DVA-C02 Deployment Practice Test 12 — 15 Questions

Question 1

A developer is setting up an IAM role for a CI/CD pipeline. The above IAM policy is attached to the role. The pipeline needs to deploy a revision to an Amazon S3 bucket and then trigger a CodeDeploy deployment. The deployment fails with an access denied error. What is the missing permission?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

codedeploy:RegisterApplicationRevision. The correct missing permission is 'codedeploy:RegisterApplicationRevision'. When deploying a revision stored in Amazon S3, CodeDeploy requires this permission to register the revision before triggering a deployment. Option A is incorrect because 'codedeploy:UpdateDeploymentGroup' is used to modify deployment group settings, not to initiate a deployment. Option C is incorrect because 's3:ListBucket' is not necessary for uploading a revision; the pipeline likely already has s3:PutObject. Option D is incorrect because 's3:GetObjectVersion' is only needed when accessing specific versions of objects, which is not required here.

Answer

codedeploy:UpdateDeploymentGroup

Answer

s3:ListBucket

Answer

s3:GetObjectVersion

Question 2

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a 'OneAtATime' deployment configuration. The developer notices that the deployment is taking a long time. What is the most likely reason?

Accepted Answer

The Auto Scaling group has a large number of instances, and deploying one at a time is slow.. The 'OneAtATime' deployment configuration deploys to one instance at a time, so if the Auto Scaling group has a large number of instances, the deployment will take a long time. Option A is incorrect because the load balancer configuration does not directly affect deployment speed when using 'OneAtATime'. Option C is incorrect because the deployment configuration is correctly set to 'OneAtATime', not 'AllAtOnce'. Option D is incorrect because if the CodeDeploy agent were not running, the deployment would likely fail entirely, not just be slow.

Answer

The deployment group is configured with an incorrect load balancer.

Answer

The deployment configuration is set to 'AllAtOnce', but the developer intended 'OneAtATime'.

Answer

The CodeDeploy agent on the instances is not running.

Question 3

A developer is trying to update a CloudFormation stack that includes a Lambda function. The stack rolls back with the error shown. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have a trust policy that allows Lambda to assume it.. The error message indicates that the IAM role cannot be assumed by Lambda. This typically means the trust policy of the execution role does not include 'lambda.amazonaws.com' as a trusted entity. Option A is incorrect because the error is about assuming the role, not about writing logs. Option B is incorrect because the error is not about the deployment package location. Option C is incorrect because the error is not about code size.

Answer

The Lambda function's execution role lacks permissions to write logs to CloudWatch.

Answer

The Lambda function's deployment package is not stored in Amazon S3.

Answer

The Lambda function's code is too large for the deployment.

Question 4

A company uses AWS OpsWorks for Chef Automate to manage their infrastructure. A developer needs to deploy a new application version to a stack of EC2 instances. The developer wants to minimize downtime and ensure that the deployment is rolled back automatically if any instance fails. Which deployment strategy should the developer use?

Accepted Answer

Rolling deployment with rollback on error. AWS OpsWorks for Chef Automate supports rolling deployments with a rollback-on-error feature. This strategy updates instances in batches, and if any batch fails (e.g., Chef client run errors or application health checks), the deployment automatically rolls back the failed batch to the previous state, minimizing downtime by keeping remaining batches running.

Answer

Canary deployment

Answer

In-place deployment with a single batch

Answer

Blue/green deployment

Question 5

A developer is deploying a static website to Amazon S3. The developer wants to enable versioning to easily roll back to a previous version if the new deployment has issues. After enabling versioning on the bucket, the developer uploads the new files. How can the developer roll back to the previous version?

Accepted Answer

Copy the previous version of the object to the same key, making it the current version.. With versioning enabled, you can restore a previous version by copying it to the same key, which promotes that version to become the current version. Option B is wrong because deleting the current version does not restore a previous version; it simply removes the current version, and the previous version becomes current only if the delete creates a delete marker. Option C is wrong because there is no 'Restore' action in S3 for version rollback; 'Restore' applies to archived objects in Glacier. Option D is wrong because 'Show versions' allows you to see versions but not to set a previous version as current; you must explicitly copy it.

Answer

Delete the current version of the object from the bucket.

Answer

Use the S3 console 'Restore' action on the bucket.

Answer

Enable 'Show versions' and then select the previous version to make it current.

Question 6

A developer is deploying a serverless application using AWS SAM. The application consists of an API Gateway REST API and multiple AWS Lambda functions. The developer wants to deploy the application to a production environment with minimal downtime. Which deployment strategy should the developer use?

