DOP-C02 SDLC Automation Practice Test 8 — 15 Questions

Question 1

A company is using AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a CodeBuild step that minifies JavaScript files. Recently, the build step started failing with an error: 'Error: ENOENT: no such file or directory, open 'index.js''. What is the most likely cause?

Accepted Answer

The CodeBuild project's working directory is not set to the source directory.. The error suggests that the working directory in CodeBuild is not set to the source directory where index.js resides. Option D is correct.

Answer

The source code was not uploaded to S3 correctly.

Answer

The S3 bucket policy is blocking access to the source code.

Answer

The buildspec.yml file is missing the 'phases' section.

Question 2

A team uses AWS CodePipeline with multiple parallel actions in a stage. They notice that when one action fails, the entire stage fails and no further actions are attempted. They want the pipeline to continue with the remaining actions even if one fails, and then report the failure at the end. Which feature should they use?

Accepted Answer

Configure each action with 'On failure' set to 'CONTINUE'.. CodePipeline supports a 'RunOrder' but also a 'Failure mode' per action. However, to allow continuation, they need to set the 'On failure' for the stage to 'ROLLBACK' or 'FAIL'. Actually, the correct approach is to use a custom action or set the 'RunOrder' such that actions are independent. The best practice is to use 'FAILURE' mode as 'CONTINUE' is not available; instead, they should set the stage's 'On failure' to 'FAIL' and use a separate stage for error handling. But the question asks for a specific feature: 'Retry on failure' with a maximum count. Option C is correct because setting retry allows the pipeline to continue after a transient failure, but for permanent failure, they need to use 'Failure mode' per action. Actually, CodePipeline now supports 'On failure' for actions: 'ABORT' or 'CONTINUE'. So using 'CONTINUE' on failure for the action will let the pipeline continue. Option C is correct.

Answer

Configure each action with a 'RunOrder' of 1 and set 'On failure' to 'ABORT'.

Answer

Set the stage's 'On failure' to 'ROLLBACK'.

Answer

Use a custom Lambda function to catch failures and resume the pipeline.

Question 3

A company uses AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yml includes a 'post_build' phase command to tag the image. The build fails with 'unauthorized: authentication required'. What must be done to resolve this?

Accepted Answer

Add 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' permissions to the CodeBuild service role.. CodeBuild needs permission to push to ECR. The IAM role must have appropriate ECR permissions. Option A is correct.

Answer

Use the 'docker login' command with AWS CLI in the build phase.

Answer

Install the AWS CLI in the CodeBuild build environment.

Answer

Create a new IAM user with ECR permissions and store the keys in CodeBuild environment variables.

Question 4

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda. They want to automatically deploy the latest version of the Lambda function to production after running integration tests. The source code is in AWS CodeCommit. Which pipeline configuration should they use?

Accepted Answer

CodeCommit -> CodeBuild (test) -> CodeDeploy (Lambda deployment) -> Lambda.. The best practice is to use CodePipeline with CodeBuild for testing and CodeDeploy for Lambda deployment. Option B is correct.

Answer

CodeCommit -> CodeBuild (test) -> Lambda (deploy via update-function-code).

Answer

CodeCommit -> Lambda (deploy via S3 trigger) -> CodeBuild (test) -> production.

Answer

CodeCommit -> CodeBuild (test and deploy) -> Lambda via AWS CLI in buildspec.

Question 5

A company has a multi-account AWS environment with separate accounts for development, staging, and production. They want to implement a CI/CD pipeline that deploys to each account sequentially after manual approvals. Which setup allows cross-account deployment with CodePipeline?

Accepted Answer

Create an IAM role in the target account with permissions for the pipeline service role to assume, and use that role in the deployment action.. Cross-account deployment requires an IAM role in the target account that the pipeline can assume. Option D is correct.

Answer

Create separate pipelines in each account and trigger them via SNS from a master pipeline.

Answer

Use CodePipeline with cross-account actions by specifying the target account ID and region.

Answer

Use a single pipeline in the management account with different stages for each account.

Question 6

A developer is using AWS CodeCommit as a source repository for a CodePipeline. They want to automatically start the pipeline when changes are pushed to the main branch. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that triggers the pipeline on CodeCommit 'push to main' events.. CodePipeline can use Amazon CloudWatch Events (EventBridge) to detect changes in CodeCommit and start the pipeline. Option A is correct.

Answer

Add a Lambda function that is invoked by CodeCommit triggers, which then starts the pipeline.

Answer

Configure the pipeline to poll the CodeCommit repository every 5 minutes.

Answer

Use a webhook from CodeCommit to the pipeline.

Question 7

Which TWO actions are best practices when designing a CI/CD pipeline for a containerized application on Amazon ECS? (Choose two.)

Accepted Answer

Separate the build stage from the deploy stage in the pipeline.. Using separate build and deploy stages (C) is a best practice for separation of concerns. Using a blue/green deployment strategy (D) ensures zero-downtime. A is wrong because building the image inside the deployment stage conflates steps. B is wrong because running a full integration test suite in every commit slows down the pipeline; tests should be optimized. E is wrong because rolling update may cause downtime; blue/green is preferred for zero-downtime.

Answer

Run a full integration test suite on every commit to the repository.

Answer

Build the Docker image in the deploy stage to ensure consistency.

Answer

Use a rolling update with a fixed number of tasks for deployment.

Question 8

Which THREE steps are required to set up a cross-account CodePipeline that deploys to an EC2 instance in a target account? (Choose three.)

Accepted Answer

Create an IAM role in the target account with permissions to deploy to EC2.. A: The pipeline needs an IAM role to assume in the target account. C: The target account must trust the pipeline account to allow role assumption. D: The pipeline service role must have permission to assume the target role. B is not required because the pipeline can be in the source account. E is not required because the pipeline uses the assumed role, not the target account's pipeline.

