DOP-C02 SDLC Automation — Timed 20 Questions

Question 1

A company uses AWS CodePipeline with a multi-branch strategy. A new feature branch triggers a pipeline that runs unit tests and deploys to a test environment. The deployment step uses AWS CodeDeploy with a deployment group configured for in-place deployment to Amazon EC2 instances. The deployment fails intermittently with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The instances are healthy and pass health checks. What is the most likely cause?

Accepted Answer

A previous deployment is still in progress or frozen in the CodeDeploy deployment group.. Option D is correct because CodeDeploy enforces a per-deployment-group concurrency limit of one deployment at a time. If a previous deployment is still in progress or in a 'frozen' state (e.g., due to a failed or stopped deployment that hasn't been explicitly rolled back or cleaned up), new deployments will fail with the 'too many individual instances failed' error even when instances are healthy. The error message is misleading because it reflects CodeDeploy's inability to proceed with the new deployment, not actual instance health issues.

Answer

The pipeline has a failed execution that is blocking subsequent executions.

Answer

The CodeDeploy agent on the instances is not running, causing the deployment to fail.

Answer

The pipeline is configured with a high frequency of changes, causing throttling from CodePipeline.

Question 2

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Accepted Answer

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.. Caching dependencies in an Amazon S3 bucket allows CodeBuild to reuse previously downloaded Maven/Gradle dependencies across builds, eliminating the need to re-download them each time. Since the codebase and dependencies are stable, this directly reduces the build time by avoiding repeated network transfers of large artifact repositories.

Answer

Move the build process to a local developer machine to avoid CodeBuild overhead.

Answer

Reduce the number of unit tests executed in the build phase.

Answer

Increase the compute type of the build environment to a larger instance.

Question 3

A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?

Accepted Answer

Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.. Option C is correct because it enforces branch-based deployment at the pipeline level, ensuring that only changes from specific branches trigger the production pipeline with the approval step. This approach is secure and maintainable as it leverages AWS CodePipeline's native ability to trigger on branch events, avoiding custom logic or manual verification. By isolating production deployments to a dedicated pipeline, the team reduces the risk of unauthorized or untested code reaching production.

Answer

Use a Lambda function in the pipeline to check the branch name and fail if not allowed.

Answer

Add a manual approval step in the pipeline and rely on the approver to verify the branch.

Answer

Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.

Question 4

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled JARs) to the repository, causing the repository size to grow rapidly and slowing down clone operations. The team wants to enforce a policy to reject pushes that contain files larger than 50 MB. Which approach should be used?

Accepted Answer

Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.. Option A is correct because AWS CodeCommit supports custom triggers that invoke AWS Lambda functions on repository events, including pushes. By configuring a trigger for the 'push' event, a Lambda function can inspect each file in the push payload, check its size against the 50 MB threshold, and programmatically reject the push by returning an error response. This approach enforces the policy at the repository level without requiring client-side changes.

Answer

Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.

Answer

Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.

Answer

Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.

Question 5

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Accepted Answer

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.. The pipeline's service role must have an `sts:AssumeRole` permission on the cross-account role to perform the role assumption. Even if the trust policy on the cross-account role allows the pipeline's service role, the pipeline's service role itself needs an IAM policy granting `sts:AssumeRole` for the cross-account role ARN. Without this permission, the `AssumeRole` API call fails with 'Access Denied', which is the exact error described.

Answer

The EC2 instances in the prod account do not have an appropriate instance profile.

Answer

The cross-account role's permissions boundary denies the deploy action.

Answer

The pipeline's service role does not have permission to perform the deploy action in the prod account.

Question 6

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is Blue/Green. During a recent deployment, the new instances passed all health checks, but traffic was not routed to them. What is the most likely reason?

Accepted Answer

The target group associated with the Auto Scaling group is not properly configured to route traffic.. In a Blue/Green deployment with CodeDeploy and an Auto Scaling group, traffic routing is handled by a load balancer target group. If the target group is not properly configured to route traffic to the new instances (e.g., missing or incorrect listener rules, deregistration delay, or health check thresholds), the instances may pass health checks but never receive traffic. This is the most likely cause because the deployment succeeded in provisioning and validating the new instances, but the load balancer did not forward requests to them.

Answer

The deployment group is not configured to use a load balancer.

Answer

The Auto Scaling group's lifecycle hook failed to signal readiness.

Answer

The CodeDeploy agent on the new instances is not installed.

