DOP-C02 SDLC Automation Practice Test 8 — 15 Questions

Question 1

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.. Caching dependencies in an Amazon S3 bucket allows CodeBuild to reuse previously downloaded Maven/Gradle dependencies across builds, eliminating the need to re-download them each time. Since the codebase and dependencies are stable, this directly reduces the build time by avoiding repeated network transfers of large artifact repositories.

Answer

Move the build process to a local developer machine to avoid CodeBuild overhead.

Answer

Reduce the number of unit tests executed in the build phase.

Answer

Increase the compute type of the build environment to a larger instance.

Question 2

A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?

Accepted Answer

Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.. It enforces branch-based deployment at the pipeline level, ensuring that only changes from specific branches trigger the production pipeline with the approval step. This approach is secure and maintainable as it leverages AWS CodePipeline's native ability to trigger on branch events, avoiding custom logic or manual verification. By isolating production deployments to a dedicated pipeline, the team reduces the risk of unauthorized or untested code reaching production.

Answer

Use a Lambda function in the pipeline to check the branch name and fail if not allowed.

Answer

Add a manual approval step in the pipeline and rely on the approver to verify the branch.

Answer

Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.

Question 3

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled JARs) to the repository, causing the repository size to grow rapidly and slowing down clone operations. The team wants to enforce a policy to reject pushes that contain files larger than 50 MB. Which approach should be used?

Accepted Answer

Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.. AWS CodeCommit supports custom triggers that invoke AWS Lambda functions on repository events, including pushes. By configuring a trigger for the 'push' event, a Lambda function can inspect each file in the push payload, check its size against the 50 MB threshold, and programmatically reject the push by returning an error response. This approach enforces the policy at the repository level without requiring client-side changes.

Answer

Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.

Answer

Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.

Answer

Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.

Question 4

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Accepted Answer

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.. The pipeline's service role must have an `sts:AssumeRole` permission on the cross-account role to perform the role assumption. Even if the trust policy on the cross-account role allows the pipeline's service role, the pipeline's service role itself needs an IAM policy granting `sts:AssumeRole` for the cross-account role ARN. Without this permission, the `AssumeRole` API call fails with 'Access Denied', which is the exact error described.

Answer

The EC2 instances in the prod account do not have an appropriate instance profile.

Answer

The cross-account role's permissions boundary denies the deploy action.

Answer

The pipeline's service role does not have permission to perform the deploy action in the prod account.

Question 5

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is Blue/Green. During a recent deployment, the new instances passed all health checks, but traffic was not routed to them. What is the most likely reason?

Accepted Answer

The target group associated with the Auto Scaling group is not properly configured to route traffic.. In a Blue/Green deployment with CodeDeploy and an Auto Scaling group, traffic routing is handled by a load balancer target group. If the target group is not properly configured to route traffic to the new instances (e.g., missing or incorrect listener rules, deregistration delay, or health check thresholds), the instances may pass health checks but never receive traffic. This is the most likely cause because the deployment succeeded in provisioning and validating the new instances, but the load balancer did not forward requests to them.

Answer

The deployment group is not configured to use a load balancer.

Answer

The Auto Scaling group's lifecycle hook failed to signal readiness.

Answer

The CodeDeploy agent on the new instances is not installed.

Question 6

A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the external system does not overwrite the object after the pipeline execution starts.. The deploy stage fails with 'The S3 object does not exist' when the external system overwrites the source artifact after the pipeline execution starts. CodePipeline references the object by its key at the time the pipeline is triggered; if the object is replaced (i.e., deleted and re-uploaded with the same key), the pipeline may attempt to download a version that no longer exists, especially if the S3 bucket is not versioned. Ensuring the external system does not overwrite the object during execution prevents this race condition.

Answer

Change the source stage to use AWS CodeCommit instead of S3.

Answer

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Answer

Increase the timeout for the deploy stage in the pipeline.

