DVA-C02 Deployment Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A developer attempted to update a CloudFormation stack that includes an EC2 instance. The update failed and the stack is rolling back. The event shows that the EC2 instance update failed with reason 'Resource update cancelled: stack update cancelled'. What is the most likely cause of this failure?

Accepted Answer

A stack policy is preventing updates to the EC2 instance resource.. Option B is correct because the error 'Resource update cancelled: stack update cancelled' indicates that the stack update was cancelled, likely due to a stack policy that denies updates to the EC2 instance. Option A is wrong because insufficient permissions would show a different error. Option C is wrong because the instance being in a stopped state would cause a different error. Option D is wrong because a missing parameter would cause a validation error before update.

Answer

The IAM user does not have permission to update EC2 instances.

Answer

The template has a missing required parameter for the EC2 instance.

Answer

The EC2 instance is in a stopped state and cannot be updated.

Question 2

Refer to the exhibit. A CloudFormation template creates an S3 bucket with a 'Retain' deletion policy and an EC2 instance. If the stack is deleted, what happens to the S3 bucket?

Accepted Answer

The S3 bucket is retained and must be deleted manually.. Option D is correct because the 'Retain' deletion policy on the S3 bucket overrides the default stack deletion behavior. When a CloudFormation stack is deleted, any resource with a 'DeletionPolicy' set to 'Retain' is preserved in the AWS account, even though the resource is removed from the stack's template. The bucket continues to exist independently and must be manually deleted by the user via the AWS Management Console, CLI, or SDK.

Answer

The S3 bucket is deleted along with the stack.

Answer

The S3 bucket is moved to a different account.

Answer

A snapshot of the S3 bucket is taken before deletion.

Question 3

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application uses environment variables for database credentials. What is the BEST way to securely provide these credentials to the application?

Accepted Answer

Set environment properties in the Elastic Beanstalk environment configuration.. Option D is correct because Elastic Beanstalk allows you to set environment properties in the environment configuration, which are injected as environment variables into the application's runtime. This approach keeps sensitive credentials out of the source code and deployment artifacts, adhering to the principle of least privilege and secure credential management. For a Node.js application, these environment variables can be accessed via `process.env`, providing a secure and flexible way to manage database credentials without hardcoding or storing them in files.

Answer

Store the credentials in a file in the source code repository.

Answer

Store the credentials in the application's configuration file within the deployment package.

Answer

Hardcode the credentials in the application code.

Question 4

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Accepted Answer

The new application version fails the configured health checks on the instances.. The error message indicates that instances failed deployment, which is most commonly caused by the new application version failing the health checks configured in the deployment group. CodeDeploy uses these health checks (e.g., ELB health checks or custom scripts) to determine if an instance is healthy after deployment; if the application crashes or returns non-200 status codes, CodeDeploy marks the instance as failed and aborts the deployment.

Answer

The deployment group does not exist.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Answer

The CodeDeploy agent is not installed on the instances.

Question 5

A development team uses AWS CodePipeline to automate deployments. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy. After a recent change, the deploy stage fails intermittently with a timeout error. The CodeBuild stage succeeds. What should the team do to troubleshoot the issue?

Accepted Answer

Increase the timeout value in the CodeDeploy deployment configuration.. Option D is correct because the intermittent timeout error in the deploy stage, despite a successful build, indicates that the CodeDeploy agent is taking longer than the configured timeout to complete the deployment lifecycle events (e.g., BeforeInstall, AfterInstall, ApplicationStart). Increasing the timeout value in the CodeDeploy deployment configuration gives the agent more time to finish these operations, which directly addresses the timeout failure without altering the build or permissions.

Answer

Ensure the deployment group is configured to use the correct Auto Scaling group.

Answer

Verify that the CodeDeploy service role has sufficient permissions.

Answer

Check the buildspec.yml file for syntax errors.

Question 6

A company uses AWS CloudFormation to manage infrastructure. A developer wants to update a stack that includes an Amazon RDS database. The update requires replacing the database with a new instance. Which stack update policy should the developer use to minimize downtime?

Accepted Answer

Replacement with Snapshot. Option C is correct because the Replacement policy with Snapshot allows CloudFormation to create a new DB instance, take a snapshot of the old instance, and then delete the old instance, minimizing downtime. Option A is wrong because Delete does not preserve data. Option B is wrong because Retain keeps the old instance, causing downtime. Option D is wrong because Snapshot without Replacement is not a valid update policy.

Answer

Snapshot

Answer

Retain

Answer

Delete

Question 7

Refer to the exhibit. A developer has attached the above IAM policy to an IAM role used by an AWS Lambda function. The Lambda function reads and writes objects to an S3 bucket. However, the function fails when trying to write objects. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses AWS KMS encryption, and the policy does not include KMS permissions.. Option B is correct because the bucket is encrypted with AWS KMS, and the policy does not include kms:Decrypt and kms:GenerateDataKey permissions. Option A is wrong because GetObject works. Option C is wrong because the bucket policy is not shown. Option D is wrong because the function role has the policy.

Answer

The S3 bucket policy denies the Lambda function.

Answer

The Lambda function does not have permission to read objects.

Answer

The Lambda function is not using the correct IAM role.