Question 7

A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the external system does not overwrite the object after the pipeline execution starts.. Option A is correct because the deploy stage fails with 'The S3 object does not exist' when the external system overwrites the source artifact after the pipeline execution starts. CodePipeline references the object by its key at the time the pipeline is triggered; if the object is replaced (i.e., deleted and re-uploaded with the same key), the pipeline may attempt to download a version that no longer exists, especially if the S3 bucket is not versioned. Ensuring the external system does not overwrite the object during execution prevents this race condition.

Answer

Change the source stage to use AWS CodeCommit instead of S3.

Answer

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Answer

Increase the timeout for the deploy stage in the pipeline.

Question 8

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own code repository and build artifacts. The team wants to use AWS CodePipeline with multiple parallel actions to build and test all microservices simultaneously. They also want to ensure that if one microservice's build fails, the pipeline does not block other microservices. Which THREE steps should the team take? (Choose THREE.)

Accepted Answer

Use a parallel action group with separate build actions for each microservice.. Option A is correct because using a parallel action group with separate build actions for each microservice allows all microservices to be built simultaneously within a single pipeline. This design ensures that if one microservice's build fails, the other parallel actions continue unaffected, as CodePipeline treats each action in a parallel group independently.

Answer

Configure the pipeline to block subsequent stages if any build action fails.

Answer

Configure a single build action that sequentially builds all microservices.

Question 9

A large enterprise uses a multi-account AWS strategy with a centralized DevOps account. The DevOps account hosts an AWS CodePipeline that deploys a critical application to production account (111111111111) using AWS CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy). The deploy stage uses a cross-account role (arn:aws:iam::111111111111:role/CrossAccountDeployRole) to perform the deployment. The trust policy on that role allows the DevOps account's CodePipeline service role (arn:aws:iam::222222222222:role/CodePipelineServiceRole) to assume it. The pipeline has been working for months, but after a recent security audit, the security team tightened permissions. Now the deploy stage fails with the error: 'User: arn:aws:sts::222222222222:assumed-role/CodePipelineServiceRole/AWS-CodePipeline-xxx is not authorized to perform: codedeploy:CreateDeployment on resource: arn:aws:codedeploy:us-east-1:111111111111:deploymentgroup:MyApp/MyDG'. The DevOps team has verified that the CrossAccountDeployRole has a permissions policy that allows 'codedeploy:*' on all resources. The CodePipelineServiceRole has a permissions policy that allows 'sts:AssumeRole' on the CrossAccountDeployRole. What is the most likely cause and what action should be taken to resolve the issue?

Accepted Answer

Check the permissions boundary on CrossAccountDeployRole and add a boundary that allows CodeDeploy actions.. Option C is correct because the error indicates that the assumed role (CrossAccountDeployRole) is not authorized to perform codedeploy:CreateDeployment, despite having a permissions policy that allows codedeploy:* on all resources. This typically occurs when a permissions boundary is attached to the role that restricts the effective permissions, overriding the permissions policy. Adding a permissions boundary that allows CodeDeploy actions resolves the issue by ensuring the role's effective permissions include the necessary CodeDeploy operations.

Answer

Add 'sts:AssumeRole' to the permissions policy of CodePipelineServiceRole.

Answer

Create the deployment group in the production account again to reset permissions.

Answer

Update the trust policy of CrossAccountDeployRole to include the DevOps account ID.

Question 10

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. They have configured a CodeBuild project that triggers on pushes to the 'develop' branch. The build runs unit tests and packages the application. However, developers report that the pipeline fails intermittently with a 'BUILD_FAILED' status due to test failures, but the tests pass locally. What is the MOST likely cause of this discrepancy?

Accepted Answer

The CodeBuild project has different environment variables or dependency versions compared to the local environment.. Option D is correct because the most common cause of tests passing locally but failing in CodeBuild is environment inconsistency. CodeBuild runs in a managed environment with specific runtime versions, environment variables, and dependency caches that may differ from the developer's local machine. This discrepancy can lead to test failures due to different library versions, missing environment variables, or platform-specific behaviors.

Answer

The CodeBuild project is configured with a VPC that restricts access to external dependency repositories.

Answer

The CodePipeline has a timeout setting that causes the build to be terminated before tests complete.

Answer

The CodePipeline is configured with a branch filter that only triggers on the 'main' branch.

Question 11

A DevOps engineer is setting up an AWS CodePipeline to deploy a web application to an EC2 instance using AWS CodeDeploy. The deployment group uses an in-place deployment configuration. The pipeline's deploy stage fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The engineer checks the CodeDeploy logs on the instance and finds that the 'BeforeInstall' lifecycle hook script is failing. The script attempts to download a package from an Amazon S3 bucket that is encrypted with SSE-KMS. What is the MOST likely cause of the failure?

