DOP-C02 SDLC Automation Practice Test 8 — 15 Questions

Question 1

A company wants to ensure that all code changes are reviewed before being merged to the main branch in AWS CodeCommit. Which feature should be enabled?

Accepted Answer

Create an approval rule template and associate it with the main branch.. AWS CodeCommit does not natively support branch protection rules like GitHub or GitLab. Instead, you must create an approval rule template and associate it with the main branch to require at least one approved pull request before merging. This ensures all code changes are reviewed before being merged to the main branch.

Answer

Configure a Lambda function to validate commits and block pushes.

Answer

Enable branch protection rules on the repository.

Answer

Use CloudWatch Events to notify when a push occurs.

Question 2

A company is migrating from Jenkins to AWS CodeBuild. They have hundreds of Jenkins jobs that run on a schedule. Some jobs take hours and must not overlap. What is the most efficient way to migrate these jobs to CodeBuild while ensuring no overlapping builds?

Accepted Answer

Use Amazon CloudWatch Events to trigger a Lambda function that checks the build status before starting a new build.. It provides a robust, event-driven mechanism to prevent overlapping builds. By using Amazon CloudWatch Events to trigger a Lambda function that checks the current build status of the CodeBuild project before starting a new build, you can ensure that a new build is only initiated when no other build is running. This approach directly addresses the requirement that some jobs take hours and must not overlap, without relying on fragile timing or configuration limits that may not apply across multiple projects.

Answer

Create a buildspec file that includes a sleep command to stagger start times.

Answer

Configure the CodeBuild project with a concurrent build limit of 1.

Answer

Set up a separate CodeBuild project for each job and use a custom retry policy.

Question 3

A developer is troubleshooting a failed CodeBuild build. The build is triggered by a pull request from a forked repository. The buildspec includes a command to fetch pull request references. What is the most likely cause of the failure?

Accepted Answer

The CodeBuild project is not configured to allow pull requests from forked repositories.. When a build is triggered by a pull request from a forked repository, CodeBuild requires explicit configuration to allow builds from forks. By default, CodeBuild projects do not accept webhook events from forked repositories. The error occurs because the project lacks the 'Allow pull requests from forked repositories' setting enabled, even though the IAM role and buildspec may be correctly configured.

Answer

The IAM role for CodeBuild does not have permission to read from the repository.

Answer

The buildspec file is not present in the source code.

Answer

The buildspec contains invalid syntax.

Question 4

A CloudFormation stack is created with a template that includes an S3 bucket with no DeletionPolicy specified, and the parameter Environment is set to 'dev'. Later, the stack is deleted. What happens to the S3 bucket?

Accepted Answer

The bucket is deleted.. Since no DeletionPolicy is specified, the default DeletionPolicy of 'Delete' applies. CloudFormation will attempt to delete the S3 bucket during stack deletion. If the bucket is empty, the deletion succeeds. If the bucket contains objects, the deletion fails and the bucket is retained. The question assumes the bucket is empty (as no objects are mentioned), so the bucket is deleted.

Answer

The bucket is retained only if it contains objects.

Answer

The bucket is retained.

Answer

The bucket is deleted but the objects are retained.

Question 5

A team uses AWS CodeBuild to run security scans on code before deployment. They want to ensure that if the security scan fails, the build is marked as FAILED and no further pipeline stages execute. What should they add to the buildspec?

Accepted Answer

Use the 'phases' section with a command that exits with a non-zero status on failure.. In AWS CodeBuild, the build process is controlled by the 'phases' section of the buildspec file. Each phase runs a series of commands sequentially, and if any command exits with a non-zero status (e.g., a security scan tool returns a failure exit code), CodeBuild immediately marks the build as FAILED and stops further execution. This ensures that no subsequent pipeline stages are triggered, as the build status propagates to the pipeline.

Answer

Use the 'artifacts' section to define failure conditions.

Answer

Use the 'env' section to set a variable that fails the build.

Answer

Use the 'reports' section to mark the build as failed if tests fail.

Question 6

A development team is using AWS CodeCommit as a source control repository. They want to automate code builds and run unit tests every time a developer pushes code to the 'develop' branch. Which AWS service should they use to trigger the build automatically?

Accepted Answer

Create an AWS CodePipeline with CodeCommit as source and CodeBuild as build stage, configured to start on source changes.. AWS CodePipeline can be configured with CodeCommit as the source stage and CodeBuild as the build stage, and by enabling the 'Amazon CloudWatch Events' trigger on the pipeline, it automatically starts whenever a change is pushed to the specified branch (e.g., 'develop'). This is the native, fully managed way to achieve continuous integration without custom scripting or additional services.

Answer

Set up AWS CodeDeploy to run builds on code push.

Answer

Configure AWS CodeCommit to invoke AWS CodeBuild directly.

Answer

Use Amazon CloudWatch Events to detect a push to CodeCommit and trigger AWS CodeBuild.

Question 7

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must deploy to Amazon ECS using blue/green deployments. The team wants to automatically roll back if the new deployment fails health checks. Which combination of AWS services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with an ECS compute platform, configure a CloudWatch alarm for health checks, and enable automatic rollback.. AWS CodeDeploy with an ECS compute platform natively supports blue/green deployments for Amazon ECS, including automatic rollback triggered by CloudWatch alarms. By configuring a CloudWatch alarm based on ECS service health checks (e.g., ELB target group health), CodeDeploy can automatically revert to the original blue task set if the new green deployment fails, meeting the requirement for zero-touch rollback.

Answer

Use AWS CloudFormation with a custom resource to perform blue/green deployment.

Answer

Use AWS Elastic Beanstalk with blue/green environment swapping.

Answer

Use AWS CodePipeline with ECS deployment action and manual approval for rollback.

Question 8

A team uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a deployment stage that uses AWS CodeDeploy to copy files to an S3 bucket. However, the deployment fails because the S3 bucket is not configured for static website hosting. What is the MOST likely cause of the failure?

Accepted Answer

The S3 bucket does not have static website hosting enabled.. The failure occurs because the S3 bucket is not configured for static website hosting. The AWS CodePipeline S3 deployment action (Deploy to S3) requires the target bucket to have static website hosting enabled. Without this configuration, the action will fail. IAM permissions or bucket public access settings are not the immediate cause of this specific error message.

Answer

The IAM role for CodeDeploy does not have permissions to write to the S3 bucket.

Answer

The S3 bucket is not configured as a public bucket.

Answer

AWS CodeDeploy cannot deploy to S3 buckets.

Question 9

A company has a CI/CD pipeline that deploys to Amazon ECS using AWS CodePipeline. The pipeline includes a manual approval step before deployment to production. The security team requires that all approvals be logged in AWS CloudTrail and that the approver's identity be verified. Which action should the DevOps engineer take to meet these requirements?

Accepted Answer

Ensure that the manual approval action is configured as a CodePipeline approval action; CloudTrail will log the 'Approval' event with the IAM user ARN.. CodePipeline's manual approval action inherently generates an 'Approval' event in CloudTrail when an approver approves or rejects the action. This event includes the IAM user ARN of the approver, satisfying both the logging and identity verification requirements without additional configuration.

Answer

Create a custom CloudTrail trail specifically for CodePipeline API calls.

Answer

Enable CloudTrail Insights to detect unusual approval activity.

Answer

Configure the approval action to send a notification to an Amazon SNS topic, and log the SNS delivery to CloudWatch Logs.

Question 10

A development team uses AWS CodeCommit as a Git repository. They want to automatically trigger a build in AWS CodeBuild when a pull request is created or updated. Which configuration should the team use?

Accepted Answer

Create a CodeCommit trigger that invokes CodeBuild on 'Pull Request Created' and 'Pull Request Updated' events.. CodeCommit supports direct triggers for events like 'Pull Request Created' and 'Pull Request Updated', which can invoke AWS CodeBuild without any intermediate services. This is the simplest and most direct integration for automatically starting a build when a pull request is created or updated.

Answer

Use Amazon SNS to notify CodeBuild when a pull request is created.

Answer

Use Amazon CloudWatch Events to detect CodeCommit pull request events and invoke CodeBuild.

Answer

Configure CodePipeline with a source action on CodeCommit and a build action, and set the pipeline to start on source changes.

Question 11

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage that runs 'npm install' and 'npm test'. The team notices that the build stage often fails due to network timeouts when downloading npm packages. Which action would MOST reliably resolve this issue?

Accepted Answer

Configure the CodeBuild project to use a VPC with a NAT gateway to the internet.. The network timeouts occur because the CodeBuild project lacks outbound internet access to reach the npm registry. By configuring the CodeBuild project to use a VPC with a NAT gateway, you provide a stable, routable path to the internet via the NAT gateway's elastic IP, eliminating intermittent connectivity issues caused by relying on public endpoints through a non-VPC network path.

Answer

Use a custom Docker image that includes pre-installed npm packages.

Answer

Enable local dependency caching in the buildspec file.

Answer

Increase the build timeout to the maximum value.

Question 12

A company is using AWS CodePipeline with a deployment stage that uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that if the CloudFormation stack update fails, the pipeline automatically rolls back to the previous version of the stack. Which configuration should the DevOps engineer implement?

Accepted Answer

In the CodePipeline CloudFormation deployment action, set 'Stack failure behavior' to 'ROLLBACK'.. In a CodePipeline CloudFormation deployment action, setting 'Stack failure behavior' to 'ROLLBACK' instructs CloudFormation to automatically roll back the stack to its last known stable state if the update fails. This ensures the pipeline reverts to the previous stack version without manual intervention, aligning with the requirement for automatic rollback on failure.

Answer

Configure the CodeDeploy deployment group to automatically roll back on failure.

Answer

Configure a CloudFormation stack policy to prevent updates and force rollback.

Answer

Use CloudFormation change sets and manually execute them after review.

Question 13

A DevOps team is designing a CI/CD pipeline for a microservices application that runs on Amazon ECS. They need to implement automated canary deployments. Which TWO AWS services would be essential for this implementation?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is essential because it natively supports canary deployments for Amazon ECS through its ECS blue/green deployment type, allowing you to specify a canary traffic shift (e.g., 10% for 5 minutes) before full promotion. This enables automated, controlled rollouts with built-in rollback capabilities based on CloudWatch alarms.

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Answer

Amazon EC2 Auto Scaling

Question 14

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The team wants to automatically test the deployed application before promoting it to production. Which THREE steps should be included in the pipeline?

Accepted Answer

Add a stage that runs a performance or load test.. Adding a performance or load test stage after deployment validates that the serverless application can handle expected traffic volumes under AWS SAM's provisioned concurrency and scaling limits. This ensures the application meets non-functional requirements before promotion, catching issues like cold start latency or throttling that unit tests miss.

Answer

Add a stage that automatically rolls back the deployment if tests fail.

Answer

Add a stage that deploys the application to a separate production environment.

Question 15

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yaml includes commands to build and tag the image. However, the push to ECR fails with an authentication error. Which TWO actions should the DevOps engineer take to resolve this?

Accepted Answer

Add a command in the buildspec to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. The `aws ecr get-login-password` command retrieves a temporary authentication token from the ECR service, which is then piped to `docker login` to authenticate the Docker client against the private ECR registry. This is the standard AWS-recommended method for authenticating Docker to ECR in automated build environments like CodeBuild, as it avoids hardcoding long-lived credentials.

Answer

Configure the ECR repository as public.

Answer

Create an ECR lifecycle policy to expire untagged images.

Answer

Run 'docker login' with ECR credentials in the buildspec.