DOP-C02 SDLC Automation Practice Test 6 — 15 Questions

Question 1

A developer wants to automate the creation of a new Amazon ECS service whenever a new Docker image is pushed to Amazon ECR. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture ECR image push events (via the 'ECR Image Action' event type) and route them to a target such as an ECS service or a Lambda function that triggers an ECS service update or creation. This serverless event bus natively integrates with ECR and ECS, making it the simplest and most direct service to orchestrate the workflow without custom polling or additional orchestration logic.

Answer

AWS Step Functions

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Question 2

An organization uses AWS CodeBuild to run integration tests. The tests require a large amount of memory and CPU, and they often timeout after the default 60 minutes. What is the MOST efficient way to increase the timeout and allocate more resources?

Accepted Answer

Select a larger instance type in the CodeBuild project configuration, such as 'BUILD_GENERAL1_LARGE'.. In AWS CodeBuild, the compute type (e.g., BUILD_GENERAL1_LARGE) is a project-level configuration, not a buildspec override. To increase memory and CPU, you must select a larger compute type in the CodeBuild project settings. Additionally, the timeout can be increased in the project configuration or via the AWS CLI/API, not in the buildspec.yml. This approach is the most efficient and reliable way to allocate more resources and extend the timeout.

Answer

Use Amazon CloudWatch to monitor the build and automatically restart it if it times out.

Answer

Use AWS Lambda instead of CodeBuild, as it can run up to 15 minutes.

Answer

Modify the buildspec.yml file to include 'compute-type' and 'timeout-in-minutes' overrides.

Question 3

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to deploy a CloudFormation stack set to all accounts in the organization. Which IAM permissions are REQUIRED for the stack set execution role?

Accepted Answer

iam:PassRole. The stack set execution role requires the `iam:PassRole` permission because CloudFormation uses this role to create, update, or delete stacks in target accounts. When deploying a stack set, the service passes the execution role ARN to the target accounts, and the calling principal must have `iam:PassRole` on that role to authorize the delegation. Without this permission, CloudFormation cannot assume the role in the target accounts to perform stack operations.

Answer

sts:AssumeRole

Answer

cloudformation:CreateStackSet

Answer

iam:*

Question 4

A developer wants to automatically deploy a new version of an AWS Lambda function whenever code is pushed to a specific branch in AWS CodeCommit. Which combination of services should be used?

Accepted Answer

AWS CodeCommit, Amazon EventBridge, AWS CodePipeline. AWS CodePipeline can be configured with a source stage that uses AWS CodeCommit as the source provider, and an Amazon EventBridge rule can detect push events to a specific branch in CodeCommit. When a push occurs, EventBridge triggers the pipeline execution, which then deploys the new Lambda function version automatically. This combination provides a fully managed, event-driven CI/CD pipeline for Lambda deployments.

Answer

AWS CodeCommit, Amazon S3, AWS Lambda

Answer

AWS CodeCommit, AWS CodeBuild

Answer

AWS CodeCommit, Amazon CloudWatch Logs

Question 5

A company uses AWS CodeDeploy with a blue/green deployment strategy for an Amazon EC2 Auto Scaling group. During deployment, the new instances are failing health checks and the deployment is rolling back. What is the MOST likely cause?

Accepted Answer

The new instances are not passing the configured health check grace period.. In a blue/green deployment with CodeDeploy, new instances are launched and must pass health checks before traffic is routed to them. If the health check grace period is not configured or is too short, the new instances may be deemed unhealthy before the application has fully started, triggering a rollback. This is the most likely cause because the health check grace period directly controls how long CodeDeploy waits before evaluating instance health.

Answer

The application is not registered with an Elastic Load Balancer.

Answer

The deployment group is not configured to use an Auto Scaling group.

Answer

The CodeDeploy agent is not installed on the new instances.

