DOP-C02 SDLC Automation Practice Test 7 — 15 Questions

Question 1

A developer wants to automatically run unit tests when a pull request is created in AWS CodeCommit. Which AWS service should be used to trigger the tests?

Accepted Answer

Amazon EventBridge rule for CodeCommit pull request state changes targeting AWS Lambda.. Amazon EventBridge can capture CodeCommit pull request state changes (e.g., created, updated, merged) via a rule and route them to a target like AWS Lambda. The Lambda function can then invoke unit tests in response to the pull request creation event. This provides a serverless, event-driven trigger without polling or webhooks.

Answer

AWS CodePipeline with source polling.

Answer

AWS CodeBuild with webhooks from CodeCommit.

Answer

AWS CloudWatch Logs subscription filter for repository logs.

Question 2

A company is using AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a CodeBuild step that minifies JavaScript files. Recently, the build step started failing with an error: 'Error: ENOENT: no such file or directory, open 'index.js''. What is the most likely cause?

Accepted Answer

The CodeBuild project's working directory is not set to the source directory.. The error 'ENOENT: no such file or directory, open 'index.js'' indicates that CodeBuild cannot find the file in the current working directory. This typically happens when the working directory is not set to the source directory where the file resides. Option C correctly identifies this as the most likely cause. Option D is incorrect because the buildspec.yml file does not require a 'phases' section to run.

Answer

The source code was not uploaded to S3 correctly.

Answer

The S3 bucket policy is blocking access to the source code.

Answer

The buildspec.yml file is missing the 'phases' section.

Question 3

A team uses AWS CodePipeline with multiple parallel actions in a stage. They notice that when one action fails, the entire stage fails and no further actions are attempted. They want the pipeline to continue with the remaining actions even if one fails, and then report the failure at the end. Which feature should they use?

Accepted Answer

Configure each action with 'On failure' set to 'CONTINUE'.. AWS CodePipeline allows you to set the 'On failure' property for each action to 'CONTINUE', which instructs the pipeline to proceed with subsequent actions even if that specific action fails. This ensures that all parallel actions in the stage are attempted, and the overall stage status reflects any failures at the end, rather than aborting immediately.

Answer

Configure each action with a 'RunOrder' of 1 and set 'On failure' to 'ABORT'.

Answer

Set the stage's 'On failure' to 'ROLLBACK'.

Answer

Use a custom Lambda function to catch failures and resume the pipeline.

Question 4

A company uses AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yml includes a 'post_build' phase command to tag the image. The build fails with 'unauthorized: authentication required'. What must be done to resolve this?

Accepted Answer

Add 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' permissions to the CodeBuild service role.. The error 'unauthorized: authentication required' indicates that CodeBuild's IAM role lacks the necessary permissions to push the Docker image to Amazon ECR. The correct resolution is to add the specific ECR permissions 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' to the CodeBuild service role, as these are required for the Docker push operation to upload image layers. Without these permissions, the ECR API rejects the push even if other permissions like 'ecr:GetAuthorizationToken' are present.

Answer

Use the 'docker login' command with AWS CLI in the build phase.

Answer

Install the AWS CLI in the CodeBuild build environment.

Answer

Create a new IAM user with ECR permissions and store the keys in CodeBuild environment variables.

Question 5

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda. They want to automatically deploy the latest version of the Lambda function to production after running integration tests. The source code is in AWS CodeCommit. Which pipeline configuration should they use?

Accepted Answer

CodeCommit -> CodeBuild (test) -> CodeDeploy (Lambda deployment) -> Lambda.. It uses CodeDeploy's built-in Lambda deployment support, which enables safe, gradual traffic shifting (e.g., canary or linear deployments) and automatic rollback on CloudWatch alarm failures. This pipeline integrates CodeCommit for source, CodeBuild for integration tests, and CodeDeploy to orchestrate the Lambda update with minimal risk, aligning with AWS best practices for serverless CI/CD.

