DVA-C02 Deployment — 25 Questions

Question 1

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an Amazon API Gateway HTTP API and several AWS Lambda functions. The developer wants to implement a canary deployment for the API Gateway stage so that 10% of traffic is shifted to the new version for 30 minutes before the remaining 90% is shifted. Which SAM resource attribute should the developer configure on the API Gateway resource?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeploymentPreference. To implement gradual traffic shifting (such as canary or linear deployments) for Lambda functions in an AWS SAM template, you must configure the `DeploymentPreference` attribute on the `AWS::Serverless::Function` resource. Under `DeploymentPreference`, you specify the `Type` (e.g., `Canary10Percent30Minutes`), which instructs AWS CodeDeploy to manage the traffic shifting. Note that `AutoPublishAlias` is also required to enable versioning and alias creation, but `DeploymentPreference` is the specific attribute where the traffic-shifting strategy is defined.

Answer

AutoPublishAlias

Answer

ProvisionedConcurrencyConfig

Answer

EventInvokeConfig

Question 2

A developer is deploying an application to Amazon ECS using AWS CodeDeploy with a blue/green deployment strategy. After the new task set is created, it fails health checks. The developer wants to immediately route traffic back to the original task set without waiting for CodeDeploy to complete the rollback process. Which action should the developer take?

Accepted Answer

Use the CodeDeploy console to stop the deployment and then choose to reroute traffic.. In AWS CodeDeploy blue/green deployments for ECS, if you need to immediately revert to the original task set, you must stop the deployment. Stopping an in-progress deployment automatically triggers a rollback, which reroutes traffic back to the original (blue) task set and deletes the replacement (green) task set. The 'Reroute traffic' button is only used to manually fast-track shifting traffic forward to the new task set.

Answer

Update the ECS service to set the desired count of the new task set to zero.

Answer

Delete the new task set.

Answer

Update the Application Load Balancer listener rule to forward traffic to the original target group.

Question 3

A developer is deploying a new version of a web application to an EC2 Auto Scaling group using AWS CodeDeploy with a blue/green deployment strategy. The Auto Scaling group is associated with an Application Load Balancer (ALB). The developer wants to ensure that the new instances are registered with the ALB and pass health checks before any traffic is routed to them. Which CodeDeploy configuration should the developer use?

Accepted Answer

Set the 'Reroute traffic to replacement instances' to 'Immediately'.. When a load balancer (like an ALB) is configured with a CodeDeploy deployment group, CodeDeploy automatically registers the replacement instances and waits for them to pass the load balancer's health checks during the `AllowTraffic` lifecycle event. To ensure this happens as soon as the instances are ready, the developer should select 'Reroute traffic immediately'. There is no 'Wait for health check' option in CodeDeploy; health check validation is an inherent part of the deployment process when a load balancer is specified.

Answer

Set the 'Reroute traffic to replacement instances' to 'Wait for time' and specify a wait time.

Answer

Set the 'Reroute traffic to replacement instances' to 'Wait for health check' and specify the ELB health check.

Answer

Set the deployment to terminate the original instances before rerouting traffic.

Question 4

A developer is using AWS CodeDeploy to deploy an application to an Amazon ECS service with the Fargate launch type. The deployment uses a blue/green strategy. After the new task set is created and passes the initial health checks, the traffic is shifted to the new task set. However, the new task set is immediately replaced by the old one after a few minutes, causing a rollback. What is the most likely reason?

Accepted Answer

The new task set fails the post-traffic shift validation tests.. In a blue/green deployment on ECS with CodeDeploy, after traffic is shifted to the new task set, CodeDeploy runs post-traffic shift validation tests (e.g., via Lambda hooks or target group health checks). If these tests fail, CodeDeploy automatically triggers a rollback by replacing the new task set with the original (old) task set. This matches the described behavior where the new task set is immediately replaced after a few minutes.

Answer

The lifecycle hooks for the new task set are failing.

Answer

The target group for the new task set is not configured correctly.

Answer

The deployment group's rollback configuration triggers due to alarm threshold.

Question 5

A developer is deploying a microservice using AWS CodeDeploy with an Amazon ECS compute platform. The service must be updated with a blue/green deployment strategy. The developer wants to ensure that if the deployment fails, the new task set is automatically terminated and the original task set continues to serve traffic. Which configuration should the developer set?