Question 6

A team uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The deployment fails with an error: 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used in the deploy stage does not have permission to assume the CloudFormation execution role.. The error 'The security token included in the request is invalid' typically occurs when the IAM role used by CodePipeline in the deploy stage lacks the necessary trust relationship or permissions to assume the CloudFormation execution role. In AWS SAM deployments via CodePipeline, the deploy action uses a specified IAM role to call CloudFormation, and if that role cannot assume the CloudFormation service role (or the CloudFormation role itself is misconfigured), the security token becomes invalid. This is a common misconfiguration when the pipeline's IAM role does not include the 'sts:AssumeRole' permission for the CloudFormation execution role ARN.

Answer

The build stage did not produce the correct output artifact.

Answer

The SAM template has a syntax error.

Answer

The 'sam deploy' command is missing the '--capabilities' parameter.

Question 7

A company wants to enforce that all infrastructure changes go through a CI/CD pipeline. Which AWS service can be used to prevent direct changes to production resources?

Accepted Answer

AWS Config. AWS Config can be used with AWS Config rules to evaluate resource configurations against desired policies. By creating a rule that requires all changes to go through a CI/CD pipeline (e.g., by checking that resources are tagged with a pipeline identifier or that changes are made via CloudFormation), AWS Config can detect noncompliant resources and trigger automated remediation (e.g., reverting changes or notifying administrators). This enforces the requirement that direct changes to production resources are prevented or flagged.

Answer

AWS Service Catalog

Answer

AWS IAM

Answer

AWS CloudTrail

Question 8

A DevOps engineer is troubleshooting a failed CodePipeline execution. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage succeeds, but the deploy stage fails with 'No deployments found for the specified deployment group.' Which TWO actions should the engineer take to resolve this?

Accepted Answer

Confirm that the CodeDeploy deployment group exists in the same AWS Region as the pipeline.. CodePipeline and CodeDeploy must operate in the same AWS Region. If the deployment group is in a different Region, CodePipeline cannot find it, resulting in the 'No deployments found' error. This is a common cross-Region misconfiguration that prevents the deploy stage from locating the specified deployment group.

Answer

Update the IAM role for CodePipeline to allow it to list deployment groups.

Answer

Check the CodeBuild build logs for errors.

Answer

Ensure the CodeCommit repository has a valid commit.

Question 9

A company uses AWS CodeBuild to run security scans on code. The scan requires access to a private Amazon ECR repository for downloading scanning tools. The CodeBuild project is configured with a VPC and uses an IAM role. However, the build fails with 'Error: unable to pull image from registry.' Which TWO steps should be taken to resolve this?

Accepted Answer

Add 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to the CodeBuild service role.. The CodeBuild service role must have the 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to authorize the retrieval of container image layers from the private ECR repository. Without these permissions, the Docker pull operation fails with 'unable to pull image from registry' even if network connectivity is established.

Answer

Change the ECR repository policy to allow public access.

Answer

Remove the VPC configuration from the CodeBuild project so it can access the public internet.

Answer

Grant 'kms:Decrypt' permissions for the KMS key used by ECR.

Question 10

A company wants to implement a CI/CD pipeline for an application that runs on Amazon ECS with Fargate. The pipeline should build a Docker image, push it to Amazon ECR, and deploy a new task definition to ECS. Which THREE AWS services are required to build this pipeline?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is required because it manages the deployment of the updated task definition to the ECS service, supporting strategies like blue/green and canary deployments. It integrates with AWS CodePipeline to orchestrate the deployment step, ensuring minimal downtime and rollback capabilities.

Answer

Amazon S3

Answer

AWS CodeCommit

Question 11

Refer to the exhibit. A CodePipeline service role has this IAM policy attached. The pipeline's deploy stage uses CodeDeploy to perform an ECS blue/green deployment. The deployment fails with an access denied error. What is the MOST likely missing permission?

