DOP-C02 SDLC Automation Practice Test 6 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a Source stage from CodeCommit and a Deploy stage that syncs the contents to an S3 bucket. The deployment fails intermittently with a 'BucketNotEmpty' error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket has versioning enabled, and the deploy action is trying to delete the bucket before syncing.. The 'BucketNotEmpty' error occurs when attempting to delete an S3 bucket that still contains objects. With versioning enabled, the deploy action attempts to delete the bucket before syncing new content, but the bucket cannot be deleted because it contains versioned objects or delete markers. Options B, C, and D are incorrect: B describes a non-standard feature, C would cause an AccessDenied error, and D also results in AccessDenied, not BucketNotEmpty.

Answer

The source artifact from CodeCommit contains a 'delete' manifest that instructs S3 to remove all files.

Answer

The CodePipeline service role does not have permission to list the bucket contents.

Answer

The S3 bucket has a bucket policy that denies DeleteObject permissions.

Question 2

A DevOps team is using AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer, an Auto Scaling group, and an RDS database. They want to update the stack to change the instance type of the Auto Scaling group without downtime. Which three steps should they take? (Choose THREE.)

Accepted Answer

Create a new Auto Scaling group with the new instance type and attach it to the load balancer, then delete the old group.. Option A is correct because creating a new Auto Scaling group with the desired instance type and attaching it to the same Application Load Balancer lets new capacity come online and serve traffic before the old group is deleted, achieving a zero-downtime blue/green style replacement. Option C is correct because the instance type is defined in the Auto Scaling group's launch template (or legacy launch configuration), so updating that launch template/configuration to the new instance type is the required configuration change. Option E is correct because CloudFormation UpdatePolicy with AutoScalingRollingUpdate using MinInstancesInService, MaxBatchSize of 1, and a PauseTime performs a rolling replacement that keeps instances in service and avoids downtime. Option B is not correct because RDS instance type is unrelated to EC2 instance type and changing it is unnecessary and could cause an outage. Option D is not correct because terminating all instances before updating the launch configuration causes downtime and defeats the goal of a zero-downtime update.

Answer

Modify the RDS instance type to match the new EC2 instance type for consistency.

Answer

Terminate all instances in the Auto Scaling group before updating the launch configuration.

Question 3

Your company has a CI/CD pipeline for a Java web application using AWS CodePipeline, CodeBuild, and CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy to EC2 instances in an Auto Scaling group). Recently, after a change to the buildspec, the Build stage succeeds but the Deploy stage fails with the error 'The deployment failed because the deployment group exceeded the minimum healthy host count.' The CodeDeploy deployment configuration uses a 'OneAtATime' deployment with a minimum healthy host count of 1. The Auto Scaling group has a minimum size of 2 and a maximum size of 4. The application runs on Amazon Linux 2 instances. The CodeDeploy agent is installed and running on all instances. What is the most likely cause of the failure?

Accepted Answer

The new build artifact is larger, causing the instances to run out of disk space during deployment, which prevents the CodeDeploy agent from completing the deployment.. The most likely cause is that the new build artifact is larger, causing instances to run out of disk space during deployment, which prevents the CodeDeploy agent from completing the deployment. With a OneAtATime deployment and minimum healthy host count of 1, if the agent fails due to disk space, the deployment cannot proceed and the healthy host count is exceeded.

Answer

The CodeDeploy agent on some instances has been stopped or is not responding.

Answer

The Auto Scaling group is using a different Amazon Machine Image (AMI) that lacks the CodeDeploy agent.

Answer

The CodeDeploy service role does not have permission to describe the Auto Scaling group.

Question 4

You are a DevOps engineer for a company that runs a containerized microservices application on Amazon ECS with Fargate. The CI/CD pipeline uses AWS CodePipeline, with CodeBuild for building Docker images and pushing them to Amazon ECR, and CodeDeploy for deploying to ECS. The pipeline has a manual approval step before production deployment. Recently, the production deployment failed after approval, with the error: 'The service my-service could not be deployed because the task definition arn:aws:ecs:us-east-1:123456789012:task-definition/my-task:5 references an image that does not exist in the repository.' The image was built and pushed successfully in the Build stage. The task definition is updated by CodeDeploy to reference the new image URI. The ECS service is configured with 'deploymentController: CODE_DEPLOY' and uses a blue/green deployment. The CodeDeploy deployment group uses a 'Lambda' compute platform (incorrectly set). The pipeline uses the default CodeDeploy provider for ECS. What is the most likely cause of the failure?