Accepted Answer

Use SAM's built-in canary deployment with traffic shifting.. AWS SAM supports canary deployments with traffic shifting, allowing gradual rollout of new versions and minimizing downtime. Option A is wrong because AWS Elastic Beanstalk is not part of SAM; SAM uses AWS CodeDeploy for canary deployments, not Elastic Beanstalk. Option B is wrong because deleting and redeploying the entire stack causes downtime. Option C is wrong because rolling updates by updating functions one by one is not a built-in SAM feature; SAM leverages traffic shifting via AWS CodeDeploy.

Answer

Create a blue/green deployment using AWS Elastic Beanstalk.

Answer

Delete the existing stack and deploy a new one.

Answer

Perform a rolling update by updating functions one by one.

Question 7

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment.' What is the most likely cause?

Accepted Answer

The number of instances that failed deployment exceeded the configured failure threshold.. The error 'The overall deployment failed because too many individual instances failed deployment' occurs when the number of instances that fail deployment exceeds the failure threshold configured in the CodeDeploy deployment group. Option D is correct. Option A is incorrect because missing hooks would produce an error like 'The deployment failed because the application specification file (appspec) is invalid or missing required hooks'. Option B is incorrect because insufficient IAM permissions would result in 'AccessDenied' errors. Option C is incorrect because the Auto Scaling group not having enough instances would cause a different error such as 'The deployment failed because the number of healthy instances is below the minimum required'.

Answer

The application specification file (appspec) is missing required hooks.

Answer

The IAM role for CodeDeploy does not have sufficient permissions to call EC2 APIs.

Answer

The Auto Scaling group does not have enough instances to meet the minimum healthy count.

Question 8

A development team wants to automate the deployment of a microservices application on Amazon ECS with Fargate. The team uses AWS CodePipeline for CI/CD. Each microservice has its own source repository and Dockerfile. The team wants to build Docker images, push them to Amazon ECR, and deploy them to ECS. Which approach minimizes manual effort and follows best practices?

Accepted Answer

Use AWS CodePipeline with a build stage in CodeBuild and a deploy stage that uses the ECS deploy provider.. AWS CodePipeline provides a fully automated CI/CD pipeline. With the ECS deploy provider, CodePipeline can update the ECS service with the new task definition directly, eliminating manual steps. Option A is incorrect because adding CodeDeploy for blue/green deployments introduces unnecessary complexity for a basic ECS deployment; the ECS deploy provider in CodePipeline handles it without additional services. Option B is incorrect because it requires manual triggering of CloudFormation updates, which does not achieve full automation. Option D is incorrect because it requires manual intervention to update the ECS service, contradicting the goal of minimizing manual effort.

Answer

Use AWS CodeDeploy to deploy to ECS with a blue/green deployment.

Answer

Use AWS CloudFormation to create the infrastructure and manually trigger updates.

Answer

Use AWS CodeBuild to build and push images, then manually update the ECS service.

Question 9

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a build stage that compiles the website and a deploy stage that syncs the build output to an S3 bucket. After a recent change, the pipeline succeeds but the website does not show the updated content. What is the most likely cause?

Accepted Answer

Amazon CloudFront is caching the old content and needs an invalidation.. When using CloudFront with an S3 origin, updating the S3 bucket does not automatically invalidate CloudFront's cache. The pipeline succeeds because it uploads the new content to S3, but CloudFront serves the old cached content until the cache expires or is manually invalidated. Option B is incorrect: if the build failed silently, the build output would be empty and the deploy stage would sync an empty folder to S3, which would actually remove the website content, causing the site to be unavailable, not show old content. Option C is incorrect: the deploy action is configured to skip if the source content hasn't changed, but here the build output changed (since a recent change was made), so the deploy should run. Option D is incorrect: if the bucket policy blocked public read access, the website would not load at all, regardless of CloudFront caching. The most likely cause is that CloudFront is caching the old version and needs an invalidation.

Answer

The build output is empty because the build failed silently.

Answer

The deploy action is configured to skip if the source content has not changed.

Answer

The S3 bucket policy does not allow public read access.

Question 10

A developer is deploying a containerized application on Amazon ECS with Fargate. The application needs to read configuration data from AWS Systems Manager Parameter Store. The developer wants to ensure that the ECS task definition can access the parameter without hardcoding the value. What should the developer do?

Accepted Answer

Use the 'secrets' field in the task definition to reference the parameter ARN.. The 'secrets' field in an ECS task definition allows you to reference AWS Systems Manager Parameter Store (or AWS Secrets Manager) parameters by their ARN. This enables the container to retrieve the configuration value at runtime without hardcoding it in the task definition or container image, maintaining security and flexibility.

