DVA-C02 Deployment Practice Test 13 — 15 Questions

Question 1

A development team needs to deploy a containerized web application on AWS. The deployment must be automated, scalable, and minimize manual intervention. Which AWS service should the team use to orchestrate the deployment of containers across a cluster of Amazon EC2 instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon ECS. Amazon ECS (Elastic Container Service) is a fully managed container orchestration service that allows you to run and scale containerized applications on a cluster of Amazon EC2 instances. It integrates with AWS services like Auto Scaling and Elastic Load Balancing to automate deployment, scaling, and management, minimizing manual intervention.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

Amazon S3

Question 2

A company uses AWS CodePipeline to deploy a web application. The deployment fails intermittently during the 'Deploy' stage. The pipeline includes a step that runs a shell script on an EC2 instance. The pipeline uses a CodeBuild project for the build stage. What is the MOST likely cause of the intermittent failure?

Accepted Answer

The EC2 instance used for deployment does not have the CodeDeploy agent installed.. If the EC2 instance is terminated or replaced, the CodeDeploy agent may not be installed, causing intermittent failures. Option A is wrong because CodeBuild uses temporary instances. Option C is wrong because CodePipeline does not require a VPC. Option D is wrong because IAM roles are not updated automatically.

Answer

The CodeBuild project is using an outdated build image.

Answer

The pipeline is not configured to use a VPC.

Answer

The IAM role for CodePipeline does not have permissions to deploy.

Question 3

Refer to the exhibit. An IAM policy is attached to a user who needs to deploy a serverless application. The user reports that they cannot upload a new version of a Lambda function using the AWS CLI. What is the MOST likely reason?

Accepted Answer

The policy does not include lambda:UpdateFunctionCode.. The error occurs because the IAM policy attached to the user does not include the `lambda:UpdateFunctionCode` permission, which is required to upload a new version of a Lambda function via the AWS CLI. Without this action, the `update-function-code` command fails, even if other Lambda permissions like `lambda:InvokeFunction` are present. The policy must explicitly allow `lambda:UpdateFunctionCode` to enable code updates.

Answer

The Lambda invoke permission is scoped to a specific function.

Answer

The user does not have permission to write to the S3 bucket.

Answer

The user is not in the same AWS region as the Lambda function.

Question 4

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment is successful, but the application health checks fail. The application runs on a single EC2 instance. What should a developer do to troubleshoot this issue?

Accepted Answer

View the application logs in the Elastic Beanstalk console.. Viewing the application logs in the Elastic Beanstalk console helps identify why the application is not responding to health checks. Logs can reveal application errors, missing dependencies, or configuration issues. Option D is wrong because SSH may not be configured for the instance, and restarting the web server without understanding the root cause may not resolve the issue. Option B is incorrect because modifying the CloudFormation template to increase instance size does not address health check failures. Option C is incorrect because adding an Application Load Balancer does not fix underlying application problems.

Answer

Modify the CloudFormation template to increase instance size.

Answer

Add an Application Load Balancer to the environment.

Answer

SSH into the EC2 instance and restart the web server.

Question 5

Refer to the exhibit. A developer tried to create a CloudFormation stack that includes an EC2 instance. The stack creation failed and rolled back. What should the developer do to get more details about the failure?

Accepted Answer

Run `aws cloudformation describe-stack-events` for the stack.. The `aws cloudformation describe-stack-events` command lists events for the stack, including status reason messages that detail why the creation failed. Option A (reviewing template syntax) is not the most direct way to get failure details; the events already capture errors. Option B (`detect-stack-drift`) is used to detect changes from the intended template, not to diagnose creation failures. Option D (updating with the same template) would attempt to update a failed stack, but the events from the original creation provide the needed information without additional risks.

Answer

Review the CloudFormation template syntax.

Answer

Use the `detect-stack-drift` command.

Answer

Update the stack with the same template to see the error.

Question 6

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. Recently, deployments have been failing because the CodeBuild project cannot download dependencies from the internet. The build environment does not have internet access due to VPC settings. Which THREE steps should a developer take to resolve this issue? (Choose THREE.)

