DOP-C02 SDLC Automation Practice Test 7 — 15 Questions

Question 1

An organization uses AWS CodeBuild to run integration tests. The tests require a large amount of memory and CPU, and they often timeout after the default 60 minutes. What is the MOST efficient way to increase the timeout and allocate more resources?

Accepted Answer

Modify the buildspec.yml file to include 'compute-type' and 'timeout-in-minutes' overrides.. Option D is correct because the buildspec allows setting compute type and timeout via 'compute-type' and 'timeout-in-minutes' overrides. Option A is incorrect because Lambda has a 15-minute limit. Option B is incorrect because only large instance types are suitable. Option C is incorrect because CloudWatch does not control build resources.

Answer

Use Amazon CloudWatch to monitor the build and automatically restart it if it times out.

Answer

Use AWS Lambda instead of CodeBuild, as it can run up to 15 minutes.

Answer

Select a larger instance type in the CodeBuild project configuration, such as 'BUILD_GENERAL1_LARGE'.

Question 2

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to deploy a CloudFormation stack set to all accounts in the organization. Which IAM permissions are REQUIRED for the stack set execution role?

Accepted Answer

iam:PassRole. Option B is correct because the stack set execution role must be able to pass the stack set's administrative role to CloudFormation in each target account. Option A is incorrect because 'cloudformation:CreateStackSet' is needed for the admin role, not the execution role. Option C is incorrect because 'iam:*' is overly permissive. Option D is incorrect because 'sts:AssumeRole' is needed but not sufficient on its own.

Answer

sts:AssumeRole

Answer

cloudformation:CreateStackSet

Answer

iam:*

Question 3

A developer wants to automatically deploy a new version of an AWS Lambda function whenever code is pushed to a specific branch in AWS CodeCommit. Which combination of services should be used?

Accepted Answer

AWS CodeCommit, Amazon EventBridge, AWS CodePipeline. Option A is correct because CodeCommit triggers an EventBridge event, which can invoke a pipeline or Lambda. Option B is incorrect because S3 is not needed. Option C is incorrect because CodeBuild alone does not deploy. Option D is incorrect because CloudWatch Logs is for monitoring.

Answer

AWS CodeCommit, Amazon S3, AWS Lambda

Answer

AWS CodeCommit, AWS CodeBuild

Answer

AWS CodeCommit, Amazon CloudWatch Logs

Question 4

A company uses AWS CodeDeploy with a blue/green deployment strategy for an Amazon EC2 Auto Scaling group. During deployment, the new instances are failing health checks and the deployment is rolling back. What is the MOST likely cause?

Accepted Answer

The new instances are not passing the configured health check grace period.. Option C is correct because failing health checks indicate the new instances are not ready. Option A is incorrect because CodeDeploy agent not running would cause a different error. Option B is incorrect because blue/green typically uses an ELB. Option D is incorrect because the deployment group already targets the ASG.

Answer

The application is not registered with an Elastic Load Balancer.

Answer

The deployment group is not configured to use an Auto Scaling group.

Answer

The CodeDeploy agent is not installed on the new instances.

Question 5

A team uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The deployment fails with an error: 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used in the deploy stage does not have permission to assume the CloudFormation execution role.. Option B is correct because 'sam deploy' requires valid AWS credentials; if the IAM role used by CodePipeline has insufficient permissions, it cannot assume the deployment role. Option A is incorrect because the build stage succeeded. Option C is incorrect because the template is already built. Option D is incorrect because the error points to credentials, not a missing parameter.

Answer

The build stage did not produce the correct output artifact.

Answer

The SAM template has a syntax error.

Answer

The 'sam deploy' command is missing the '--capabilities' parameter.

Question 6

A company wants to enforce that all infrastructure changes go through a CI/CD pipeline. Which AWS service can be used to prevent direct changes to production resources?

Accepted Answer

AWS Config. Option D is correct because AWS Config rules can detect changes and trigger remediation. Option A is incorrect because IAM alone does not prevent changes. Option B is incorrect because CloudTrail is for auditing. Option C is incorrect because Service Catalog is for pre-approved products.

Answer

AWS Service Catalog

Answer

AWS IAM

Answer

AWS CloudTrail

Question 7

A DevOps engineer is troubleshooting a failed CodePipeline execution. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage succeeds, but the deploy stage fails with 'No deployments found for the specified deployment group.' Which TWO actions should the engineer take to resolve this?

Accepted Answer

Confirm that the CodeDeploy deployment group exists in the same AWS Region as the pipeline.. Options A and D are correct. The error suggests the pipeline cannot find the deployment group, often due to incorrect configuration or region mismatch. Checking the deploy stage configuration ensures the deployment group name is correct. Verifying the deployment group exists confirms it's not deleted. Option B is unnecessary if the build succeeded. Option C is unrelated. Option E is about IAM, but the error message is about missing deployment group.

Answer

Update the IAM role for CodePipeline to allow it to list deployment groups.

Answer

Check the CodeBuild build logs for errors.

Answer

Ensure the CodeCommit repository has a valid commit.

Question 8

A company uses AWS CodeBuild to run security scans on code. The scan requires access to a private Amazon ECR repository for downloading scanning tools. The CodeBuild project is configured with a VPC and uses an IAM role. However, the build fails with 'Error: unable to pull image from registry.' Which TWO steps should be taken to resolve this?

Accepted Answer

Add 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to the CodeBuild service role.. Options A and C are correct. The error suggests the build environment cannot authenticate or reach ECR. Adding ECR permissions to the IAM role allows pulling images. Configuring VPC endpoints allows the build to reach ECR privately without NAT. Option B is unnecessary if the build already has a VPC. Option D is for public access, but the repository is private. Option E is about KMS, not related.