Answer

CodeCommit -> CodeBuild (test) -> Lambda (deploy via update-function-code).

Answer

CodeCommit -> Lambda (deploy via S3 trigger) -> CodeBuild (test) -> production.

Answer

CodeCommit -> CodeBuild (test and deploy) -> Lambda via AWS CLI in buildspec.

Question 6

A developer is using AWS CodeCommit as a source repository for a CodePipeline. They want to automatically start the pipeline when changes are pushed to the main branch. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that triggers the pipeline on CodeCommit 'push to main' events.. Amazon EventBridge can natively capture CodeCommit repository events, such as 'push to main', and directly trigger a CodePipeline execution without any custom code or polling. This is the simplest and most serverless approach, as it requires no additional infrastructure or manual configuration of webhooks.

Answer

Add a Lambda function that is invoked by CodeCommit triggers, which then starts the pipeline.

Answer

Configure the pipeline to poll the CodeCommit repository every 5 minutes.

Answer

Use a webhook from CodeCommit to the pipeline.

Question 7

Which TWO actions are best practices when designing a CI/CD pipeline for a containerized application on Amazon ECS? (Choose two.)

Accepted Answer

Separate the build stage from the deploy stage in the pipeline.. Separating the build stage from the deploy stage in a CI/CD pipeline for Amazon ECS ensures that the Docker image is built, tested, and validated independently before being promoted to production. This decoupling allows you to reuse the same immutable artifact across multiple environments (e.g., dev, staging, prod), reducing the risk of environment-specific build inconsistencies and enabling rollback to a known good image.

Answer

Run a full integration test suite on every commit to the repository.

Answer

Build the Docker image in the deploy stage to ensure consistency.

Answer

Use a rolling update with a fixed number of tasks for deployment.

Question 8

Which THREE steps are required to set up a cross-account CodePipeline that deploys to an EC2 instance in a target account? (Choose three.)

Accepted Answer

Create an IAM role in the target account with permissions to deploy to EC2.. The target account must have an IAM role that grants permissions to deploy to EC2 (e.g., ec2:RunInstances, ssm:SendCommand). This role is assumed by the pipeline in the source account to perform deployments in the target account, following the cross-account access pattern using IAM roles.

Answer

Configure the pipeline to use the target account's default KMS key for artifacts.

Answer

Create a CodePipeline in the target account.

Question 9

Which TWO are valid use cases for using AWS CodeArtifact in a CI/CD pipeline? (Choose two.)

Accepted Answer

Caching dependencies from public repositories to improve build speed and reliability.. CodeArtifact can act as a proxy cache for public repositories like npm, PyPI, Maven, and NuGet. By caching dependencies locally, it reduces reliance on external sources, improves build speed by avoiding repeated downloads, and increases reliability by insulating the pipeline from outages or rate limits of public registries.

Answer

Storing Docker images that are used by ECS tasks.

Answer

Storing source code archives for use in deployment stages.

Answer

Hosting static website assets for deployment to S3.

Question 10

Which THREE practices help ensure the security of a CI/CD pipeline that deploys to production? (Choose three.)

Accepted Answer

Integrate static code analysis and vulnerability scanning into the pipeline.. Static code analysis and vulnerability scanning (option A) are essential for identifying security flaws early in the development lifecycle, preventing vulnerable code from reaching production. Integrating these tools into the CI/CD pipeline ensures that every commit is automatically checked against known vulnerabilities and coding standards, reducing the risk of deploying exploitable code.

Answer

Require manual approval for all deployments to production.

Answer

Store deployment credentials in the source repository for traceability.

Question 11

A DevOps engineer is creating a CodePipeline service role. The above IAM policy is attached to the role. The pipeline fails when trying to download artifacts from the S3 bucket. What is the issue?

Accepted Answer

The policy is missing s3:ListBucket permission on the bucket.. The pipeline fails because the IAM policy grants s3:GetObject on the object ARN but lacks s3:ListBucket on the bucket ARN. CodePipeline's S3 artifact download action first calls ListBucket to verify the bucket exists and the object key is accessible before performing the GetObject call. Without s3:ListBucket, the initial validation fails, causing the pipeline to error out even though GetObject is allowed.