Accepted Answer

The CodeDeploy deployment group's compute platform is set to 'Lambda' instead of 'ECS'.. CodeDeploy for ECS requires the compute platform to be 'ECS' (or 'Server' for EC2), not 'Lambda'. Setting it to 'Lambda' causes the deployment to fail because CodeDeploy then expects a Lambda function instead of an ECS service, leading to the error that the task definition references a non-existent image. Option B is incorrect because the manual approval step does not change the task definition ARN. Option C is incorrect because the image was built and pushed successfully, and no lifecycle policy expired it. Option D is incorrect because the pipeline is configured to use the CodeDeploy provider for ECS (the default provider).

Answer

The manual approval step changed the task definition ARN to a previous version.

Answer

The ECR repository has a lifecycle policy that expired the image tag before deployment.

Answer

The CodePipeline is not configured to use the CodeDeploy provider for ECS.

Question 5

A company is implementing a blue/green deployment strategy for a microservice hosted on AWS Elastic Beanstalk. They want to minimize downtime and be able to quickly roll back in case of issues. The deployment must support traffic shifting gradually. Which configuration should they use?

Accepted Answer

Use a blue/green deployment with a Classic Load Balancer and swap environment URLs.. Elastic Beanstalk's blue/green deployment with a Classic Load Balancer and environment URL swap allows you to shift traffic gradually by pre-warming the new environment and then swapping the CNAME records. This minimizes downtime and provides a straightforward rollback by swapping back to the original environment URL. The URL swap is atomic and does not require DNS propagation delays, enabling rapid recovery.

Answer

Use immutable updates with a fixed percentage of instances.

Answer

Use rolling updates with a batch size of 100%.

Answer

Use canary deployments by configuring the Elastic Load Balancer listener rules.

Question 6

A company uses AWS CodeBuild to run unit tests as part of their CI/CD pipeline. The tests are memory-intensive and occasionally fail due to insufficient memory. The buildspec.yml file uses the default compute type. What is the most cost-effective solution to resolve the memory issue?

Accepted Answer

Change the build project's compute type to a larger instance (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM).. Increasing the compute type (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM) directly provides more memory for the build environment, resolving the out-of-memory failures. This is the most cost-effective solution as it only increases resources for the specific build project that needs them, without requiring architectural changes or additional build projects.

Answer

Use a custom build environment with the same compute type.

Answer

Enable local caching in the build project to reduce disk I/O.

Answer

Split the tests into multiple build projects and run them in parallel.

Question 7

A DevOps engineer needs to deploy a serverless application using AWS CodeDeploy with a Lambda deployment group. The application uses AWS Lambda functions. The engineer wants to shift 10% of traffic to the new version initially, then gradually increase to 100%. Which deployment configuration should be used?

Accepted Answer

CodeDeployDefault.LambdaCanary10Percent5Minutes. The requirement is to initially shift 10% of traffic to the new Lambda version and then gradually increase to 100%. CodeDeployDefault.LambdaCanary10Percent5Minutes shifts 10% of traffic immediately to the new version and, after 5 minutes, automatically shifts the remaining 90% to complete the deployment. This matches the described canary deployment pattern.

Answer

CodeDeployDefault.LambdaAllAtOnce

Answer

CodeDeployDefault.LambdaCanary10Percent10Minutes

Answer

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

Question 8

Your organization uses AWS CodePipeline to orchestrate a multi-stage pipeline for a Java application. The pipeline has a source stage (Amazon S3), a build stage (CodeBuild), and a deploy stage (CodeDeploy to EC2). Recently, the build stage started failing with the error 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE'. The build project uses a managed image for Java. You checked the CodeBuild project settings and confirmed that the image is correct. No changes were made to the build project. What is the most likely cause?

Accepted Answer

The Docker image specified in the build project is no longer available or the registry is unreachable.. The managed image may have been updated and the pull failed due to network issues. Option A is wrong because the source is S3, not CodeCommit. Option B is wrong because environment variables are not related to the image pull error. Option D is wrong because the buildspec.yml syntax does not affect image pulling.

Answer

The S3 bucket policy has been changed to deny access.

Answer

The build project's environment variables are incorrectly configured.

Answer

The buildspec.yml file contains invalid syntax.

Question 9

A company is designing a CI/CD pipeline using AWS CodePipeline. They want to automatically run unit tests when a pull request is created in AWS CodeCommit. Which TWO actions should be taken to implement this?

Accepted Answer

Include a buildspec file in the repository that defines the unit test commands.. Option A is correct because AWS CodeBuild executes the build and test commands defined in a buildspec.yml file stored in the repository, so including a buildspec that defines the unit test commands is how the tests actually get run. Option E is correct because CodeBuild supports webhook triggers that can be configured to fire on CodeCommit pull request events (e.g., PULL_REQUEST_CREATED), which is the mechanism that automatically starts the test build when a PR is created. Option B is not appropriate because CodePipeline's source actions support CodeCommit branch/commit events, not a native 'pull request' source action for triggering on PR creation. Option C is unnecessary and overly complex since CodeBuild webhooks natively handle CodeCommit PR events without needing a CloudWatch Events rule plus Lambda. Option D is wrong because CodeDeploy is a deployment service, not a unit-test runner, and unit tests belong in CodeBuild.

Answer

Configure a CodePipeline stage that uses the pull request source action.

Answer

Set up an Amazon CloudWatch Events rule to detect pull request creation and invoke an AWS Lambda function that starts CodeBuild.

Answer

Add a CodeDeploy deployment group to run the tests on an EC2 instance.

Question 10

An organization uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is 'Blue/Green'. After a successful deployment, traffic is routed to the new instances. However, the application experiences errors because the new instances cannot connect to the database. Which TWO configuration changes could resolve this issue?

Accepted Answer

Update the security group of the new instances to allow outbound traffic to the database security group.. In a Blue/Green deployment, new instances are created with a new security group. If the database security group only allows inbound traffic from the old instances' security group, the new instances will be blocked. Updating the new instances' security group to allow outbound traffic to the database, or adding the new security group to the database's inbound rule, resolves the connectivity issue. Option C is incorrect; configuring the database to use a DNS name that resolves to the new instances would not help—the database's DNS name should resolve to the database itself, not to the instances. The issue is that the new instances cannot connect to the database, not the other way around.

Answer

Modify the CodeDeploy deployment group to include the database security group.

Answer

Configure the database to use a DNS name that resolves to the new instances after the deployment.

Answer

Increase the number of instances in the Auto Scaling group.

Answer

Reinstall the CodeDeploy agent on the new instances.

Question 11

A startup is using AWS CodeCommit to store their application code. They have set up a CI/CD pipeline with AWS CodePipeline and AWS CodeBuild. The pipeline consists of a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using AWS CodeDeploy to deploy to an Auto Scaling group of EC2 instances. Recently, a developer committed code that introduced a critical bug, and the pipeline automatically deployed the bug to production, causing an outage. The team wants to implement a manual approval step before production deployment. They also want to ensure that the approval step is only required for deployments to the production environment, not for development or testing. Which solution should they implement?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage. Configure the approval to require a designated approver.. CodePipeline supports manual approval actions that can be added as a stage before production deployment. By configuring separate pipelines or stages for different environments, the approval step can be limited to production. Option B is wrong because CodeDeploy does not have approval workflows. Option C is wrong because CloudWatch Events does not provide manual approval. Option D is wrong because SNS is for notifications, not approvals.

Answer

Configure the CodeDeploy deployment group to require approval before deploying to any instance.

Answer

Use Amazon Simple Notification Service (SNS) to send a notification to the team and have them manually stop the pipeline if needed.

Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an approval request via email and pauses the pipeline until approved.

Question 12

A large enterprise is using AWS CloudFormation to manage their infrastructure. They have a master template that orchestrates nested stacks for different components: VPC, application, and database. The VPC stack creates subnets, route tables, and security groups. The application stack creates EC2 instances and an Application Load Balancer. The database stack creates an RDS instance. The master template uses parameters to pass configuration values. Recently, when updating the application stack, the update failed because the security group ID from the VPC stack changed, and the application stack references the old security group ID. The team wants to ensure that when the VPC stack is updated, dependent stacks are automatically updated to use the new outputs. Which approach should they take?

Accepted Answer

Use the Fn::ImportValue intrinsic function in the application stack to import the security group ID from the VPC stack's exports.. Fn::ImportValue is still the correct built-in mechanism to reference another stack's output value across stacks, and is the best of the four given options, but it does not provide automatic propagation: after the VPC stack changes an exported value, each importing stack (e.g., the application stack) must itself be updated to pick up the new value, and CloudFormation will actually prevent the VPC stack from changing/removing an export that is currently imported elsewhere. The explanation should not claim CloudFormation auto-updates importing stacks.