Accepted Answer

The IAM role attached to the EC2 instance lacks the 'kms:Decrypt' permission for the AWS KMS key used to encrypt the S3 object.. The error occurs because the EC2 instance's IAM role lacks the `kms:Decrypt` permission for the AWS KMS key used to encrypt the S3 object. When the `BeforeInstall` script attempts to download the package, the AWS SDK or CLI on the instance must decrypt the object using the KMS key. Without this permission, the download fails, causing the lifecycle hook to fail and the overall deployment to abort due to too many failed instances.

Answer

The EC2 instance does not have internet access to reach the S3 bucket.

Answer

The S3 bucket name is misspelled in the 'BeforeInstall' script.

Answer

The CodeDeploy agent does not have permissions to read from the S3 bucket.

Question 12

A company uses AWS CodeBuild to compile a Java application. The buildspec.yml includes a 'pre_build' phase that runs SonarQube for static code analysis. The analysis requires access to a private SonarQube server hosted on an EC2 instance in the same VPC. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the build fails with a timeout when trying to connect to the SonarQube server. The security group for the SonarQube server allows inbound traffic on port 9000 from the CodeBuild security group. What is the MOST likely reason for the failure?

Accepted Answer

The security group for the SonarQube server does not allow inbound traffic on port 9000 from the CodeBuild security group.. Option B is correct because the scenario explicitly states that the security group for the SonarQube server allows inbound traffic on port 9000 from the CodeBuild security group, yet the build fails with a timeout. A timeout typically indicates a network connectivity issue, not a certificate or permission problem. The most likely cause is that the security group rule is misconfigured (e.g., using the wrong security group ID, or the rule is not actually applied), preventing the TCP handshake on port 9000 from completing.

Answer

The CodeBuild project is not configured with the correct VPC subnets.

Answer

The SonarQube server is using a self-signed certificate that CodeBuild does not trust.

Answer

The CodeBuild project does not have internet access, so it cannot reach the SonarQube server.

Question 13

An organization uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests in CodeBuild. Recently, the pipeline failed because the Test stage took longer than expected, causing a pipeline execution timeout. The pipeline has a default timeout of 7 days. What is the MOST efficient way to set a maximum execution time for the Test stage without affecting other stages?

Accepted Answer

Modify the CodeBuild project's build timeout (e.g., 1 hour) in the buildspec or project configuration.. Option D is correct because the CodeBuild project's build timeout setting directly controls the maximum duration a build can run before it is stopped. By setting this timeout to 1 hour in the CodeBuild project configuration or buildspec, the Test stage will automatically fail if it exceeds that limit, without affecting the pipeline's overall timeout or other stages. This is the most efficient and targeted approach, as it leverages a native CodeBuild feature rather than adding external monitoring or changing pipeline-wide settings.

Answer

Create an AWS Lambda function that stops the pipeline if the Test stage exceeds 1 hour.

Answer

Set the pipeline execution timeout to 1 hour in the pipeline settings.

Answer

Use Amazon CloudWatch Events to detect when the Test stage runs for more than 1 hour and then stop the pipeline.

Question 14

Which AWS service is primarily used to automate the building, testing, and deployment of code changes to AWS infrastructure based on a defined release process?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the building, testing, and deployment of code changes through a defined release process. It integrates with source control (e.g., CodeCommit, GitHub), build services (e.g., CodeBuild), and deployment services (e.g., CodeDeploy) to automate the entire pipeline from commit to production.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 15

A DevOps engineer needs to implement a CI/CD pipeline that builds a Docker image, scans it for vulnerabilities, and deploys it to Amazon ECS. The scanning must be integrated into the pipeline before the image is pushed to Amazon ECR. Which approach meets these requirements?

Accepted Answer

Use CodeBuild to run a vulnerability scanner on the Docker image, then push to ECR only if the scan passes.. Option B is correct because it uses CodeBuild to run a vulnerability scanner on the Docker image before pushing to ECR, ensuring that only images that pass the scan are stored and deployed. This satisfies the requirement to scan before the image is pushed to ECR, which is critical for preventing vulnerable images from entering the registry.

Answer

Enable ECR 'Scan on Push' and configure CodePipeline to deploy only if the scan result is clean.