Accepted Answer

Configure a NAT gateway in the public subnet to allow outbound internet access.. Corrected explanation: A NAT gateway in a public subnet allows instances in private subnets to access the internet, enabling CodeBuild to download dependencies. C: Placing the CodeBuild project in a private subnet is necessary for using the NAT gateway to route outbound traffic. E: VPC endpoints for Amazon S3 allow CodeBuild to access dependencies stored in S3 without requiring internet access. B is incorrect because moving the source to S3 does not address the lack of internet connectivity for downloading dependencies. D is incorrect because, although assigning a public IP is possible, it only works if the project is in a public subnet with an internet gateway; the standard recommended solution for this scenario is using a private subnet with a NAT gateway.

Answer

Move the source stage to use S3 instead of CodeCommit.

Answer

Assign a public IP address to the CodeBuild project.

Question 7

A developer is deploying a serverless application using AWS SAM. The application includes multiple Lambda functions and an API Gateway. Which THREE AWS CLI commands are part of the typical SAM deployment workflow? (Choose THREE.)

Accepted Answer

sam deploy. `sam deploy` is the AWS SAM CLI command that deploys the packaged application to AWS, creating or updating the CloudFormation stack with the Lambda functions and API Gateway resources. It reads the `template.yaml` and the packaged artifacts (from `sam package`) to provision the infrastructure. This command is the final step in the standard SAM deployment workflow.

Answer

sam init

Answer

aws s3 cp

Question 8

A company has a production environment running on AWS. The environment includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is deployed using AWS CodeDeploy with a blue/green deployment strategy. Recently, the deployment started failing because the new instances do not pass the health checks configured on the ALB. The health check path is '/health'. The developer has verified that the application starts correctly and responds to the health check on the new instances when accessed directly via the instance's private IP. However, the health checks from the ALB are failing. The security group for the ALB allows inbound traffic on port 80 from 0.0.0.0/0, and the security group for the EC2 instances allows inbound traffic on port 80 from the ALB's security group. The VPC has both public and private subnets. The Auto Scaling group launches instances in private subnets. The ALB is in public subnets. What is the MOST likely cause of the health check failure?

Accepted Answer

The network ACL on the private subnets is blocking inbound traffic from the ALB's subnets.. The health check failures are most likely due to network ACLs on the private subnets blocking inbound traffic from the ALB's subnets. The ALB performs health checks from its private IP addresses in the public subnets. While security groups allow traffic on port 80 from the ALB's security group, network ACLs are stateless and must allow both inbound and outbound traffic. If the private subnet's NACL denies inbound traffic from the ALB's subnet (or outbound return traffic), the health checks will fail. Option A is incorrect because the application responds correctly when accessed directly. Option B is incorrect because the health check path is '/health' and works. Option C is incorrect because the ALB and instances are in the same VPC.

Answer

The application is not listening on port 80 on the new instances.

Answer

The health check path is configured incorrectly in the ALB target group.

Answer

The ALB is not in the same VPC as the instances.

Question 9

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application needs to read environment-specific configuration variables. Which configuration file should the developer use to define these variables within the Elastic Beanstalk environment?

Accepted Answer

.ebextensions/*.config. Ebextensions/*.config files in YAML or JSON format are used to define environment-specific configuration, including environment variables, in Elastic Beanstalk. Option A is wrong because package.json is for Node.js dependencies and cannot set environment variables. Option C is wrong because Dockerfile is for Docker containers, not Elastic Beanstalk configuration. Option D is wrong because buildspec.yml is used by AWS CodeBuild, not Elastic Beanstalk.

Answer

package.json

Answer

Dockerfile

Answer

buildspec.yml

Question 10

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration is CodeDeployDefault.OneAtATime. The Auto Scaling group has 4 instances. What is the most likely cause?

Accepted Answer

The first instance in the deployment fails, and the deployment stops because only one instance is deployed at a time.. With the CodeDeployDefault.OneAtATime deployment configuration, only one instance is deployed at a time. If that instance fails, the deployment stops and fails immediately, since no other instances are attempted. This matches the error indicating too many instances failed or too few healthy instances, even though only one instance was actually deployed and failed.

Answer

The CodeDeploy agent on the instances is not running.

Answer

The target group health checks are misconfigured.

Answer

The Auto Scaling group is scaling down during deployment.

Question 11

A company is migrating a monolithic application to microservices on AWS. They want to use a blue/green deployment strategy for a new version of a service running on Amazon ECS with Fargate. The service is behind an Application Load Balancer. Which combination of actions should be taken to implement blue/green deployment with minimal downtime? (Choose the correct answer.)