Accepted Answer

Set the deployment group's 'Rollback configuration' to automatically roll back failed deployments and configure the 'Deployment configuration' to terminate the original task set on success, but keep it on failure.. AWS CodeDeploy for Amazon ECS blue/green deployments allows you to configure automatic rollback on failure within the deployment group settings. By enabling 'Rollback configuration' to automatically roll back failed deployments and setting the deployment group's blue/green deployment settings to terminate the original task set on success, you ensure that if the deployment fails, CodeDeploy rolls back, terminating the new task set and keeping the original task set to continue serving traffic.

Answer

Set the deployment configuration to 'AllAtOnce' and enable termination of the original task set

Answer

Define a blue/green deployment using an AppSpec file with a 'Hooks' section to specify a 'BeforeAllowTraffic' hook that checks health. If the check fails, CodeDeploy automatically rolls back.

Answer

Use a manual approval step in the pipeline to decide whether to terminate the new task set.

Question 6

A company deploys a serverless application using AWS SAM. The application includes an Amazon API Gateway HTTP API and several AWS Lambda functions. The developer wants to implement a canary deployment for the API Gateway stage: 5% of traffic should be immediately shifted to the new version, and after 15 minutes, the remaining 95% should be shifted. Which SAM resource attribute should the developer configure?

Accepted Answer

DeploymentPreference with Type: Canary5Percent15Minutes. AWS SAM's DeploymentPreference attribute supports predefined CodeDeploy configurations. For a canary deployment where 10% of traffic is shifted immediately and the remaining 90% is shifted after 15 minutes, the correct type is 'Canary10Percent15Minutes'. This is supported for AWS::Serverless::Function and AWS::Serverless::Api (REST APIs), but not for HTTP APIs.

Answer

DeploymentPreference with Type: Canary10Percent30Minutes

Answer

DeploymentPreference with Type: Linear10PercentEvery10Minutes

Answer

DeploymentPreference with Type: AllAtOnce

Question 7

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The developer wants the deployment to automatically roll back if any of the new instances fail a health check within the first 10 minutes after deployment. Which configuration should the developer set in the CodeDeploy deployment group?

Accepted Answer

Configure a CloudWatch alarm and enable alarm-based automatic rollback in the AutoRollbackConfiguration.. CodeDeploy's AutoRollbackConfiguration allows you to specify CloudWatch alarms as triggers for automatic rollback. By creating a CloudWatch alarm that monitors the EC2 Auto Scaling group's health check failures and setting the alarm's evaluation period to 10 minutes, the deployment will automatically roll back if any new instance fails a health check within that window. This directly meets the requirement without custom scripting or manual intervention.

Answer

Set the DeploymentStyle to 'BLUE_GREEN' and configure the 'LoadBalancerInfo' with the target group.

Answer

Create a lifecycle hook for the Auto Scaling group to trigger a rollback script.

Answer

Set a TriggerConfiguration in the deployment group to send notifications on deployment failure.

Question 8

A developer is using AWS CodePipeline with a two-stage pipeline: Source (CodeCommit) and Deploy (Elastic Beanstalk). The developer wants to add a test stage that runs unit tests using AWS CodeBuild. The test stage should run only when a specific branch (development) is pushed. Which approach should the developer use?

Accepted Answer

Create a separate pipeline for the development branch and configure it with the test stage.. AWS CodePipeline is designed such that a pipeline structure is static and runs end-to-end for the configured source. It does not natively support conditionally skipping or executing specific stages (like a Test stage) based on the branch name within a single pipeline. To run unit tests on a 'development' branch while maintaining a separate deployment workflow for another branch (like 'main'), the correct AWS best practice is to create a separate pipeline for the development branch and configure it with the Test stage.

Answer

Add a test stage in the pipeline and configure a 'branch' filter on the source action to only trigger for the development branch.

Answer

Add a test stage in the pipeline and configure a 'branch' condition on the test action using a Lambda function.

Answer

Add a test stage in the pipeline and use a 'Manual approval' action that requires a human to verify the branch.

Question 9

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The deployment must be rolled back automatically if any instance in the deployment fails a health check within 10 minutes after the deployment. Which configuration should the developer set in the CodeDeploy deployment group?

Accepted Answer

Configure a deployment group with automatic rollback enabled and set the rollback trigger to instance failure.. The developer needs to configure the CodeDeploy deployment group with automatic rollback enabled and set the rollback trigger to 'instance failure'. This configuration ensures that if any instance fails a health check within the specified monitoring period (10 minutes after deployment), CodeDeploy automatically rolls back the deployment to the last known good revision. The 'instance failure' trigger specifically monitors the health of each instance and initiates a rollback when a health check fails, meeting the requirement exactly.