Answer

Use AWS Lambda to scan the image after push and automatically roll back if vulnerabilities are found.

Answer

Use AWS Security Hub to scan images in ECR and block deployment.

Question 16

A company uses AWS CodeCommit as a source repository and wants to enforce that all commits are signed using GPG keys. The DevOps team configures a pre-receive hook in CodeCommit to validate commit signatures. However, the hook rejects all commits even when valid GPG signatures are present. What is the most likely cause?

Accepted Answer

CodeCommit does not support pre-receive hooks.. AWS CodeCommit does not support pre-receive hooks. Pre-receive hooks are a feature of self-managed Git repositories (e.g., GitHub Enterprise, GitLab, or on-premises Git servers) that run on the server before accepting a push. CodeCommit uses IAM policies and repository-level settings (such as requiring signed commits via the 'git push --signed' flag) to enforce commit signing, not server-side hooks. Therefore, any attempt to configure a pre-receive hook in CodeCommit will fail, causing all commits to be rejected.

Answer

The GPG key is not registered with the IAM user's profile.

Answer

The hook script has a syntax error.

Answer

The repository is not configured to require signed commits.

Question 17

A DevOps team is designing a deployment pipeline for a microservices application on Amazon ECS using AWS CodePipeline. They want to implement a canary deployment strategy where a small percentage of traffic is routed to the new version before fully promoting it. Which AWS service or feature should they use to achieve this?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment. AWS CodeDeploy with ECS blue/green deployment is the correct choice because it natively supports canary traffic shifting for Amazon ECS services. When integrated with AWS CodePipeline, CodeDeploy can route a small percentage of traffic (e.g., 10%) to the new task set, monitor it with CloudWatch alarms, and then automatically shift the remaining traffic after a specified interval. This is the only option that directly provides the canary deployment lifecycle within the ECS and CodePipeline context.

Answer

Amazon ECS Service Auto Scaling

Answer

Amazon Route 53 weighted routing

Answer

AWS App Mesh with traffic shifting

Question 18

A company uses AWS CloudFormation to manage infrastructure. They need to implement a CI/CD pipeline that automatically updates CloudFormation stacks when changes are pushed to a CodeCommit repository. The pipeline must use change sets to review changes before execution. Which pipeline configuration meets these requirements?

Accepted Answer

Use a CloudFormation action with action mode 'CHANGE_SET_REPLACEMENT' and then a separate action with mode 'CHANGE_SET_EXECUTE' after an approval step.. Option B is correct because CodePipeline's CloudFormation deployment action supports a 'CHANGE_SET_REPLACEMENT' mode that creates or replaces a change set without executing it, followed by a 'CHANGE_SET_EXECUTE' action that applies the change set after an approval step. This two-step approach allows teams to review infrastructure changes before they are applied, meeting the requirement to use change sets for review before execution.

Answer

Use a CloudFormation action in CodePipeline with action mode 'CREATE_UPDATE' and include a manual approval step before the action.

Answer

Use an AWS Lambda function to create a change set and trigger a manual approval via SNS.

Answer

Use a CloudFormation action with action mode 'CREATE_UPDATE' and set the 'Review' flag to true.

Question 19

Which of the following are valid strategies for implementing continuous integration in AWS? (Choose two.)

Accepted Answer

Configure AWS CodeBuild to automatically run tests when a pull request is created in CodeCommit.. Option A is correct because AWS CodeBuild can be configured to automatically run tests when a pull request is created in CodeCommit using a webhook or event rule. This enables continuous integration by validating code changes before merging, ensuring that only tested code is integrated into the main branch.

Answer

Set up AWS CodeDeploy to trigger a build every time a commit is pushed to a repository.

Answer

Use AWS CloudFormation to create a stack that runs tests every time a new commit is pushed.

Question 20

A DevOps engineer is designing a deployment pipeline for a serverless application using AWS SAM. The pipeline must include the following stages: source, build, deploy to a development environment, run integration tests, and promote to production after manual approval. Which AWS services and features should be used to implement this pipeline? (Choose two.)

Accepted Answer

AWS CodePipeline to orchestrate the pipeline stages.. AWS CodePipeline is the correct service for orchestrating the pipeline stages because it provides native support for defining source, build, deploy, test, and manual approval stages in a sequential workflow. It integrates directly with AWS SAM and can trigger builds and deployments based on source code changes, making it the ideal orchestrator for this multi-stage pipeline.

Answer

AWS CodeDeploy for deploying the SAM application.

Answer

AWS CodeCommit to build the SAM application.