Question 8

A developer is deploying a web application on AWS Elastic Beanstalk. The application needs to run on multiple instances behind a load balancer. Which deployment policy will cause the LEAST downtime?

Accepted Answer

Rolling with additional batch. Option D is correct because rolling with additional batch adds new instances before taking old ones out of service, resulting in zero downtime. Option A is wrong because all at once causes downtime. Option B is wrong because rolling causes some downtime. Option C is wrong because immutable launches a full new set, causing temporary doubling of instances.

Answer

All at once

Answer

Rolling

Answer

Immutable

Question 9

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline triggers on changes to the S3 bucket. However, the pipeline does not trigger when a new object is uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured for the pipeline.. Option A is correct because S3 event notifications must be configured to invoke the pipeline. Option B is wrong because the bucket policy is not related. Option C is wrong because the pipeline is not triggered by S3 events directly. Option D is wrong because encryption does not affect triggering.

Answer

The S3 bucket policy denies access to CodePipeline.

Answer

The pipeline is not configured with a webhook.

Answer

The object is encrypted and CodePipeline cannot read it.

Question 10

A developer is creating a CloudFormation template to deploy a microservices architecture. The template includes an Amazon ECS service with an Application Load Balancer. The developer wants to ensure that the load balancer is created before the ECS service. How should the developer achieve this?

Accepted Answer

Use the DependsOn attribute in the ECS service resource to reference the load balancer.. Option A is correct because DependsOn explicitly specifies the order. Option B is wrong because Ref does not guarantee creation order. Option C is wrong because order in template does not guarantee creation order. Option D is wrong because Fn::GetAtt does not enforce order.

Answer

Use the Ref function in the ECS service to reference the load balancer.

Answer

Define the load balancer before the ECS service in the template.

Answer

Use the Fn::GetAtt function to reference the load balancer.

Question 11

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the BeforeInstall lifecycle event. What should the developer do to troubleshoot the issue?

Accepted Answer

Check the appspec.yml file for errors in the BeforeInstall hook.. Option D is correct because the BeforeInstall hook scripts are in the appspec.yml file. Option A is wrong because the deployment group configuration is not the issue. Option B is wrong because the build output is already successful. Option C is wrong because the deployment configuration settings are not related.

Answer

Check the deployment group configuration.

Answer

Verify the build output from CodeBuild.

Answer

Review the deployment configuration settings.

Question 12

Which TWO are benefits of using AWS CloudFormation for infrastructure deployment? (Choose two.)

Accepted Answer

Infrastructure is provisioned consistently across environments.. Options A and D are correct. CloudFormation provides consistent provisioning (infrastructure as code) and automated rollback on failure. Option B is wrong because it is not a compliance service. Option C is wrong because it does not replace CI/CD. Option E is wrong because it does not provide real-time monitoring.

Answer

Automatically enforces compliance rules.

Answer

Replaces the need for a CI/CD pipeline.

Answer

Provides real-time monitoring of deployed resources.

Question 13

A company is deploying a new microservice using AWS Lambda and Amazon API Gateway. Which THREE steps should be included in the deployment pipeline? (Choose three.)

Accepted Answer

Deploy the API Gateway API to a stage.. Options A, C, and E are correct. The pipeline should include building the Lambda function (A), creating the API Gateway resources (C), and deploying the API (E). Option B is wrong because updating DNS is not required. Option D is wrong because CloudFront is not necessary.

Answer

Invalidate the Amazon CloudFront cache.

Answer

Update the Route 53 DNS record to point to the new API.

Question 14

Which THREE are valid deployment strategies in AWS CodeDeploy? (Choose three.)

Accepted Answer

AllAtOnce. Options A, B, and D are correct. CodeDeploy supports AllAtOnce, Rolling, and Blue/Green. Option C is wrong because Canary is not a CodeDeploy strategy. Option E is wrong because Immutable is an Elastic Beanstalk strategy, not CodeDeploy.

Answer

Immutable

Answer

Canary

Question 15

A company uses AWS CodePipeline to deploy a containerized application to Amazon ECS with Fargate. The pipeline consists of a source stage (Amazon ECR), a build stage (CodeBuild), and a deploy stage (CodeDeploy with ECS Blue/Green). Recently, after a successful build, the deploy stage fails with the error 'Service deployment failed because the task definition is not compatible with the target group.' The task definition uses the 'awsvpc' network mode and specifies a port mapping of 80. The target group is configured to use port 80. What is the MOST likely cause of the failure?

Accepted Answer

The target group health check path is not configured correctly.. The error 'Service deployment failed because the task definition is not compatible with the target group' typically occurs when the target group's health check configuration is invalid or unreachable. In an ECS Blue/Green deployment with CodeDeploy, the target group health check path must be configured to return a valid HTTP response from the container; if the path is incorrect (e.g., missing or pointing to a non-existent endpoint), the target group marks instances as unhealthy, causing the deployment to fail even though the port mapping and network mode are correct.

Answer

The task definition port mapping does not match the target group port.

Answer

The task definition does not include a logging configuration for CloudWatch Logs.

Answer

The task definition uses the 'awsvpc' network mode, which is not supported for Blue/Green deployments.