Answer

Change the ECR repository policy to allow public access.

Answer

Remove the VPC configuration from the CodeBuild project so it can access the public internet.

Answer

Grant 'kms:Decrypt' permissions for the KMS key used by ECR.

Question 9

A company wants to implement a CI/CD pipeline for an application that runs on Amazon ECS with Fargate. The pipeline should build a Docker image, push it to Amazon ECR, and deploy a new task definition to ECS. Which THREE AWS services are required to build this pipeline?

Accepted Answer

AWS CodeDeploy. Options A, B, and D are correct. CodeBuild builds the Docker image and pushes it to ECR. CodePipeline orchestrates the stages. CodeDeploy (or ECS directly) deploys the new task definition. Option C is not a deployment service. Option E is not needed because ECR is used.

Answer

Amazon S3

Answer

AWS CodeCommit

Question 10

Refer to the exhibit. A CodePipeline service role has this IAM policy attached. The pipeline's deploy stage uses CodeDeploy to perform an ECS blue/green deployment. The deployment fails with an access denied error. What is the MOST likely missing permission?

Accepted Answer

ecs:UpdateService. Option C is correct because ECS blue/green deployments require the 'ecs:UpdateService' permission to update the service with the new task definition. The policy only allows 'ecs:DescribeServices'. Option A is not needed for blue/green. Option B is needed but already allowed. Option D is not a standard action.

Answer

ecs:RegisterTaskDefinition

Answer

codedeploy:CreateDeployment

Answer

ecs:CreateService

Question 11

Refer to the exhibit. A developer runs this buildspec in CodeBuild to deploy a CDK application. The build succeeds, but the CDK stack is not deployed. What is the MOST likely reason?

Accepted Answer

The CDK application has not been bootstrapped in the target account.. Option A is correct because CDK synth outputs to 'cdk.out' by default, but the artifacts specify 'cdk.out' as base-directory, so the deploy command runs in the build environment, not from the artifacts. However, the issue is that 'cdk deploy' runs in the build phase but the artifacts are collected after; but actually the deploy should happen in post_build. The more likely reason is that the CDK stack requires bootstrapping. Option B is incorrect because the runtime is sufficient. Option C is incorrect because the commands are valid. Option D is incorrect because the permissions might be missing, but the error would be different.

Answer

The 'npx cdk deploy' command should be in the build phase, not post_build.

Answer

The Node.js runtime version 14 is incompatible with the CDK version.

Answer

The IAM role for CodeBuild does not have permission to create CloudFormation stacks.

Question 12

Refer to the exhibit. A DevOps engineer sees this output when listing pipelines. The pipeline 'my-app-pipeline' has execution mode set to 'QUEUED'. The team reports that when multiple commits are pushed simultaneously, only the latest commit is deployed, and earlier ones are skipped. How should the pipeline execution mode be changed to ensure all commits are deployed?

Accepted Answer

Change the execution mode to 'PARALLEL'.. Option B is correct because 'PARALLEL' execution mode allows multiple pipeline executions to run concurrently, one per commit. Option A is incorrect because 'SUPERSEDED' would replace the current execution with a new one. Option C is incorrect because 'SERIAL' would queue them but run one at a time, potentially still skipping if a newer one supersedes. Option D is incorrect because V2 pipelines support only 'QUEUED' and 'SUPERSEDED', not 'PARALLEL'.

Answer

Change the execution mode to 'SUPERSEDED'.

Answer

Upgrade the pipeline to V2 type which supports 'QUEUED' mode.

Answer

Change the execution mode to 'SERIAL'.

Question 13

A company uses AWS CodePipeline with an S3 source action and a CodeBuild project. The pipeline fails intermittently during the build stage with an error indicating that the source code archive is corrupt. Which action should the DevOps engineer take to resolve this issue?

Accepted Answer

Enable versioning on the S3 bucket and use versioned objects in the pipeline.. Enabling versioning on the S3 bucket ensures that object versions are preserved, preventing corruption from overwrites. Option D is correct because using S3 source with versioning guarantees that the pipeline always retrieves the correct version.

Answer

Increase the timeout for the CodeBuild project.

Answer

Configure the pipeline to use AWS CodeCommit as the source instead of S3.

Answer

Add a manual approval step before the build stage.

Question 14

A DevOps team is implementing a CI/CD pipeline for a microservices architecture on AWS ECS. They want to ensure zero-downtime deployments and automatic rollback if health checks fail. Which combination of services should they use?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment and CloudWatch alarms for automatic rollback.. CodeDeploy with ECS blue/green deployment and CloudWatch alarms for rollback provides zero-downtime and automatic rollback. Option B is correct.

Answer

AWS CodePipeline with ECS rolling update and manual rollback.

Answer

AWS Elastic Beanstalk with rolling deployment and enhanced health reporting.

Answer

AWS CloudFormation with ECS service update and SNS notification on failure.

Question 15

A developer wants to automatically run unit tests when a pull request is created in AWS CodeCommit. Which AWS service should be used to trigger the tests?

Accepted Answer

Amazon EventBridge rule for CodeCommit pull request state changes targeting AWS Lambda.. CodeCommit can trigger Amazon EventBridge events on pull request creation, which can invoke a Lambda function to run tests. Option C is correct.

Answer

AWS CodePipeline with source polling.

Answer

AWS CodeBuild with webhooks from CodeCommit.

Answer

AWS CloudWatch Logs subscription filter for repository logs.