SDLC Automation practice questions

The pipeline has a failed execution that is blocking subsequent executions.

Why wrong: CodePipeline allows concurrent executions unless specifically configured to block.

The CodeDeploy agent on the instances is not running, causing the deployment to fail.

Why wrong: If the agent were not running, instances would fail health checks and show specific errors.

The pipeline is configured with a high frequency of changes, causing throttling from CodePipeline.

Why wrong: CodePipeline throttles are rare and would produce a different error.

Move the build process to a local developer machine to avoid CodeBuild overhead.

Why wrong: Local builds are not a scalable or consistent solution.

Reduce the number of unit tests executed in the build phase.

Why wrong: This compromises quality and may not be acceptable.

Increase the compute type of the build environment to a larger instance.

Why wrong: While faster compute helps, it does not address the dependency download overhead.

Use a Lambda function in the pipeline to check the branch name and fail if not allowed.

Why wrong: The Lambda function can be modified by anyone with pipeline edit permissions.

Add a manual approval step in the pipeline and rely on the approver to verify the branch.

Why wrong: Manual approval does not prevent a developer from approving their own change.

Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.

Why wrong: CodePipeline does not support conditions on artifact tags.

Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.

Why wrong: This is reactive, not preventive.

Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.

Why wrong: IAM policies cannot evaluate file sizes.

Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.

Why wrong: Pre-receive hooks are not natively supported in CodeCommit.

The EC2 instances in the prod account do not have an appropriate instance profile.

Why wrong: The pipeline does not run on EC2 instances.

The cross-account role's permissions boundary denies the deploy action.

Why wrong: Permissions boundary affects what the role can do after assuming it, not the assumption itself.

The pipeline's service role does not have permission to perform the deploy action in the prod account.

Why wrong: The error occurs when assuming the role, not during the deploy action itself.

The deployment group is not configured to use a load balancer.

Why wrong: Blue/Green deployments require a load balancer; if not configured, CodeDeploy would not proceed.

The Auto Scaling group's lifecycle hook failed to signal readiness.

Why wrong: Lifecycle hooks affect instance state but not traffic routing directly.

The CodeDeploy agent on the new instances is not installed.

Why wrong: If the agent were missing, CodeDeploy would report a failure.

Change the source stage to use AWS CodeCommit instead of S3.

Why wrong: Changing source type is unnecessary and may not address the root cause.

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Why wrong: Encryption does not affect object existence.

Increase the timeout for the deploy stage in the pipeline.

Why wrong: Timeout does not address the object not existing.

Configure the pipeline to block subsequent stages if any build action fails.

Why wrong: Blocking would affect other microservices.

Configure a single build action that sequentially builds all microservices.

Why wrong: Sequential builds would block if one fails.

Add 'sts:AssumeRole' to the permissions policy of CodePipelineServiceRole.

Why wrong: The service role already has that permission.

Create the deployment group in the production account again to reset permissions.

Why wrong: The deployment group exists; the error is about authorization.

Update the trust policy of CrossAccountDeployRole to include the DevOps account ID.

Why wrong: The trust policy already allows the correct role.

The CodeBuild project is configured with a VPC that restricts access to external dependency repositories.

Why wrong: Intermittent failures due to network issues would likely affect all builds, not just test failures.

The CodePipeline has a timeout setting that causes the build to be terminated before tests complete.

Why wrong: Timeouts would consistently cause failures, not intermittent ones, and default timeouts are typically long enough.

The CodePipeline is configured with a branch filter that only triggers on the 'main' branch.

Why wrong: Branch filters would prevent the pipeline from triggering at all on 'develop', not cause intermittent failures.

The EC2 instance does not have internet access to reach the S3 bucket.

Why wrong: If the instance is in a VPC without internet access, it might not be able to access S3 via public endpoint, but the error mentions a script failure, not a network error.

The S3 bucket name is misspelled in the 'BeforeInstall' script.

Why wrong: A misspelled bucket name would cause a different error (e.g., NoSuchBucket), not a KMS-related failure.

