DVA-C02 Deployment Practice Test 22 — 15 Questions

Question 1

A developer is setting up an IAM role for a CI/CD pipeline. The above IAM policy is attached to the role. The pipeline needs to deploy a revision to an Amazon S3 bucket and then trigger a CodeDeploy deployment. The deployment fails with an access denied error. What is the missing permission?

Accepted Answer

codedeploy:RegisterApplicationRevision. Option C is correct because to trigger a CodeDeploy deployment, the 'codedeploy:RegisterApplicationRevision' permission is required when using S3 as the revision location. Option A is wrong because 's3:ListBucket' is not needed for uploading. Option B is wrong because 'codedeploy:UpdateDeploymentGroup' is for updating configuration, not deployment. Option D is wrong because 's3:GetObjectVersion' is for versioning, not required.

Answer

codedeploy:UpdateDeploymentGroup

Answer

s3:ListBucket

Answer

s3:GetObjectVersion

Question 2

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a 'OneAtATime' deployment configuration. The developer notices that the deployment is taking a long time. What is the most likely reason?

Accepted Answer

The Auto Scaling group has a large number of instances, and deploying one at a time is slow.. Option C is correct because 'OneAtATime' deploys to one instance at a time, which can be slow for large groups. Option A is wrong because the deployment configuration is correct. Option B is wrong because the agent is not the issue. Option D is wrong because the deployment group is correctly configured.

Answer

The deployment group is configured with an incorrect load balancer.

Answer

The deployment configuration is set to 'AllAtOnce', but the developer intended 'OneAtATime'.

Answer

The CodeDeploy agent on the instances is not running.

Question 3

A developer is trying to update a CloudFormation stack that includes a Lambda function. The stack rolls back with the error shown. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have a trust policy that allows Lambda to assume it.. Option A is correct because the error states that the role cannot be assumed by Lambda, meaning the trust policy of the IAM role does not include 'lambda.amazonaws.com' as a trusted entity. Option B is wrong because the error is about the role, not permissions. Option C is wrong because the error is not about S3. Option D is wrong because the function code is not the issue.

Answer

The Lambda function's execution role lacks permissions to write logs to CloudWatch.

Answer

The Lambda function's deployment package is not stored in Amazon S3.

Answer

The Lambda function's code is too large for the deployment.

Question 4

A company uses AWS OpsWorks for Chef Automate to manage their infrastructure. A developer needs to deploy a new application version to a stack of EC2 instances. The developer wants to minimize downtime and ensure that the deployment is rolled back automatically if any instance fails. Which deployment strategy should the developer use?

Accepted Answer

Rolling deployment with rollback on error. Option B is correct because rolling deployments update instances in batches, and if any instance fails, the deployment can be rolled back. Option A is wrong because blue/green is not built into OpsWorks. Option C is wrong because in-place updates can cause downtime. Option D is wrong because canary is not a standard OpsWorks strategy.

Answer

Canary deployment

Answer

In-place deployment with a single batch

Answer

Blue/green deployment

Question 5

A developer is deploying a static website to Amazon S3. The developer wants to enable versioning to easily roll back to a previous version if the new deployment has issues. After enabling versioning on the bucket, the developer uploads the new files. How can the developer roll back to the previous version?

Accepted Answer

Copy the previous version of the object to the same key, making it the current version.. Option B is correct because with versioning enabled, you can restore a previous version by copying it to the same key, making it the current version. Option A is wrong because deleting the current version does not restore the previous one. Option C is wrong because there is no 'Restore' action like in RDS. Option D is wrong because you cannot simply 'enable' a previous version; you must copy it.

Answer

Delete the current version of the object from the bucket.

Answer

Use the S3 console 'Restore' action on the bucket.

Answer

Enable 'Show versions' and then select the previous version to make it current.

Question 6

A developer is deploying a serverless application using AWS SAM. The application consists of an API Gateway REST API and multiple AWS Lambda functions. The developer wants to deploy the application to a production environment with minimal downtime. Which deployment strategy should the developer use?

Accepted Answer

Use SAM's built-in canary deployment with traffic shifting.. Option A is correct because AWS SAM supports canary deployments, which allow traffic shifting gradually to new versions, minimizing downtime. Option B is wrong because rolling updates are not natively supported by SAM for Lambda. Option C is wrong because blue/green deployments require manual setup and are not built into SAM. Option D is wrong because replacing the stack causes downtime.

Answer

Create a blue/green deployment using AWS Elastic Beanstalk.

Answer

Delete the existing stack and deploy a new one.

Answer

Perform a rolling update by updating functions one by one.

Question 7

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment.' What is the most likely cause?

Accepted Answer

The number of instances that failed deployment exceeded the configured failure threshold.. Option C is correct because CodeDeploy has a failure threshold that, when exceeded, fails the entire deployment. Option A is wrong because insufficient capacity would cause a different error. Option B is wrong because IAM permissions would cause access denied errors. Option D is wrong because missing tags would cause a different error.

Answer

The application specification file (appspec) is missing required hooks.

Answer

The IAM role for CodeDeploy does not have sufficient permissions to call EC2 APIs.

Answer

The Auto Scaling group does not have enough instances to meet the minimum healthy count.

Question 8

A development team wants to automate the deployment of a microservices application on Amazon ECS with Fargate. The team uses AWS CodePipeline for CI/CD. Each microservice has its own source repository and Dockerfile. The team wants to build Docker images, push them to Amazon ECR, and deploy them to ECS. Which approach minimizes manual effort and follows best practices?