Question 7

A large enterprise uses a multi-account AWS strategy with a centralized DevOps account. The DevOps account hosts an AWS CodePipeline that deploys a critical application to production account (111111111111) using AWS CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy). The deploy stage uses a cross-account role (arn:aws:iam::111111111111:role/CrossAccountDeployRole) to perform the deployment. The trust policy on that role allows the DevOps account's CodePipeline service role (arn:aws:iam::222222222222:role/CodePipelineServiceRole) to assume it. The pipeline has been working for months, but after a recent security audit, the security team tightened permissions. Now the deploy stage fails with the error: 'User: arn:aws:sts::222222222222:assumed-role/CodePipelineServiceRole/AWS-CodePipeline-xxx is not authorized to perform: codedeploy:CreateDeployment on resource: arn:aws:codedeploy:us-east-1:111111111111:deploymentgroup:MyApp/MyDG'. The DevOps team has verified that the CrossAccountDeployRole has a permissions policy that allows 'codedeploy:*' on all resources. The CodePipelineServiceRole has a permissions policy that allows 'sts:AssumeRole' on the CrossAccountDeployRole. What is the most likely cause and what action should be taken to resolve the issue?

Accepted Answer

Check the permissions boundary on CrossAccountDeployRole and add a boundary that allows CodeDeploy actions.. The error indicates that the assumed role (CrossAccountDeployRole) is not authorized to perform codedeploy:CreateDeployment, despite having a permissions policy that allows codedeploy:* on all resources. This typically occurs when a permissions boundary is attached to the role that restricts the effective permissions, overriding the permissions policy. Adding a permissions boundary that allows CodeDeploy actions resolves the issue by ensuring the role's effective permissions include the necessary CodeDeploy operations.

Answer

Add 'sts:AssumeRole' to the permissions policy of CodePipelineServiceRole.

Answer

Create the deployment group in the production account again to reset permissions.

Answer

Update the trust policy of CrossAccountDeployRole to include the DevOps account ID.

Question 8

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. They have configured a CodeBuild project that triggers on pushes to the 'develop' branch. The build runs unit tests and packages the application. However, developers report that the pipeline fails intermittently with a 'BUILD_FAILED' status due to test failures, but the tests pass locally. What is the MOST likely cause of this discrepancy?

Accepted Answer

The CodeBuild project has different environment variables or dependency versions compared to the local environment.. The most common cause of tests passing locally but failing in CodeBuild is environment inconsistency. CodeBuild runs in a managed environment with specific runtime versions, environment variables, and dependency caches that may differ from the developer's local machine. This discrepancy can lead to test failures due to different library versions, missing environment variables, or platform-specific behaviors.

Answer

The CodeBuild project is configured with a VPC that restricts access to external dependency repositories.

Answer

The CodePipeline has a timeout setting that causes the build to be terminated before tests complete.

Answer

The CodePipeline is configured with a branch filter that only triggers on the 'main' branch.

Question 9

A DevOps engineer is setting up an AWS CodePipeline to deploy a web application to an EC2 instance using AWS CodeDeploy. The deployment group uses an in-place deployment configuration. The pipeline's deploy stage fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The engineer checks the CodeDeploy logs on the instance and finds that the 'BeforeInstall' lifecycle hook script is failing. The script attempts to download a package from an Amazon S3 bucket that is encrypted with SSE-KMS. What is the MOST likely cause of the failure?

Accepted Answer

The IAM role attached to the EC2 instance lacks the 'kms:Decrypt' permission for the AWS KMS key used to encrypt the S3 object.. The error occurs because the EC2 instance's IAM role lacks the `kms:Decrypt` permission for the AWS KMS key used to encrypt the S3 object. When the `BeforeInstall` script attempts to download the package, the AWS SDK or CLI on the instance must decrypt the object using the KMS key. Without this permission, the download fails, causing the lifecycle hook to fail and the overall deployment to abort due to too many failed instances.

Answer

The EC2 instance does not have internet access to reach the S3 bucket.

Answer

The S3 bucket name is misspelled in the 'BeforeInstall' script.

Answer

The CodeDeploy agent does not have permissions to read from the S3 bucket.

Question 10

An organization uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests in CodeBuild. Recently, the pipeline failed because the Test stage took longer than expected, causing a pipeline execution timeout. The pipeline has a default timeout of 7 days. What is the MOST efficient way to set a maximum execution time for the Test stage without affecting other stages?

Accepted Answer

Modify the CodeBuild project's build timeout (e.g., 1 hour) in the buildspec or project configuration.. The CodeBuild project's build timeout setting directly controls the maximum duration a build can run before it is stopped. By setting this timeout to 1 hour in the CodeBuild project configuration or buildspec, the Test stage will automatically fail if it exceeds that limit, without affecting the pipeline's overall timeout or other stages. This is the most efficient and targeted approach, as it leverages a native CodeBuild feature rather than adding external monitoring or changing pipeline-wide settings.

Answer

Create an AWS Lambda function that stops the pipeline if the Test stage exceeds 1 hour.