Answer

Use the Fn::GetAtt intrinsic function in the application stack to directly reference the security group from the VPC stack.

Answer

Hardcode the security group ID in the application template to avoid changes.

Answer

Configure the master template to automatically update all nested stacks whenever any output changes.

Question 13

A team is using AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild (which runs unit tests and packages the Lambda code), and a deploy stage using AWS CloudFormation to update a stack that contains the Lambda function and API Gateway. The deployment stage uses a CloudFormation template that creates the Lambda function and API Gateway. Recently, the deployment stage started failing with the error: 'The API Gateway deployment already exists'. The team has not changed the template. What is the most likely cause?

Accepted Answer

The CloudFormation template uses a fixed physical name for the deployment resource, causing a conflict when CloudFormation tries to create a new deployment with the same name.. The error 'The API Gateway deployment already exists' occurs when CloudFormation attempts to create an AWS::ApiGateway::Deployment resource whose logical ID or physical name collides with an existing deployment. This typically happens when the template hardcodes a DeploymentId or StageName, or when the deployment resource lacks a unique identifier tied to a change, so CloudFormation tries to recreate a deployment that already exists in API Gateway. Option A correctly identifies the fixed physical name as the root cause.

Answer

The Lambda function does not have permission to be invoked by API Gateway.

Answer

The account has reached the limit for API Gateway deployments.

Answer

The API Gateway stage name is being changed in the template.

Question 14

A company uses multiple AWS accounts: one for development, one for testing, and one for production. They want to implement a CI/CD pipeline using AWS CodePipeline that deploys the same application to all three accounts. The source code is stored in a CodeCommit repository in the development account. The pipeline should first build the application, then deploy to development, then after approval, deploy to testing, and finally after another approval, deploy to production. The deployment uses AWS CodeDeploy to deploy to EC2 instances in each account. The pipeline will be created in the development account. Which configuration will allow the pipeline to deploy to the testing and production accounts?

Accepted Answer

Create IAM roles in the testing and production accounts that grant CodeDeploy permissions, and configure the pipeline to assume those roles using the CodePipeline cross-account action.. CodePipeline supports cross-account actions by allowing the pipeline in the development (tooling) account to assume an IAM role in the target account. The role in the testing/production account must trust the pipeline's role and grant permissions for CodeDeploy (and typically S3 artifact access). The pipeline's deploy action is then configured with the target account ID and the role ARN, enabling CodeDeploy to run in that account. This is the AWS-recommended pattern for multi-account CI/CD.

Answer

Establish VPC peering between the accounts and allow the pipeline to communicate directly with CodeDeploy in the other accounts.

Answer

Create IAM users in testing and production accounts with programmatic access, and configure the pipeline to use those credentials.

Answer

Use AWS Organizations to create a shared service and grant the pipeline full access to all accounts.

Question 15

A company uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. They want to enforce that every commit triggers a build, but only if the commit message contains a specific pattern 'BUILD:'. Which THREE steps are required?

Accepted Answer

Configure a webhook in CodeBuild that filters events by commit message pattern.. Option C is correct because CodeBuild supports webhook-based triggers for CodeCommit repositories, and the webhook's filter groups can include a filter on the commit message (using the pattern/HEAD_REF-style filters) so builds only start when the message matches 'BUILD:'. Option E is correct because the buildspec.yml defines the build phases, and a conditional phase (for example, using shell logic in pre_build/install to inspect CODEBUILD_WEBHOOK_TRIGGER or the commit message) ensures the build proceeds only when the required pattern is present. Option A is not required because CodeBuild's native webhook filtering handles the commit-message condition without a custom Lambda. Option B is not correct because a CloudWatch Events (EventBridge) rule alone cannot filter on the commit message content and would trigger builds on every push. Option D is not correct because CodeCommit does not provide a custom trigger that directly invokes CodeBuild; the supported integration is the CodeBuild webhook.

Answer

Create an AWS Lambda function that processes the commit message and calls CodeBuild.

Answer

Create a CloudWatch Events rule to invoke CodeBuild on every push to CodeCommit.

Answer

Create a custom trigger in CodeCommit that invokes CodeBuild.