Answer

Set the deployment style to in-place and enable automatic rollback with event triggers.

Answer

Configure a deployment configuration with a minimum healthy hosts of 90% and enable CloudWatch alarm-based rollback.

Answer

Set the deployment style to blue/green and enable automatic rollback for deployment failure.

Question 10

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of EC2 instances. The deployment must automatically roll back if the new application version causes health check failures for more than 20% of the instances within the first 5 minutes after deployment. Which configuration should the developer set in the deployment group?

Accepted Answer

Create a CloudWatch alarm that monitors the DeploymentFailure metric and configure it as a rollback trigger in the deployment group.. AWS CodeDeploy supports CloudWatch alarm-based rollback triggers. By creating a CloudWatch alarm that monitors the UnHealthyHostCount metric of the Application Load Balancer (which reflects health check failures of the instances) and configuring it as a rollback trigger in the deployment group, the deployment will automatically roll back if the alarm state is breached (e.g., more than 20% of instances failing health checks) within the specified monitoring period (5 minutes).

Answer

Define a lifecycle hook in the Auto Scaling group that terminates instances with failing health checks.

Answer

Set the deployment configuration to use a minimum healthy host percentage of 80% and a timeout of 5 minutes.

Answer

Configure the AppSpec file with a rollback section that specifies the health check failure threshold.

Question 11

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an Amazon API Gateway HTTP API and several AWS Lambda functions. The developer wants to implement a canary deployment for the API Gateway stage so that 10% of traffic is shifted to the new version for 30 minutes before the remaining 90% is shifted. Which SAM resource attribute should the developer configure on the API Gateway resource?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS::Lambda::Permission. AWS::Lambda::Permission is the correct resource because it explicitly grants the S3 service principal permission to invoke the Lambda function when an object is created. In AWS SAM, this resource is automatically generated when you define an S3 event source on a Lambda function, but if you need to declare it manually or override permissions, you use AWS::Lambda::Permission with a SourceArn pointing to the S3 bucket and a SourceAccount to prevent confused deputy attacks.

Answer

AWS::S3::BucketPolicy

Answer

AWS::Lambda::EventSourceMapping

Answer

AWS::IAM::Role

Question 12

A company uses AWS Elastic Beanstalk to run a web application. They want to deploy a new version with zero downtime. They have a production environment running the current version and a staging environment running the new version. After thoroughly testing the staging environment, they want to swap the URLs so that production now points to the new version. Which deployment strategy should they use?

Accepted Answer

Blue/green deployment with CNAME swap. Blue/green deployment with a CNAME swap is the correct strategy because it allows you to run two identical environments (blue = current production, green = new version) and switch traffic atomically by updating the DNS CNAME record. This achieves zero downtime since the production environment remains active until the swap is complete, and the staging environment has been fully tested. Elastic Beanstalk supports this by letting you perform a CNAME swap between environments via the console, CLI, or API.

Answer

Rolling deployment

Answer

Immutable deployment

Answer

All at once deployment

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The development team wants to test a new feature by routing a small percentage of traffic to a separate environment before fully rolling out. Which Elastic Beanstalk deployment strategy should the developer use?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct strategy because it allows you to route a small percentage of traffic to a separate environment (the 'green' environment) by swapping the CNAME record or using Elastic Beanstalk's environment URL swap feature. This enables testing the new feature with a subset of users before fully rolling out to the 'blue' environment, minimizing risk and enabling quick rollback if issues arise.

Answer

Rolling deployment

Answer

Immutable deployment

Answer

All at once deployment

Question 14

A developer is using AWS Elastic Beanstalk to deploy a Node.js application. The application requires an environment variable that contains a secret (e.g., a database password). The developer wants to store the secret securely and make it available to the application instances. Which Elastic Beanstalk feature should be used?

Accepted Answer

Use the AWS Secrets Manager integration in Elastic Beanstalk.. To securely store and retrieve secrets (such as database credentials) in AWS Elastic Beanstalk, the best practice is to use a dedicated secrets management service like AWS Secrets Manager or AWS Systems Manager Parameter Store. The application's EC2 instances are assigned an IAM instance profile. By granting this instance profile permission to read the secret, the application code can securely retrieve the secret at runtime using the AWS SDK, avoiding the need to store sensitive information in plaintext in environment properties or source code.

Answer

Store the secret in an environment property with the value set in plaintext.

Answer

Use an .ebextensions configuration file to set the environment variable.