Answer

Store the configuration in Amazon ECR as a label and reference it in the task definition.

Answer

Use the 'configs' section in the task definition to load from Parameter Store.

Answer

Add a 'parameters' section in the task definition to load from Parameter Store.

Question 11

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'The overall deployment failed because the deployment group did not have enough instances to successfully deploy.' What is the most likely cause?

Accepted Answer

The deployment group contains zero instances.. The error message indicates that the deployment group did not have enough instances to successfully deploy. This occurs when the deployment group has zero registered instances. Option B is correct because the most likely cause is that the deployment group contains zero instances. Options A, C, and D would result in different error messages, such as revision format errors, agent communication failures, or invalid lifecycle hook configurations.

Answer

The revision has an incorrect file format.

Answer

The CodeDeploy agent on the instance is not running.

Answer

The appspec file contains an invalid lifecycle hook.

Question 12

A company uses AWS CloudFormation to manage infrastructure. The development team wants to make a change to a stack that involves replacing a critical resource. The team wants to minimize downtime and ensure that the replacement is successful before removing the old resource. Which CloudFormation feature should the team use?

Accepted Answer

Use a CreationPolicy on the resource to ensure it is fully created before the old one is deleted.. When AWS CloudFormation replaces a resource during a stack update, it creates the new resource first and then deletes the old one. To ensure that the new resource is fully functional and successful before the old one is deleted, you should use a `CreationPolicy`. This pauses the update process and prevents the deletion of the old resource until the new resource sends a success signal (e.g., via cfn-signal). If the signal is not received, the update rolls back, keeping the old resource intact and minimizing downtime. A change set (Option B) only previews what changes will occur; it does not ensure successful execution or control the runtime replacement behavior.

Answer

Use AWS CodeDeploy blue/green deployment.

Answer

Use a change set to review the changes before executing.

Answer

Use nested stacks to isolate the resource.

Question 13

Refer to the exhibit. A CloudFormation stack update resulted in a rollback. What is the most likely reason for the rollback?

Accepted Answer

A user manually cancelled the update of the Lambda function.. The event message 'Resource update cancelled by user' indicates that the Lambda function update was cancelled by a user, triggering the rollback. Options B, C, and D are incorrect because there is no indication of a timeout, insufficient permissions, or invalid code; the error explicitly states user cancellation.

Answer

The Lambda function update timed out.

Answer

The Lambda function's IAM role did not have sufficient permissions.

Answer

The Lambda function code was invalid.

Question 14

Refer to the exhibit. A developer has the above IAM policy attached. The developer is trying to push code to a CodeCommit repository and trigger a CodePipeline. The push succeeds but the pipeline does not start. What is the most likely reason?

Accepted Answer

The CloudWatch Events rule that triggers the pipeline on code push does not have the necessary IAM role to invoke the pipeline.. The pipeline is triggered by a CloudWatch Events rule that monitors code push events. For the rule to invoke the pipeline, it must have an IAM role with permission to start the pipeline. If that role is missing or lacks permissions, the pipeline won't start even though the developer has push permissions. Option A is incorrect because the developer's policy allows GitPush, so push succeeds. Option C is incorrect because the developer has StartPipelineExecution permission, but that's not how the pipeline is triggered—it's an event-driven trigger. Option D is incorrect because CodeCommit does not require a trigger to be configured; the CloudWatch Events rule handles the event.

Answer

The developer does not have permissions to push to the repository.

Answer

The developer does not have permissions to start the pipeline.

Answer

The CodeCommit repository does not have a trigger configured.

Question 15

Refer to the exhibit. A developer deploys this CloudFormation template. After deployment, the S3 bucket is created but the developer notices that the lifecycle rule does not appear in the bucket's management console. What is the most likely cause?

Accepted Answer

The VersioningConfiguration is incorrectly specified.. The VersioningConfiguration might be incorrectly specified, such as setting it to 'Suspended' while the lifecycle rule requires versioning to be enabled for actions like 'NoncurrentVersionExpiration'. If versioning is not enabled, the lifecycle rule may not be applied or may not appear in the management console. Option A is incorrect because the 'Prefix' property is optional; an omitted prefix means the rule applies to all objects and is still valid. Option B is incorrect because lifecycle rules are not required to have a 'Transitions' property; they can have other actions like 'Expiration'. Option D is incorrect because bucket names can contain account IDs as long as they are globally unique.

Answer

The lifecycle rule is missing the 'Prefix' property, causing it to be invalid.

Answer

The lifecycle rule must have a 'Transitions' property.

Answer

The bucket name contains an account ID, which is not allowed.