Answer

Set the pipeline execution timeout to 1 hour in the pipeline settings.

Answer

Use Amazon CloudWatch Events to detect when the Test stage runs for more than 1 hour and then stop the pipeline.

Question 11

Which AWS service is primarily used to automate the building, testing, and deployment of code changes to AWS infrastructure based on a defined release process?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the building, testing, and deployment of code changes through a defined release process. It integrates with source control (e.g., CodeCommit, GitHub), build services (e.g., CodeBuild), and deployment services (e.g., CodeDeploy) to automate the entire pipeline from commit to production.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 12

A DevOps engineer needs to implement a CI/CD pipeline that builds a Docker image, scans it for vulnerabilities, and deploys it to Amazon ECS. The scanning must be integrated into the pipeline before the image is pushed to Amazon ECR. Which approach meets these requirements?

Accepted Answer

Use CodeBuild to run a vulnerability scanner on the Docker image, then push to ECR only if the scan passes.. It uses CodeBuild to run a vulnerability scanner on the Docker image before pushing to ECR, ensuring that only images that pass the scan are stored and deployed. This satisfies the requirement to scan before the image is pushed to ECR, which is critical for preventing vulnerable images from entering the registry.

Answer

Enable ECR 'Scan on Push' and configure CodePipeline to deploy only if the scan result is clean.

Answer

Use AWS Lambda to scan the image after push and automatically roll back if vulnerabilities are found.

Answer

Use AWS Security Hub to scan images in ECR and block deployment.

Question 13

A company uses AWS CodeCommit as a source repository and wants to enforce that all commits are signed using GPG keys. The DevOps team configures a pre-receive hook in CodeCommit to validate commit signatures. However, the hook rejects all commits even when valid GPG signatures are present. What is the most likely cause?

Accepted Answer

CodeCommit does not support pre-receive hooks.. AWS CodeCommit does not support pre-receive hooks. Pre-receive hooks are a feature of self-managed Git repositories (e.g., GitHub Enterprise, GitLab, or on-premises Git servers) that run on the server before accepting a push. CodeCommit uses IAM policies and repository-level settings (such as requiring signed commits via the 'git push --signed' flag) to enforce commit signing, not server-side hooks. Therefore, any attempt to configure a pre-receive hook in CodeCommit will fail, causing all commits to be rejected.

Answer

The GPG key is not registered with the IAM user's profile.

Answer

The hook script has a syntax error.

Answer

The repository is not configured to require signed commits.

Question 14

A DevOps team is designing a deployment pipeline for a microservices application on Amazon ECS using AWS CodePipeline. They want to implement a canary deployment strategy where a small percentage of traffic is routed to the new version before fully promoting it. Which AWS service or feature should they use to achieve this?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment. AWS CodeDeploy with ECS blue/green deployment is the correct choice because it natively supports canary traffic shifting for Amazon ECS services. When integrated with AWS CodePipeline, CodeDeploy can route a small percentage of traffic (e.g., 10%) to the new task set, monitor it with CloudWatch alarms, and then automatically shift the remaining traffic after a specified interval. This is the only option that directly provides the canary deployment lifecycle within the ECS and CodePipeline context.

Answer

Amazon ECS Service Auto Scaling

Answer

Amazon Route 53 weighted routing

Answer

AWS App Mesh with traffic shifting

Question 15

A company uses AWS CloudFormation to manage infrastructure. They need to implement a CI/CD pipeline that automatically updates CloudFormation stacks when changes are pushed to a CodeCommit repository. The pipeline must use change sets to review changes before execution. Which pipeline configuration meets these requirements?

Accepted Answer

Use a CloudFormation action with action mode 'CHANGE_SET_REPLACEMENT' and then a separate action with mode 'CHANGE_SET_EXECUTE' after an approval step.. CodePipeline's CloudFormation deployment action supports a 'CHANGE_SET_REPLACEMENT' mode that creates or replaces a change set without executing it, followed by a 'CHANGE_SET_EXECUTE' action that applies the change set after an approval step. This two-step approach allows teams to review infrastructure changes before they are applied, meeting the requirement to use change sets for review before execution.

Answer

Use a CloudFormation action in CodePipeline with action mode 'CREATE_UPDATE' and include a manual approval step before the action.

Answer

Use an AWS Lambda function to create a change set and trigger a manual approval via SNS.

Answer

Use a CloudFormation action with action mode 'CREATE_UPDATE' and set the 'Review' flag to true.