Answer

The Resource for S3 actions should be the bucket ARN, not the object ARN.

Answer

The CodeDeploy actions require a specific resource ARN instead of '*'.

Answer

The Action list is missing s3:GetObjectVersion.

Question 12

A company is using AWS CodeCommit for source control and wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created against the main branch. Which AWS service should be used to connect CodeCommit events to CodeBuild?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct choice because it can capture CodeCommit repository events (such as pull request creation) via a default event bus and route them to targets like CodeBuild. This allows you to define a rule that matches the 'codecommit: PullRequestCreated' event and triggers a CodeBuild project directly, without needing an intermediary pipeline or compute service.

Answer

AWS CodePipeline

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 13

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own CodeCommit repository and must be built and deployed independently. The team wants to minimize manual configuration and ensure that adding a new microservice automatically creates the corresponding pipeline stages. Which approach should the team use?

Accepted Answer

Define a CloudFormation template that creates a pipeline for a given repository and invoke it automatically when a new repository is created using EventBridge and Lambda.. It uses an event-driven approach: EventBridge detects the creation of a new CodeCommit repository, triggers a Lambda function that invokes a CloudFormation template to create a corresponding CodePipeline. This fully automates pipeline provisioning for new microservices without manual intervention, aligning with the requirement to minimize manual configuration.

Answer

Create a separate AWS CodePipeline for each microservice manually using the AWS Management Console.

Answer

Use the AWS Cloud Development Kit (CDK) to define a pipeline that dynamically discovers repositories.

Answer

Use a single AWS CodePipeline with multiple stages, each triggered by a different branch of the same repository.

Question 14

A development team uses AWS CodeBuild to run unit tests on every commit to the develop branch. The tests take a long time because they download dependencies each time. What should the team do to reduce build time?

Accepted Answer

Enable the local cache feature in CodeBuild.. Enabling the local cache feature in CodeBuild allows the build environment to cache dependencies, such as Maven or npm packages, in a local directory that persists across builds. This avoids re-downloading unchanged dependencies on every commit, significantly reducing build time. The cache can be stored in an S3 bucket or locally on the build instance, and is automatically restored at the start of each build.

Answer

Store dependencies in Amazon Elastic File System (EFS) and mount it during builds.

Answer

Increase the compute type of the build environment.

Answer

Use multiple builds in parallel for the same commit.

Question 15

A company is implementing a blue/green deployment strategy for an application running on Amazon ECS with AWS Fargate. The team wants to use AWS CodeDeploy to orchestrate the deployment. What is the minimum IAM permissions needed for CodeDeploy to register the new task set and shift traffic?

Accepted Answer

ecs:RegisterTaskDefinition, ecs:UpdateService, iam:PassRole. The minimum IAM permissions required for AWS CodeDeploy to orchestrate a blue/green deployment on Amazon ECS with Fargate include ecs:RegisterTaskDefinition (to register the new task definition), ecs:UpdateService (to update the service to use the new task set), and iam:PassRole (to pass the task execution role and task role to ECS). The elasticloadbalancing:RegisterTargets is not required because CodeDeploy relies on ECS to register tasks with the load balancer. Therefore, option C is correct. Option A includes elasticloadbalancing:RegisterTargets which is not needed and omits iam:PassRole, making it insufficient. Option B misses both ecs:UpdateService and iam:PassRole. Option D uses ecs:CreateService (not needed) and a legacy load balancer action.

Answer

ecs:RegisterTaskDefinition, ecs:UpdateService, elasticloadbalancing:RegisterTargets

Answer

ecs:RegisterTaskDefinition, elasticloadbalancing:RegisterTargets

Answer

ecs:CreateService, ecs:UpdateService, elasticloadbalancing:RegisterInstancesWithLoadBalancer