DVA-C02 Deployment Practice Test 2 — 15 Questions

Question 1

A developer is deploying an application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) that includes specific software packages not available in the standard Elastic Beanstalk platform. Which approach should the developer use to ensure the custom AMI is used for all EC2 instances in the environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the .ebextensions configuration file to specify the custom AMI ID.. AWS Elastic Beanstalk allows you to use a custom AMI with a standard platform. To ensure the custom AMI is used for all EC2 instances in the environment, you can specify the AMI ID in the 'ImageId' option of the 'aws:autoscaling:launchconfiguration' namespace using an .ebextensions configuration file. This is the standard infrastructure-as-code approach for applying a custom AMI.

Answer

Create a custom platform using the Packer tool and specify it in the environment configuration.

Answer

Use the Elastic Beanstalk console to change the AMI ID in the environment configuration after creation.

Answer

Launch a new environment with a different platform version that includes the required software.

Question 2

A developer is deploying an application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) that includes specific software packages not available in the standard Elastic Beanstalk platform. Which approach should the developer use to ensure the custom AMI is used for all EC2 instances in the environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immutable.. Immutable deployments (Option C) are correct because AWS Elastic Beanstalk deploys the new version to a fresh set of instances in a temporary Auto Scaling group and performs health checks. Only after these instances pass health checks (are 'fully tested') does Elastic Beanstalk route traffic to them and terminate the old instances. This ensures zero downtime and guarantees that no production traffic is routed to the new version until it is verified as healthy.

Answer

All at once.

Answer

Rolling with additional batch.

Answer

Traffic splitting.

Question 3

A developer is deploying a web application using AWS Elastic Beanstalk. The application runs on multiple Amazon EC2 instances behind an Application Load Balancer. The developer wants to deploy a new version with zero downtime and the ability to quickly roll back if issues are discovered. Which deployment policy should the developer choose?

Accepted Answer

Immutable. Immutable deployment is the correct choice because it launches a completely new set of EC2 instances in a temporary Auto Scaling group alongside the existing ones. Once the new instances pass health checks, they are integrated, and the old instances are terminated. This guarantees zero downtime. If the deployment fails at any point during the process, Elastic Beanstalk simply terminates the new temporary Auto Scaling group, resulting in an immediate rollback with zero impact on the active environment.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 4

A developer is deploying a web application on AWS Elastic Beanstalk. The environment must maintain the same number of running instances throughout the deployment to ensure capacity. The developer also wants to minimize downtime. Which deployment policy should be used?

Accepted Answer

Rolling with additional batch. Rolling with additional batch is correct because it first launches a new batch of instances in addition to the existing ones, ensuring full capacity is maintained throughout the deployment. Once the new instances are healthy, instances are updated in batches, and the original batch is terminated only after the new ones are fully serving traffic, minimizing downtime.

Answer

All at once

Answer

Rolling

Answer

Immutable

Question 5

An Elastic Beanstalk deployment must avoid downtime and create a full new set of instances before swapping traffic, accepting higher temporary cost. Which policy fits?

Accepted Answer

Immutable. Immutable deployment is correct because it launches a full set of new instances in a temporary Auto Scaling group behind the same load balancer. Once the new instances pass health checks, they are promoted to the main Auto Scaling group, and the old instances are terminated. This ensures zero downtime, maintains full capacity during deployment, and allows for a clean rollback if the deployment fails, at the cost of temporarily doubling the number of instances.

Answer

All at once

Answer

Rolling

Answer

Traffic splitting disabled

Question 6

A CloudFormation stack update fails and rolls back. Which two practices help diagnose and reduce future deployment risk?

Accepted Answer

Review stack events and resource status reasons. Reviewing stack events and resource status reasons in CloudFormation provides detailed error messages for each resource that failed during the update. This allows you to pinpoint the exact cause of the failure, such as insufficient IAM permissions, a resource limit exceeded, or a dependency conflict. Analyzing these events is essential for diagnosing issues and preventing similar failures in future deployments.

Answer

Delete the stack immediately without checking events

Answer

Disable rollback for all production deployments permanently

Question 7

A CodeDeploy blue/green ECS deployment uses an ALB. Which two resources are required?

Accepted Answer

Two target groups for original and replacement task sets. A blue/green deployment in CodeDeploy for ECS requires two distinct target groups: one for the original (blue) task set and one for the replacement (green) task set. The ALB routes traffic to the appropriate target group based on the listener rules, allowing CodeDeploy to shift traffic from the blue to the green task set during deployment.