Accepted Answer

Use AWS CodePipeline with a build stage in CodeBuild and a deploy stage that uses the ECS deploy provider.. Option D is correct because CodePipeline can directly integrate with ECS using deploy actions that update the ECS service with new task definitions. Option A is wrong because it adds unnecessary manual steps. Option B is wrong because it is not a best practice to bypass CI/CD. Option C is wrong because it adds extra complexity with CodeDeploy when not needed for Fargate.

Answer

Use AWS CodeDeploy to deploy to ECS with a blue/green deployment.

Answer

Use AWS CloudFormation to create the infrastructure and manually trigger updates.

Answer

Use AWS CodeBuild to build and push images, then manually update the ECS service.

Question 9

A developer is deploying an application using AWS Elastic Beanstalk. The application needs to connect to an Amazon RDS database. What is the best practice for storing database credentials?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Option C is correct because AWS Secrets Manager is designed for securely storing and rotating secrets. Option A is wrong because hardcoding credentials is insecure. Option B is wrong because environment variables can be exposed in logs. Option D is wrong because S3 is not secure for credentials without encryption.

Answer

Hardcode the credentials in the application code.

Answer

Store credentials in Elastic Beanstalk environment properties.

Answer

Store credentials in an Amazon S3 bucket with public read access.

Question 10

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a build stage that compiles the website and a deploy stage that syncs the build output to an S3 bucket. After a recent change, the pipeline succeeds but the website does not show the updated content. What is the most likely cause?

Accepted Answer

Amazon CloudFront is caching the old content and needs an invalidation.. Option B is correct because S3 static websites often use CloudFront for caching; an invalidation is needed after updates. Option A is wrong because if the bucket policy blocked uploads, the deploy stage would fail. Option C is wrong because if the build output was empty, the deploy would still sync (maybe nothing changes). Option D is wrong because CodePipeline would have failed if the deploy action failed.

Answer

The build output is empty because the build failed silently.

Answer

The deploy action is configured to skip if the source content has not changed.

Answer

The S3 bucket policy does not allow public read access.

Question 11

A developer is deploying a containerized application on Amazon ECS with Fargate. The application needs to read configuration data from AWS Systems Manager Parameter Store. The developer wants to ensure that the ECS task definition can access the parameter without hardcoding the value. What should the developer do?

Accepted Answer

Use the 'secrets' field in the task definition to reference the parameter ARN.. Option B is correct because ECS supports injecting parameters from Parameter Store as environment variables by referencing the parameter ARN with the 'valueFrom' field. Option A is wrong because secrets are not stored in ECR. Option C is wrong because there is no 'parameters' section in task definition. Option D is wrong because the task definition does not have a 'configs' section.

Answer

Store the configuration in Amazon ECR as a label and reference it in the task definition.

Answer

Use the 'configs' section in the task definition to load from Parameter Store.

Answer

Add a 'parameters' section in the task definition to load from Parameter Store.

Question 12

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'The overall deployment failed because the deployment group did not have enough instances to successfully deploy.' What is the most likely cause?

Accepted Answer

The deployment group contains zero instances.. Option A is correct because the deployment group must have at least one instance. Option B is wrong because CodeDeploy agent issues cause instance-level failures. Option C is wrong because action failures cause different errors. Option D is wrong because revision errors cause different errors.

Answer

The revision has an incorrect file format.

Answer

The CodeDeploy agent on the instance is not running.

Answer

The appspec file contains an invalid lifecycle hook.

Question 13

A company uses AWS CloudFormation to manage infrastructure. The development team wants to make a change to a stack that involves replacing a critical resource. The team wants to minimize downtime and ensure that the replacement is successful before removing the old resource. Which CloudFormation feature should the team use?

Accepted Answer

Use a CreationPolicy on the resource to ensure it is fully created before the old one is deleted.. Option D is correct because CloudFormation stack updates with replacement use the 'create before destroy' policy when the resource has a 'DeletionPolicy' of 'Retain' or when using a custom resource with a 'CreationPolicy'. However, the best way is to use a 'CreationPolicy' on the resource to ensure it is fully created before the old is destroyed. Option A is wrong because change sets are for preview, not ordering. Option B is wrong because it is not a CloudFormation feature. Option C is wrong because nested stacks do not control replacement order.

Answer

Use AWS CodeDeploy blue/green deployment.

Answer

Use a change set to review the changes before executing.

Answer

Use nested stacks to isolate the resource.

Question 14

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

Accepted Answer

The native library is compiled for a different operating system than Lambda (Amazon Linux).. Option C is correct because Lambda runs on Amazon Linux, and native libraries must be compiled for that platform. The local development environment may be a different OS. Option A is wrong because the IAM role does not affect module imports. Option B is wrong because a timeout would cause a different error. Option D is wrong because the handler name is correct locally.

Answer

The Lambda function's IAM role does not have permission to access the library.

Answer

The Lambda function's handler configuration is incorrect.

Answer

The Lambda function's timeout is too short.

Question 15

A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Option A and Option C are correct. AWS Secrets Manager and AWS Systems Manager Parameter Store are both secure services for storing secrets. Option B is wrong because environment variables can be exposed. Option D is wrong because hardcoding is insecure. Option E is wrong because storing in S3 without encryption is insecure.

Answer

Store credentials in an Amazon S3 bucket with server-side encryption.

Answer

Hardcode credentials in the application configuration file.

Answer

Store credentials as environment variables in the Elastic Beanstalk environment.

DVA-C02 Deployment Practice Test 22 — 15 Questions

Exhibit

DVA-C02 Deployment Practice Test 22 — 15 Questions

Exhibit