The CodeDeploy agent does not have permissions to read from the S3 bucket.

Why wrong: The CodeDeploy agent uses the instance's IAM role; if it lacks s3:GetObject, it would fail, but the error specifically points to the script failing, not the agent.

The CodeBuild project is not configured with the correct VPC subnets.

Why wrong: Incorrect subnets would cause a different error, such as failure to launch build container.

The SonarQube server is using a self-signed certificate that CodeBuild does not trust.

Why wrong: This would cause an SSL error, not a timeout.

The CodeBuild project does not have internet access, so it cannot reach the SonarQube server.

Why wrong: The SonarQube server is in the same VPC, so internet access is not required.

Create an AWS Lambda function that stops the pipeline if the Test stage exceeds 1 hour.

Why wrong: This is reactive and complex; a proactive timeout is better.

Set the pipeline execution timeout to 1 hour in the pipeline settings.

Why wrong: This would limit the entire pipeline, including deploy, which might need more time.

Use Amazon CloudWatch Events to detect when the Test stage runs for more than 1 hour and then stop the pipeline.

Why wrong: This is reactive and may not prevent the timeout; also it adds complexity.

AWS CodeCommit

Why wrong: CodeCommit is a source control service, not a CI/CD pipeline orchestrator.

AWS CodeBuild

Why wrong: CodeBuild is a build service that compiles source code and runs tests, but it does not orchestrate the entire release process.

AWS CodeDeploy

Why wrong: CodeDeploy automates code deployment to compute services, but it is not a full pipeline orchestrator.

Enable ECR 'Scan on Push' and configure CodePipeline to deploy only if the scan result is clean.

Why wrong: Scan on Push scans after the image is pushed, not before. The requirement is to scan before push.

Use AWS Lambda to scan the image after push and automatically roll back if vulnerabilities are found.

Why wrong: This scans after push, not before.

Use AWS Security Hub to scan images in ECR and block deployment.

Why wrong: Security Hub aggregates findings but does not scan images itself; it relies on other services.

The GPG key is not registered with the IAM user's profile.

Why wrong: While GPG key must be associated with the IAM user, the issue is that CodeCommit doesn't support pre-receive hooks.

The hook script has a syntax error.

Why wrong: Even if the script is correct, CodeCommit does not execute pre-receive hooks.

The repository is not configured to require signed commits.

Why wrong: CodeCommit does not have a built-in setting to require signed commits; the hook is the intended mechanism, but it's not supported.

Amazon ECS Service Auto Scaling

Why wrong: Auto Scaling adjusts the number of tasks, not traffic shifting between versions.

Amazon Route 53 weighted routing

Why wrong: Route 53 can distribute traffic across multiple endpoints, but it's not the native way for ECS service deployments.

AWS App Mesh with traffic shifting

Why wrong: App Mesh provides traffic splitting, but ECS natively integrates with CodeDeploy for canary deployments.

Use a CloudFormation action in CodePipeline with action mode 'CREATE_UPDATE' and include a manual approval step before the action.

Why wrong: CREATE_UPDATE directly applies changes without creating a change set first.

Use an AWS Lambda function to create a change set and trigger a manual approval via SNS.

Why wrong: This is more complex and not the native CodePipeline CloudFormation action.

Use a CloudFormation action with action mode 'CREATE_UPDATE' and set the 'Review' flag to true.

Why wrong: There is no 'Review' flag; CloudFormation actions do not support reviewing before update in that mode.

Set up AWS CodeDeploy to trigger a build every time a commit is pushed to a repository.

Why wrong: CodeDeploy is for deployment, not building or testing.

Use AWS CloudFormation to create a stack that runs tests every time a new commit is pushed.

Why wrong: CloudFormation is for infrastructure as code, not for running tests.

AWS CodeDeploy for deploying the SAM application.

Why wrong: SAM applications are deployed via CloudFormation, not CodeDeploy.

AWS CodeCommit to build the SAM application.

Why wrong: CodeCommit is a source control service, not a build service.