DVA-C02 Deployment Practice Test 21 — 15 Questions

Question 1

A developer is deploying a microservices architecture on Amazon ECS. The services need to communicate with each other securely. The developer wants to use service discovery and ensure that traffic between services is encrypted. Which combination of services should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh with mutual TLS. AWS Cloud Map provides service discovery by registering ECS service instances with DNS-based or API-based resolution, enabling dynamic routing between microservices. AWS App Mesh with mutual TLS (mTLS) encrypts traffic between services and enforces identity-based authentication, ensuring end-to-end encryption and secure communication. This combination directly addresses the requirements for service discovery and encrypted traffic.

Answer

Use Amazon API Gateway and AWS Lambda

Answer

Use Amazon Route 53 private hosted zones and enable DNSSEC

Answer

Use an Application Load Balancer for each service and enable TLS termination

Question 2

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of several Lambda functions and an API Gateway. The developer wants to enable gradual deployment of Lambda function versions with automatic rollback based on CloudWatch alarms. What should the developer add to the SAM template?

Accepted Answer

Add 'AutoPublishAlias' and 'DeploymentPreference' properties to the Lambda function resource, specifying a canary deployment with a CloudWatch alarm for rollback.. The SAM template supports gradual deployments through the 'AutoPublishAlias' property combined with 'DeploymentPreference'. This allows you to specify a canary deployment (or linear) and define CloudWatch alarms for automatic rollback. Option A is incorrect because manually managing 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' does not provide automated rollback. Option B is incorrect because while 'DeploymentPreference' with 'Type: Linear' does enable gradual deployment, the question specifically asks for the SAM-native approach using 'AutoPublishAlias' and 'DeploymentPreference' together; also the 'Alarms' list is specified within 'DeploymentPreference'. Option D is incorrect because 'CodeDeployLambdaAlias' is not a valid SAM resource; SAM abstracts CodeDeploy configuration through the 'DeploymentPreference' property on the Lambda function resource.

Answer

Use 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' resources to manually shift traffic and set up CloudWatch alarms to revert the alias if needed.

Answer

Add a 'DeploymentPreference' property with 'Type' set to 'Linear' and specify a 'Alarms' list for rollback.

Answer

Add a 'CodeDeployLambdaAlias' resource to the template and configure the deployment group with a canary deployment configuration.

Question 3

A company uses AWS OpsWorks for configuration management and deployment of applications on EC2 instances. The company wants to migrate to AWS Systems Manager for automation and patching. Which Systems Manager capability should be used to execute scripts and commands on EC2 instances as part of a deployment?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows you to remotely and securely execute scripts and commands on EC2 instances as part of a deployment. Run Command is designed for one-time or on-demand execution, which aligns with the need to run deployment scripts. State Manager is for ongoing configuration management, not for one-time deployment tasks.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager State Manager

Answer

AWS Systems Manager Automation

Question 4

A company uses AWS CloudFormation to manage infrastructure. The development team wants to implement a CI/CD pipeline that automatically updates a CloudFormation stack when code is pushed to a CodeCommit repository. The pipeline should also run tests before deploying. Which THREE services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can compile source code, run tests, and produce artifacts that are ready for deployment. In this CI/CD pipeline, CodeBuild executes the test suite after code is pushed to CodeCommit, ensuring that only validated code proceeds to update the CloudFormation stack.

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy

Question 5

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application uses environment variables for database credentials. What is the BEST way to securely provide these credentials to the application?

Accepted Answer

Set environment properties in the Elastic Beanstalk environment configuration.. Elastic Beanstalk allows you to set environment properties in the environment configuration, which are injected as environment variables into the application's runtime. This approach keeps sensitive credentials out of the source code and deployment artifacts, adhering to the principle of least privilege and secure credential management. For a Node.js application, these environment variables can be accessed via `process.env`, providing a secure and flexible way to manage database credentials without hardcoding or storing them in files.

Answer

Store the credentials in a file in the source code repository.

Answer

Store the credentials in the application's configuration file within the deployment package.

Answer

Hardcode the credentials in the application code.

Question 6

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Accepted Answer

The new application version fails the configured health checks on the instances.. The error message indicates that instances failed deployment, which is most commonly caused by the new application version failing the health checks configured in the deployment group. CodeDeploy uses these health checks (e.g., ELB health checks or custom scripts) to determine if an instance is healthy after deployment; if the application crashes or returns non-200 status codes, CodeDeploy marks the instance as failed and aborts the deployment.

Answer

The deployment group does not exist.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Answer

The CodeDeploy agent is not installed on the instances.

Question 7

A developer is deploying a web application on AWS Elastic Beanstalk. The application needs to run on multiple instances behind a load balancer. Which deployment policy will cause the LEAST downtime?

Accepted Answer

Rolling with additional batch. Rolling with additional batch (C) is the correct deployment policy for minimizing downtime because it first launches a full new batch of instances in addition to the existing ones, then shifts traffic to the new instances before terminating the old ones. This ensures that the full capacity remains available throughout the deployment, unlike other policies that temporarily reduce capacity or require a full replacement.

Answer

All at once

Answer

Rolling

Answer

Immutable

Question 8

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the BeforeInstall lifecycle event. What should the developer do to troubleshoot the issue?

Accepted Answer

Check the appspec.yml file for errors in the BeforeInstall hook.. The BeforeInstall hook scripts are defined in the appspec.yml file, and a failure during that lifecycle event typically indicates an error in the script or the hook configuration. Option A is wrong because the deployment group configuration (e.g., Auto Scaling group, tags) does not directly cause a script failure in the BeforeInstall hook. Option B is wrong because the build output from CodeBuild is already successful and not related to the deployment failure. Option D is wrong because deployment configuration settings (e.g., deployment type, rollback triggers) do not affect the execution of the BeforeInstall hook scripts.

Answer

Check the deployment group configuration.

Answer

Verify the build output from CodeBuild.

Answer

Review the deployment configuration settings.

Question 9

A developer is using AWS CodeBuild to build a Java application. The build succeeds locally but fails in CodeBuild with the error 'BUILD FAILED: Unable to find a Java installation.' The buildspec.yml file includes a 'runtime-versions' section specifying Java 11. The CodeBuild project uses the 'aws/codebuild/amazonlinux2-x86_64-standard:4.0' image. What is the MOST likely cause of the failure?

Accepted Answer

The runtime-versions section in buildspec.yml is not correctly formatted.. The error 'Unable to find a Java installation' indicates that the CodeBuild environment does not have Java available at runtime. When using a standard managed image like 'aws/codebuild/amazonlinux2-x86_64-standard:4.0', Java must be explicitly declared in the 'runtime-versions' section of buildspec.yml. The most likely cause is that the 'runtime-versions' section is incorrectly formatted (e.g., using 'java: 11' instead of the correct 'java: corretto11'), causing CodeBuild to skip installing Java.

Answer

The CodeBuild project does not have sufficient permissions to download Java.

Answer

The buildspec.yml file is not in the root of the source directory.

Answer

The build commands reference a non-existent Maven dependency.

Question 10

A company uses AWS Elastic Beanstalk to deploy a Python web application. After a recent deployment, the environment health turns 'Severe' and the application becomes unresponsive. The developer checks the logs and finds multiple '502 Bad Gateway' errors from the nginx proxy. The application was working before the deployment. What is the MOST likely cause?

Accepted Answer

The new application code has a bug that causes the application to crash.. A 502 Bad Gateway error from nginx means the reverse proxy cannot communicate with the application backend. Since the application was working before the deployment and became unresponsive immediately after, the most likely cause is a bug in the new code that causes the application process to crash or hang. Elastic Beanstalk's nginx proxy expects a healthy response from the application on the designated port; if the application fails to start or crashes repeatedly, nginx returns 502 errors.

Answer

The Procfile is missing from the application source.

Answer

The environment's load balancer is not configured correctly.

Answer

The environment variables are not set correctly.

Question 11

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer needs to identify the root cause. Which AWS service should the developer use to view detailed error logs from the failed deployment?

Accepted Answer

Amazon CloudWatch Logs (if configured) or the CodeDeploy agent log files on the EC2 instances. When a CodeDeploy deployment fails due to instance-level errors, the most direct way to investigate is to examine the CodeDeploy agent logs located on each EC2 instance at `/opt/codedeploy-agent/deployment-root/deployment-logs/codedeploy-agent.log`. If Amazon CloudWatch Logs has been configured to stream these logs, you can also view them centrally in the CloudWatch console. These logs contain detailed error messages from the `codedeploy-agent` process, including script failures, permission issues, or missing dependencies that caused the deployment to fail.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

AWS CodeDeploy console

Question 12

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer wants to ensure that the Lambda function's environment variables are encrypted at rest. What is the most straightforward way to achieve this?

Accepted Answer

No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.. AWS SAM, by default, encrypts Lambda function environment variables at rest using an AWS managed KMS key (aws/lambda). This is a built-in behavior of the Lambda service, so no additional configuration is required in the SAM template to achieve encryption at rest. The developer does not need to take any action beyond deploying the function.

Answer

Enable encryption in the SAM template using the 'Encrypt' property.

Answer

Modify the Lambda function's code to encrypt environment variables before deployment.

Answer

Create a customer managed KMS key and specify it in the SAM template.

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The developer has updated the application code and wants to deploy the new version with a rolling deployment strategy to minimize downtime. Which configuration should the developer use?

Accepted Answer

Set the deployment policy to 'Rolling'. The 'Rolling' deployment policy in AWS Elastic Beanstalk updates instances in batches, moving the new application version into a subset of instances while keeping the rest serving traffic, which minimizes downtime by ensuring capacity is never fully reduced. This is the correct choice for a rolling update that balances speed and availability without requiring a full parallel environment.

Answer

Set the deployment policy to 'Immutable'

Answer

Set the deployment policy to 'All at once'

Answer

Set the deployment policy to 'Blue/green'

Question 14

A developer is deploying a microservices architecture on Amazon ECS. The services need to communicate with each other securely. The developer wants to use service discovery and ensure that traffic between services is encrypted. Which combination of services should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An ALB with two target groups, one for blue and one for green.. AWS CodeDeploy for Amazon ECS requires an Application Load Balancer (ALB) with two target groups to handle traffic routing during a blue/green deployment. The blue target group serves the current production version, while the green target group serves the new version. CodeDeploy shifts traffic from blue to green by updating the ALB listener rules, and after a successful deployment, the green target group becomes the new production target.

Answer

An ALB with a single target group and an Amazon CloudFront distribution.

Answer

An ECS service discovery namespace.

Answer

A Network Load Balancer (NLB) with a single target group.

Question 15

A developer uses AWS CodeCommit to store source code. The developer wants to automatically trigger a build in AWS CodeBuild every time a new commit is pushed to the master branch. Which AWS service should the developer use to configure this integration?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it provides a fully managed continuous delivery service that can be configured to automatically start a pipeline execution whenever a new commit is pushed to a specific branch in AWS CodeCommit. By setting up a CodeCommit source action in a pipeline, CodePipeline uses webhooks or polling to detect changes and then triggers the build project in AWS CodeBuild as the next stage. This creates a seamless CI/CD workflow without requiring custom event rules or additional services.

Answer

Amazon CloudWatch Events (or EventBridge)

Answer

Amazon S3 events

Answer

AWS CodeDeploy