Accepted Answer

Use AWS CodeDeploy to orchestrate a blue/green deployment by creating a new task set and shifting traffic.. AWS CodeDeploy supports blue/green deployments on Amazon ECS with Fargate. It creates a new task set and gradually shifts traffic from the existing (blue) task set to the new (green) task set, minimizing downtime. Option A is incorrect because managing a second ALB and updating DNS is more complex and not the typical approach for ECS blue/green; AWS CodeDeploy automates this. Option C is incorrect because a rolling update updates the existing service in place, which may cause downtime or require careful orchestration; it is not a blue/green deployment. Option D is incorrect because manually creating a new target group and modifying the ALB listener rule is error-prone and does not provide automated traffic shifting or rollback capabilities.

Answer

Create a second ALB pointing to the new service, then update DNS to switch traffic.

Answer

Update the existing ECS service with the new task definition and allow rolling update.

Answer

Manually create a new target group with the new service and update the ALB listener rule.

Question 12

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with user data. The user data script installs software and configures the application. The developer wants to ensure that the stack creation waits for the user data script to complete before marking the stack as CREATE_COMPLETE. What should the developer do?

Accepted Answer

Add a CreationPolicy with a timeout to the EC2 instance resource and use cfn-signal in the user data.. The correct approach is to add a CreationPolicy to the EC2 instance resource and use cfn-signal in the user data script. The CreationPolicy tells CloudFormation to wait for a signal from the instance before considering the resource created. The user data script runs, installs software, and then calls cfn-signal to indicate success. If the signal is not received within the timeout, the stack creation fails. Option A (DependsOn) only orders resource creation, not waits for user data. Option B (WaitCondition) is a legacy method that is more complex; CreationPolicy is the recommended modern approach. Option D (running as a service) does not send any signal to CloudFormation.

Answer

Add a DependsOn attribute to the EC2 instance resource.

Answer

Use a CloudFormation WaitCondition and a WaitConditionHandle.

Answer

Configure the EC2 instance to run the user data script as a service.

Question 13

A company uses AWS CodePipeline with CodeBuild and CodeDeploy. The pipeline deploys a web application to an Auto Scaling group. Recently, a deployment failed because the build output exceeded the CodeDeploy deployment limit for the number of files. The developer needs to prevent this issue in the future. What should the developer do?

Accepted Answer

Modify the buildspec.yml to compress the build output.. The CodeDeploy file count limit applies to the number of files extracted from the deployment archive. By compressing the build output into a single archive (e.g., a tar.gz file), the number of files in the archive is reduced to one, thereby staying within the limit. After extraction, the original files are restored, but the limit is checked on the archive contents, not the extracted files. This approach effectively bypasses the file count limit.

Answer

Use AWS CodeStar to manage the pipeline.

Answer

Increase the instance size in the Auto Scaling group to handle more files.

Answer

Store the build output in an S3 bucket and modify the CodeDeploy deployment to pull the archive from S3.

Question 14

A company is using AWS CodeBuild to compile and test a Java application. The build takes 15 minutes, but the company wants to reduce build time by caching dependencies. Which file should the developer modify to enable caching in the build project?

Accepted Answer

buildspec.yml. The buildspec.yml file can include a 'cache' section to specify paths to cache, such as the Maven local repository (~/.m2). Option A is incorrect because the CodeBuild console settings are not a file; the question specifically asks which file to modify. Option B is incorrect because pom.xml is a Maven project file used for dependency management, not for CodeBuild caching configuration. Option C is incorrect because buildspec.json is not the standard filename; CodeBuild expects buildspec.yml or buildspec.yaml.

Answer

CodeBuild console settings

Answer

pom.xml

Answer

buildspec.json

Question 15

A developer is deploying a microservice to Amazon ECS using Fargate. The service needs to be accessible from the internet via an Application Load Balancer. The developer creates the ECS service with a network load balancer by mistake. What is the minimal change required to fix the deployment?

Accepted Answer

Delete the ECS service and recreate it with an ALB.. Once an Amazon ECS service is created with a load balancer configuration, that configuration is immutable. You cannot update the service to point to a different load balancer or target group. Therefore, the only way to switch from a Network Load Balancer (NLB) to an Application Load Balancer (ALB) is to delete the existing ECS service and recreate it with the correct ALB configuration.

Answer

Create a new target group for the ALB and update the ECS service to use it.

Answer

Update the ECS service to point to the ALB listener.

Answer

Change the existing target group to use ALB protocol.