Answer

Use Elastic Beanstalk platform hooks to retrieve the secret at startup.

Question 15

A developer is deploying a new version of a web application on AWS Elastic Beanstalk. The application currently runs in a single environment with an Auto Scaling group. The developer wants to ensure zero downtime during the deployment and that the new version can be fully tested before receiving any traffic. Which Elastic Beanstalk deployment policy should the developer use?

Accepted Answer

Immutable. Immutable deployment is the correct choice because it launches a completely new Auto Scaling group with the new application version alongside the old one. Once the new instances pass health checks, traffic is cut over to them, and the old instances are terminated. If the deployment fails, Elastic Beanstalk simply terminates the new Auto Scaling group, ensuring an immediate and clean rollback with zero downtime and no impact on the existing running instances.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 16

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires custom configuration, such as setting environment variables for the EC2 instances. Which file should the developer include in the application source bundle under the appropriate directory to achieve this?

Accepted Answer

Include a .ebextensions/options.config file.. AWS Elastic Beanstalk uses `.ebextensions` directory with `.config` files (e.g., `options.config`) to define custom configuration, including environment variables for EC2 instances. These YAML or JSON files are processed during environment creation and updates, allowing you to set `option_settings` that override or augment the default platform configuration.

Answer

Include a buildspec.yml file in the root directory.

Answer

Include an appspec.yml file.

Answer

Include a cron.yaml file.

Question 17

A developer is using AWS CloudFormation to deploy a stack with multiple resources. To ensure that a specific EC2 instance is created only after a security group is created, the developer wants to define the dependency. How should the developer achieve this in the CloudFormation template?

Accepted Answer

Use the DependsOn attribute on the EC2 instance resource. When there is no direct relationship or reference between two resources in a CloudFormation template, you must use the `DependsOn` attribute to explicitly define the creation order. If a reference (like `Ref` or `Fn::GetAtt`) already exists between the resources, CloudFormation automatically handles the dependency implicitly, making `DependsOn` unnecessary in those cases.

Answer

Use the Ref function to refer to the security group in the EC2 instance properties

Answer

Use the AWS::NoValue intrinsic function

Answer

Use the Condition attribute on the EC2 instance

Question 18

A developer is deploying an application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) that includes specific software packages not available in the standard Elastic Beanstalk platform. Which approach should the developer use to ensure the custom AMI is used for all EC2 instances in the environment?

Accepted Answer

Modify the .ebextensions configuration file to specify the custom AMI ID.. AWS Elastic Beanstalk allows you to use a custom AMI with a standard platform. To ensure the custom AMI is used for all EC2 instances in the environment, you can specify the AMI ID in the 'ImageId' option of the 'aws:autoscaling:launchconfiguration' namespace using an .ebextensions configuration file. This is the standard infrastructure-as-code approach for applying a custom AMI.

Answer

Create a custom platform using the Packer tool and specify it in the environment configuration.

Answer

Use the Elastic Beanstalk console to change the AMI ID in the environment configuration after creation.

Answer

Launch a new environment with a different platform version that includes the required software.

Question 19

A developer is deploying an application using AWS Elastic Beanstalk with a Docker platform. The developer wants to minimize downtime during deployments and ensure that the new version is fully tested before routing traffic to it. Which deployment policy should the developer choose?

Accepted Answer

Immutable.. Immutable deployments (Option C) are correct because AWS Elastic Beanstalk deploys the new version to a fresh set of instances in a temporary Auto Scaling group and performs health checks. Only after these instances pass health checks (are 'fully tested') does Elastic Beanstalk route traffic to them and terminate the old instances. This ensures zero downtime and guarantees that no production traffic is routed to the new version until it is verified as healthy.

Answer

All at once.

Answer

Rolling with additional batch.

Answer

Traffic splitting.

Question 20

A developer is deploying a web application using AWS Elastic Beanstalk. The application runs on multiple Amazon EC2 instances behind an Application Load Balancer. The developer wants to deploy a new version with zero downtime and the ability to quickly roll back if issues are discovered. Which deployment policy should the developer choose?

Accepted Answer

Immutable. Immutable deployment is the correct choice because it launches a completely new set of EC2 instances in a temporary Auto Scaling group alongside the existing ones. Once the new instances pass health checks, they are integrated, and the old instances are terminated. This guarantees zero downtime. If the deployment fails at any point during the process, Elastic Beanstalk simply terminates the new temporary Auto Scaling group, resulting in an immediate rollback with zero impact on the active environment.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch