DOP-C02 SDLC Automation Practice Test 9 — 15 Questions

Question 1

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. CodeBuild's security group outbound rules must explicitly allow traffic to the RDS security group on the database port (e.g., 3306 for MySQL). Even though CodeBuild runs in a VPC, if the outbound rules are too restrictive, the build agent cannot establish a TCP connection to the RDS instance, causing a timeout. The security group acts as a virtual firewall for the CodeBuild ENI, and without a matching outbound rule, packets are dropped.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 2

A team uses AWS CloudFormation to manage infrastructure. They want to reuse a common set of resources (e.g., VPC, subnets) across multiple stacks. Which CloudFormation feature should they use?

Accepted Answer

Cross-stack references. Cross-stack references allow you to export output values from one CloudFormation stack (e.g., VPC ID and subnet IDs) and import them into other stacks. This lets multiple stacks share and reuse the same underlying resources, such as VPC and subnets, without duplicating them. Nested stacks, on the other hand, are used to compose a stack from reusable templates, creating independent resource instances for each parent stack.

Answer

Custom resources

Answer

StackSets

Answer

Nested stacks

Question 3

A team wants to automate the creation of a CI/CD pipeline using a JSON/YAML file that defines source, build, and deploy stages. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define infrastructure as code (IaC) using JSON or YAML templates, which can include the creation of a CI/CD pipeline by defining resources like AWS CodePipeline, CodeBuild, and CodeDeploy. This enables full automation of the pipeline's source, build, and deploy stages through a declarative template, rather than manually configuring each service. The question specifically asks for automating the creation of the pipeline itself using a JSON/YAML file, which is exactly what CloudFormation does.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Question 4

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline triggers on changes to the S3 bucket. However, the pipeline does not trigger when a new object is uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to invoke the pipeline.. CodePipeline does not automatically monitor S3 buckets for new objects. To trigger a pipeline on S3 events, you must explicitly configure an S3 event notification (e.g., s3:ObjectCreated:Put) that sends the event to CloudWatch Events or directly to CodePipeline via Amazon EventBridge. Without this notification, the pipeline will not start when a new object is uploaded.

Answer

The S3 bucket policy denies the CodePipeline service role.

Answer

The S3 bucket is in a different AWS Region than the pipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 5

A company uses AWS CodeBuild to run builds for a Java application. The buildspec includes a 'mvn test' command. The build succeeds but the tests fail. The team wants to fail the build if any test fails. What should they do?

Accepted Answer

Ensure the buildspec's 'build' phase includes the test command and that the command returns a non-zero exit code on failure.. CodeBuild determines build success or failure based on the exit code of commands in the buildspec. The 'mvn test' command returns a non-zero exit code when tests fail, which causes the build to fail if placed in the 'build' phase. By ensuring the test command is in the 'build' phase and not suppressed (e.g., with '|| true'), the build will fail on test failure.

Answer

Add a 'post_build' phase that fails the build if tests fail.

Answer

Add a 'test' phase in the buildspec before the 'build' phase.

Answer

Configure the build project to use batch builds.

Question 6

A team wants to automatically deploy a new version of a Lambda function when code is pushed to a CodeCommit repository. Which AWS service should orchestrate this workflow?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the entire release process, including source code changes from CodeCommit, building with CodeBuild, and deploying to Lambda. It can automatically trigger a pipeline execution when a new commit is pushed to a CodeCommit repository, enabling automated deployment of the Lambda function.

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Question 7

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must ensure that only code that passes security scanning can proceed to deployment. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Add a security scanning stage in the pipeline after the build stage and before the deploy stage.. Integrating a security scanning stage after the build stage and before the deploy stage ensures that only code that has passed security checks proceeds to deployment. This aligns with the principle of shifting security left in the CI/CD pipeline, preventing vulnerable artifacts from reaching production environments.

Answer

Use Amazon CloudWatch Events to trigger a rollback if vulnerabilities are found after deployment.

Answer

Use AWS CodeDeploy to perform security scanning during deployment.

Answer

Configure the pipeline to run security scanning only in the deploy stage.

Question 8

A team uses AWS CodeBuild to build a Node.js application. The buildspec.yml file is at the root of the repository. The build fails with 'Error: Cannot find module 'aws-sdk''. Which TWO actions could resolve the issue? (Choose TWO.)

Accepted Answer

Ensure 'aws-sdk' is listed in the 'dependencies' section of package.json.. The 'aws-sdk' module must be declared in the 'dependencies' section of package.json for npm to install it during the build. Without this declaration, npm install will not download the module, causing the 'Cannot find module' error at runtime. Option D is correct because CodeBuild does not automatically run npm install; you must explicitly include an 'install' phase in buildspec.yml to execute 'npm install' and populate node_modules.

Answer

Specify a different Node.js runtime version in the buildspec.

Answer

Add a 'pre_build' phase that runs 'npm test'.

Answer

Add a 'build' phase command to compile the code.

Question 9

Refer to the exhibit. An IAM policy is attached to a role used by a CI/CD system. The policy is intended to allow starting the pipeline 'MyPipeline' from the same account. However, the CI/CD system receives an 'AccessDenied' error when trying to start the pipeline. What is the problem?

Accepted Answer

The Deny statement with the 'aws:SourceAccount' condition denies access if the condition key is not present in the request.. The Deny statement with the `aws:SourceAccount` condition key denies access unless the request includes that condition key. When the CI/CD system assumes the role and makes a `StartPipelineExecution` API call, the request context does not automatically include the `aws:SourceAccount` key unless explicitly added by the caller. Since the condition is not satisfied, the Deny statement applies, resulting in an 'AccessDenied' error even though the Allow statement grants the necessary action.

Answer

The Allow statement does not specify the correct pipeline ARN.

Answer

The policy needs an additional Allow for 'codepipeline:GetPipeline' to start the pipeline.

Answer

The role does not have permission to pass the policy to the CI/CD system.

Question 10

Refer to the exhibit. A DevOps engineer sees the following error when trying to update a CloudFormation stack: 'Stack [arn:aws:cloudformation:us-west-2:123456789012:stack/MyStack/abc123] is in ROLLBACK_COMPLETE state and can not be updated.' What should the engineer do to proceed?

Accepted Answer

Delete the stack and create a new one with the updated template.. When a CloudFormation stack reaches the ROLLBACK_COMPLETE state, it means the stack creation or update failed and the rollback has finished, leaving the stack in a terminal state. CloudFormation does not allow updates or rollback continuation on stacks in this state. The only supported action is to delete the stack and create a new one with the corrected template, as stated in the AWS documentation.

Answer

Run 'aws cloudformation continue-update-rollback' to finish the rollback and then update.

Answer

Modify the stack's template and try the update again.

Answer

Use the 'aws cloudformation resume-update' command to resume the update.

Question 11

Refer to the exhibit. A team uses this buildspec.yml in AWS CodeBuild. The build fails because the 'dist' directory does not exist after the build phase. What is the most likely cause?

Accepted Answer

The build command outputs to a 'build' directory, but the artifacts base-directory is set to 'dist'.. The buildspec.yml specifies `artifacts.base-directory: dist`, but the build commands output files to a `build` directory. Since the `dist` directory is never created during the build phase, CodeBuild cannot locate the artifacts, causing the build to fail. This mismatch between the output directory and the artifacts base-directory is the most likely cause.

Answer

The buildspec version is incorrect.

Answer

The Python runtime version 3.8 is not available in CodeBuild.

Answer

The requirements.txt file is missing from the source code.

Question 12

A company runs a microservices architecture on Amazon ECS with Fargate launch type. Each microservice is deployed using AWS CodePipeline with a source stage from CodeCommit, a build stage in CodeBuild, and a deploy stage that updates the ECS service. The team wants to implement a blue/green deployment strategy to reduce downtime and enable quick rollbacks. Which combination of AWS services and configurations should be used?

Accepted Answer

Use AWS CodeDeploy with a deployment group configured for blue/green deployment, and an Application Load Balancer (ALB) to shift traffic between the blue and green target groups.. AWS CodeDeploy natively supports blue/green deployments for Amazon ECS (Fargate) by orchestrating traffic shifting between two target groups behind an Application Load Balancer (ALB). This allows the new task set (green) to be validated before production traffic is fully shifted, and enables instant rollback by reverting traffic to the original (blue) target group. CodePipeline can integrate CodeDeploy as a deploy action to automate this workflow.

Answer

Use AWS CloudFormation with a 'DeploymentPreference' set to 'BlueGreen' for the ECS service.

Answer

Use the ECS service's built-in rolling update with a 'minimumHealthyPercent' of 100 and 'maximumPercent' of 200.

Answer

Configure the ECS service with an 'AutoScaling' policy that replaces instances gradually.

Question 13

A DevOps engineer is configuring a webhook trigger in AWS CodePipeline to automatically start a pipeline when changes are pushed to a specific branch in a CodeCommit repository. The webhook is created and the trigger is set to the 'main' branch. However, when a developer pushes a commit to the 'main' branch, the pipeline does not start. What is the MOST likely reason?

Accepted Answer

The CloudWatch Events rule that triggers the pipeline on repository changes is not configured.. AWS CodePipeline uses Amazon CloudWatch Events (now Amazon EventBridge) to detect repository changes and trigger pipeline executions. When a webhook is created in CodePipeline, it automatically sets up a CloudWatch Events rule that listens for CodeCommit repository state changes (e.g., push to a branch). If this rule is missing, misconfigured, or deleted, the pipeline will not start despite the webhook being present. The webhook itself only registers the endpoint; the actual event routing depends on the CloudWatch Events rule.

Answer

The webhook is not properly registered with CodeCommit due to a conflict with an existing webhook.

Answer

The CodeCommit repository is set to send events to Amazon S3, which conflicts with the webhook.

Answer

The pipeline requires an Amazon SNS notification to be configured for the trigger to work.

Question 14

A company uses AWS CodeBuild to compile and test Java code. The buildspec.yml file includes a 'pre_build' phase that runs unit tests. The build occasionally fails with the error 'No space left on device.' The build environment is a general1.medium EC2 instance with 160 GB of disk space. What is the MOST effective solution to resolve this issue?

Accepted Answer

Increase the file system size or add commands to clean up temporary files in the buildspec.. The 'No space left on device' error occurs when the build environment's ephemeral storage is exhausted. The most effective solution is to add cleanup commands in the buildspec to remove temporary files, directly addressing the root cause. Alternatively, switching to a compute type with a larger disk allocation (e.g., general1.large has 200 GB) can increase space, but this may be more costly and is not the most direct fix. While larger compute types do include more disk, Option C's focus on memory rather than disk makes it a less precise choice. Option D (cache) does not directly free up disk during the build.

Answer

Configure the build to use an Amazon EFS file system to offload data.

Answer

Switch the build environment to a compute type with more memory, such as general1.large.

Answer

Enable the 'cache' feature in CodeBuild to reuse dependencies and reduce disk usage.

Question 15

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline has a source stage from CodeCommit, a build stage that runs 'sam build', and a deploy stage that runs 'sam deploy --no-confirm-changeset'. The deploy stage fails with the error 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.. The error 'The security token included in the request is invalid' indicates that the AWS credentials used by CodeBuild to call the CloudFormation API are either expired or lack the necessary permissions. In a CodePipeline with a CodeBuild action, the build project assumes an IAM role to perform actions such as 'sam deploy', which internally calls CloudFormation. If that IAM role's temporary credentials have expired (e.g., due to a long-running build) or the role does not have the required CloudFormation permissions (e.g., cloudformation:CreateChangeSet, cloudformation:ExecuteChangeSet), the API call will fail with this exact error.

Answer

The CloudFormation stack is in a 'ROLLBACK_COMPLETE' state and cannot be updated.

Answer

The CodeBuild project does not have access to the CodeCommit repository.

Answer

The SAM template is invalid and contains syntax errors.