Answer

Configure the pipeline to use the target account's default KMS key for artifacts.

Answer

Create a CodePipeline in the target account.

Question 9

Which TWO are valid use cases for using AWS CodeArtifact in a CI/CD pipeline? (Choose two.)

Accepted Answer

Caching dependencies from public repositories to improve build speed and reliability.. A: CodeArtifact can store npm packages for use in CodeBuild. C: It can proxy public registries to reduce external dependencies. B is wrong because CodeArtifact stores artifacts, not source code. D is wrong because Docker images are stored in ECR, not CodeArtifact (which supports npm, Maven, PyPI, etc.). E is wrong because CodeArtifact does not host static websites.

Answer

Storing Docker images that are used by ECS tasks.

Answer

Storing source code archives for use in deployment stages.

Answer

Hosting static website assets for deployment to S3.

Question 10

Which THREE practices help ensure the security of a CI/CD pipeline that deploys to production? (Choose three.)

Accepted Answer

Integrate static code analysis and vulnerability scanning into the pipeline.. A: Encryption of artifacts in transit and at rest protects sensitive data. B: Scanning for vulnerabilities in dependencies and code helps prevent insecure deployments. D: Using least privilege IAM roles minimizes risk. C is wrong because storing credentials in the source repository is insecure. E is wrong because manual approval alone does not ensure security; automated checks are also needed.

Answer

Require manual approval for all deployments to production.

Answer

Store deployment credentials in the source repository for traceability.

Question 11

A DevOps engineer is creating a CodePipeline service role. The above IAM policy is attached to the role. The pipeline fails when trying to download artifacts from the S3 bucket. What is the issue?

Accepted Answer

The policy is missing s3:ListBucket permission on the bucket.. The policy allows s3:GetObject on the bucket, but it does not allow s3:ListBucket. CodePipeline needs to list objects in the bucket to find the artifact. Option C is correct.

Answer

The Resource for S3 actions should be the bucket ARN, not the object ARN.

Answer

The CodeDeploy actions require a specific resource ARN instead of '*'.

Answer

The Action list is missing s3:GetObjectVersion.

Question 12

A DevOps engineer is reviewing the CodePipeline structure above. The pipeline fails during the Deploy stage with an error: 'The deployment group could not be found.' What is the most likely cause?

Accepted Answer

The pipeline is configured as a single-region pipeline, but the Deploy action is in a different region.. The pipeline stages are in different regions: Build in us-east-1, Deploy in us-west-2. CodePipeline does not support cross-region actions unless cross-region action is configured with proper artifact storage. The default pipeline runs in a single region. Option B is correct.

Answer

The source artifact is not accessible from us-west-2.

Answer

The CodeDeploy application does not exist in us-west-2.

Answer

The CodeBuild project is not configured to output artifacts.

Question 13

A company is using AWS CodeCommit for source control and wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created against the main branch. Which AWS service should be used to connect CodeCommit events to CodeBuild?

Accepted Answer

Amazon EventBridge. Option C is correct because Amazon EventBridge can capture CodeCommit repository events (like pull request creation) and route them to targets such as CodeBuild projects. Option A is wrong because AWS CodePipeline is a CI/CD orchestration service, not a direct event trigger. Option B is wrong because Amazon SNS is a notification service, not a build trigger. Option D is wrong because AWS Lambda can be used as an intermediary but is not the direct connection; EventBridge is the correct native integration.

Answer

AWS CodePipeline

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 14

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own CodeCommit repository and must be built and deployed independently. The team wants to minimize manual configuration and ensure that adding a new microservice automatically creates the corresponding pipeline stages. Which approach should the team use?

Accepted Answer

Define a CloudFormation template that creates a pipeline for a given repository and invoke it automatically when a new repository is created using EventBridge and Lambda.. Option D is correct because AWS CloudFormation can define the pipeline infrastructure as code, and using nested stacks or a template that parameterizes the repository name allows for easy replication. Option A is wrong because manually updating a single pipeline is error-prone and not scalable. Option B is wrong because creating separate pipelines manually defeats automation. Option C is wrong because the AWS CDK can define infrastructure but requires separate stacks per service unless using loops or constructs.

Answer

Create a separate AWS CodePipeline for each microservice manually using the AWS Management Console.

Answer

Use the AWS Cloud Development Kit (CDK) to define a pipeline that dynamically discovers repositories.

Answer

Use a single AWS CodePipeline with multiple stages, each triggered by a different branch of the same repository.

Question 15

An organization has a AWS CodePipeline that deploys a critical application. The pipeline uses a manual approval step before deploying to production. The team wants to ensure that only authorized users can approve the deployment, and that the approval action is logged for compliance. Which combination of actions should the team take? (Select TWO.)

Accepted Answer

Configure the approval action to invoke an AWS Lambda function that validates the approver's IAM role tags.. Options A and C are correct. Option A: Configuring the Lambda function for approval to check IAM tags ensures only users with specific tags (e.g., 'role=approver') can call the approval API. Option C: Using CloudTrail to log approval actions meets compliance logging requirements. Option B is wrong because SNS does not provide fine-grained authorization. Option D is wrong because CloudWatch Logs can log but CloudTrail is the correct service for API logging. Option E is wrong because CodeCommit is not involved in approval authorization.

Answer

Use Amazon Simple Notification Service (SNS) to send approval notifications and allow any subscriber to approve.

Answer

Use AWS CodeCommit to manage approval permissions via repository policies.

Answer

Store approval logs in Amazon CloudWatch Logs for real-time monitoring.