Accepted Answer

ecs:UpdateService. In an ECS blue/green deployment via CodeDeploy, the CodePipeline service role must have permission to call ecs:UpdateService on the ECS service to trigger the deployment of the new task definition. Without this permission, CodeDeploy cannot update the ECS service to use the new task set, resulting in an access denied error. The other permissions are either already present or not directly required for the deployment action.

Answer

ecs:RegisterTaskDefinition

Answer

codedeploy:CreateDeployment

Answer

ecs:CreateService

Question 12

Refer to the exhibit. A developer runs this buildspec in CodeBuild to deploy a CDK application. The build succeeds, but the CDK stack is not deployed. What is the MOST likely reason?

Accepted Answer

The CDK application has not been bootstrapped in the target account.. The CDK stack was not deployed because the target AWS account and region must be bootstrapped before deploying CDK applications. Bootstrapping provisions the necessary resources (e.g., S3 bucket for assets, IAM roles) that CDK requires. Without bootstrapping, the `cdk deploy` command will fail silently or not execute the deployment, even if the build phase succeeds.

Answer

The 'npx cdk deploy' command should be in the build phase, not post_build.

Answer

The Node.js runtime version 14 is incompatible with the CDK version.

Answer

The IAM role for CodeBuild does not have permission to create CloudFormation stacks.

Question 13

Refer to the exhibit. A DevOps engineer sees this output when listing pipelines. The pipeline 'my-app-pipeline' has execution mode set to 'QUEUED'. The team reports that when multiple commits are pushed simultaneously, only the latest commit is deployed, and earlier ones are skipped. How should the pipeline execution mode be changed to ensure all commits are deployed?

Accepted Answer

Change the execution mode to 'PARALLEL'.. AWS CodePipeline execution modes: SUPERSEDED stops older in-progress/queued executions when a new one starts; QUEUED runs all executions sequentially in order; PARALLEL runs executions concurrently. With a QUEUED pipeline, all commits should deploy in order. Changing to PARALLEL would also deploy all commits, but it is unnecessary and does not fix a problem that cannot occur in QUEUED mode. The question should either state the current mode is SUPERSEDED, or ask which mode should be used to deploy all commits.

Answer

Change the execution mode to 'SUPERSEDED'.

Answer

Upgrade the pipeline to V2 type which supports 'QUEUED' mode.

Answer

Change the execution mode to 'SERIAL'.

Question 14

A company uses AWS CodePipeline with an S3 source action and a CodeBuild project. The pipeline fails intermittently during the build stage with an error indicating that the source code archive is corrupt. Which action should the DevOps engineer take to resolve this issue?

Accepted Answer

Enable versioning on the S3 bucket and use versioned objects in the pipeline.. The error indicates that the source code archive is corrupt, which typically occurs when a new object is uploaded to S3 while the pipeline is still referencing the old object. By enabling versioning on the S3 bucket and configuring the pipeline to use versioned objects, CodePipeline will always fetch the latest version of the object, preventing race conditions where an incomplete or overwritten archive is retrieved.

Answer

Increase the timeout for the CodeBuild project.

Answer

Configure the pipeline to use AWS CodeCommit as the source instead of S3.

Answer

Add a manual approval step before the build stage.

Question 15

A DevOps team is implementing a CI/CD pipeline for a microservices architecture on AWS ECS. They want to ensure zero-downtime deployments and automatic rollback if health checks fail. Which combination of services should they use?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment and CloudWatch alarms for automatic rollback.. AWS CodeDeploy supports blue/green deployments for ECS, which creates a new replacement task set alongside the original, allowing traffic to shift only after health checks pass. CloudWatch alarms can be configured to trigger an automatic rollback if the new deployment fails health checks, ensuring zero-downtime and automated recovery.

Answer

AWS CodePipeline with ECS rolling update and manual rollback.

Answer

AWS Elastic Beanstalk with rolling deployment and enhanced health reporting.

Answer

AWS CloudFormation with ECS service update and SNS notification on failure.