Answer

A single target group shared by both task sets only

Answer

An S3 static website endpoint

Answer

Listener configuration that allows traffic shifting/testing

Question 8

A developer wants separate dev and prod CloudFormation deployments from the same template. Which two practices help?

Accepted Answer

Use parameters or mappings for environment-specific values. To deploy separate dev and prod environments from the same template, you must create separate stacks (or use different stack names) for each environment (Option C). To handle environment-specific differences (such as resource sizes, AMI IDs, or database names) within that single template, you should use CloudFormation parameters or mappings (Option A). This allows the template to remain reusable and dynamic. Hardcoding production ARNs (Option B) prevents reusability, and using the root account (Option D) violates the AWS security best practice of least privilege.

Answer

Hardcode production ARNs throughout the template

Answer

Use the root account for deployments

Question 9

Drag and drop the steps to set up a CI/CD pipeline using AWS CodePipeline in the correct order.

Accepted Answer

Set up artifact storage, then set up source repository, then set up build project, then set up deployment target, then create pipeline.. To set up a CI/CD pipeline using AWS developer tools, you must first create the individual resources that the pipeline will orchestrate. This means creating the AWS CodeCommit repository (Source), the AWS CodeBuild project (Build), and the AWS CodeDeploy application/deployment group (Deploy) before finally creating the pipeline in AWS CodePipeline to link them together.

Answer

Set up source repository, then set up build project, then set up artifact storage, then set up deployment target, then create pipeline.

Answer

Create pipeline, then set up source repository, then set up build project, then set up deployment target, then set up artifact storage.

Answer

Set up deployment target, then set up source repository, then set up build project, then set up artifact storage, then create pipeline.

Question 10

A company is using AWS CodeDeploy with an in-place deployment to an Auto Scaling group. The deployment fails with the error 'Deployment failed because the deployment group does not have enough instances to deploy to'. The Auto Scaling group has a minimum size of 2, maximum size of 5, and desired capacity of 2. The deployment configuration is CodeDeployDefault.AllAtOnce. What is the most likely cause?

Accepted Answer

The instances in the Auto Scaling group are not passing health checks.. The error 'Deployment failed because the deployment group does not have enough instances to deploy to' occurs when there are zero healthy instances in the deployment group at the start of deployment. With CodeDeployDefault.AllAtOnce, the minimum number of healthy hosts is 0, so a single instance failure during deployment would not trigger this error. The most likely cause is that the instances in the Auto Scaling group are not passing health checks, resulting in no healthy instances available for deployment. Option C is correct.

Answer

The Auto Scaling group needs to have at least 3 instances to use AllAtOnce.

Answer

The deployment configuration is not compatible with Auto Scaling groups.

Answer

The deployment group has only 2 instances, and the deployment failed on one instance, causing the minimum healthy hosts threshold to be violated.

Question 11

A developer is using AWS Elastic Beanstalk to deploy a Python web application. The developer wants to run database migrations before the application starts. Which TWO methods can the developer use to achieve this? (Choose TWO.)

Accepted Answer

Use an .ebextensions configuration file with container_commands.. Option B is correct because Elastic Beanstalk's .ebextensions configuration files support a container_commands section, which runs commands on the EC2 instance after the application and web server are set up but before the application version is deployed and started, making it ideal for running database migrations. Option D is correct because a Procfile lets you define custom processes for your Elastic Beanstalk application, so you can specify a command that executes the migration (e.g., python manage.py migrate) before the web process starts, ensuring migrations complete prior to serving traffic. Option A is not correct because an AWS Lambda function triggered on deployment is not a native Elastic Beanstalk mechanism for running pre-start commands on the application instances. Option C is not correct because Elastic Beanstalk does not provide a generic 'pre-deployment hook' in the application source code; platform hooks exist but are configured via .platform directories, not as a simple source-code hook. Option E is not correct because cron.yaml is used to schedule periodic tasks on worker environments, not to run one-time migrations before application startup.

Answer

Use an AWS Lambda function that triggers on deployment.

Answer

Add a pre-deployment hook to the application source code.

Answer

Add a cron.yaml file to schedule the migration.

Question 12

A development team uses AWS CodeDeploy to deploy a serverless application. The deployment fails with the error: 'The deployment failed because the deployment group did not contain any instances.' The deployment group is configured with an Amazon ECS service and uses the Blue/Green deployment type. What is the MOST likely cause?

Accepted Answer

The CodeDeploy service role does not have permissions to describe ECS clusters.. In AWS CodeDeploy, the error 'The deployment failed because the deployment group did not contain any instances' occurs specifically in EC2/On-Premises deployments when CodeDeploy cannot find any target EC2 instances (either because the Auto Scaling group has a desired capacity of 0, or the specified tag filters do not match any running instances). If the CodeDeploy agent is missing or the instance profile lacks permissions, the deployment will instead hang and eventually time out. Missing AppSpec files cause a failure during the DownloadBundle phase.

Answer

The AppSpec file is incorrectly formatted and does not specify the task definition.

Answer

The deployment group's traffic routing configuration is set to 'AllAtOnce' causing immediate failure.

Answer

The deployment group does not have a configured ECS service to deploy to.

Question 13

A company uses AWS Elastic Beanstalk to deploy a PHP application. The application requires write access to the /tmp directory on the EC2 instances. The deployment uses a custom platform. After a recent deployment, the application fails to write to /tmp. The operations team verifies that the instance security group and NACLs allow all outbound traffic. What is the MOST likely cause?

Accepted Answer

The custom platform has a read-only root filesystem.. Elastic Beanstalk custom platforms are built from a platform definition that can specify a read-only root filesystem for the EC2 instances. If the root filesystem is mounted read-only, the application cannot write to /tmp even though security groups and NACLs allow traffic, because /tmp resides on the root volume. This is the most likely cause given the symptom and the custom platform context.

Answer

The application is running as an unprivileged user without write access to /tmp.

Answer

The security group is blocking outbound traffic to the S3 bucket.

Answer

The instance profile does not have permissions to write to the S3 bucket.

Question 14

A DevOps engineer is troubleshooting a failed AWS CodeBuild build. The build project uses a custom Docker image stored in Amazon ECR. The build logs show: 'Error: Cannot pull Docker image: repository does not exist or may require 'docker login'.' The engineer has verified that the ECR repository exists and the IAM role used by CodeBuild has the 'ecr:GetDownloadUrlForLayer', 'ecr:BatchGetImage', and 'ecr:GetAuthorizationToken' permissions. What is the MOST likely cause?

Accepted Answer

The image tag specified in the buildspec does not exist in the ECR repository.. The error 'Cannot pull Docker image: repository does not exist or may require 'docker login'' occurs when the specified image tag in the buildspec does not exist in the ECR repository. Even though the repository exists and the IAM role has the necessary permissions (ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, ecr:GetAuthorizationToken), if the tag is missing or misspelled, the pull fails. Option A (cross-account) would result in an access denied error, not repository not found. Option B (incorrect image name) might also cause a similar error, but the error message explicitly mentions repository does not exist, and the most common cause is a wrong tag. Option D (VPC/NAT) would cause network timeout, not this error.

Answer

The ECR repository is in a different AWS account and the IAM role does not have cross-account trust.

Answer

The CodeBuild project's environment image override is set to the wrong image name.

Answer

The CodeBuild project is configured with a VPC that does not have a NAT gateway.

Question 15

An application deployed on AWS Lambda needs access to an Amazon RDS database. The Lambda function is in a VPC with a public subnet. The RDS instance is in a private subnet. The function can connect to the database but experiences frequent timeouts. What is the MOST likely cause?

Accepted Answer

The Lambda function's security group does not allow outbound traffic to the RDS security group.. The most likely cause is that the Lambda function's security group does not allow outbound traffic to the RDS security group on the database port. Lambda functions in a VPC require proper security group rules to communicate with resources in other subnets. Without an outbound rule permitting traffic to the RDS instance, connection attempts will time out. Option A (timeout setting) could be a symptom but not the root cause—Lambda's default timeout is 3 seconds, and queries might succeed if connectivity is correct. Option B (IAM permissions) is unrelated to network connectivity; Lambda uses IAM for API calls but not for direct database connections. Option C (memory) affects compute performance, not network reachability.

Answer

The Lambda function timeout is set too low for the database queries.

Answer

The IAM role for the Lambda function does not have the 'rds:Connect' permission.

Answer

The Lambda function does not have enough memory allocated.