DVA-C02 Deployment Practice Test 23 — 15 Questions

Question 1

A company deploys a microservices application using AWS CloudFormation. Each microservice is deployed as a separate stack. The developer wants to pass the output values (e.g., API endpoint URLs) from one stack to another. Which CloudFormation feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cross-stack references using Export and ImportValue. Cross-stack references using Export and ImportValue allow you to share values between CloudFormation stacks. You export a value from one stack and import it into another, enabling loose coupling. This is the standard way to pass outputs between separate stacks.

Answer

Custom resources with Lambda

Answer

Stack outputs

Answer

Nested stacks

Question 2

A developer uses AWS SAM (Serverless Application Model) to define a serverless application. The developer wants to run the application locally for testing. Which AWS SAM CLI command should be used?

Accepted Answer

sam local start-api. `sam local start-api` starts a local HTTP server that emulates the API Gateway endpoint and invokes your Lambda functions defined in the SAM template. This allows you to test API requests and responses locally without deploying to AWS, making it the appropriate command for local testing of a serverless application.

Answer

sam build

Answer

sam deploy

Answer

sam package

Question 3

A company is deploying a new web application on Amazon EC2 instances behind an Application Load Balancer. The application must be deployed with no downtime. The deployment uses AWS CodeDeploy with a Blue/Green deployment configuration. Which TWO actions should be taken to achieve zero-downtime deployment? (Choose TWO.)

Accepted Answer

Create a new Auto Scaling group with the new application version and register it with the ALB.. Option B is correct because a CodeDeploy blue/green deployment for EC2 requires provisioning a replacement environment — a new Auto Scaling group running the new application revision — and registering it with the existing Application Load Balancer so it can serve traffic. Option E is correct because zero downtime is achieved by having the ALB gradually shift traffic from the original (blue) target group to the replacement (green) target group, using CodeDeploy's traffic-shifting controls (e.g., all-at-once, linear, or canary) before the old instances are terminated. Option A is wrong because creating a separate load balancer is unnecessary and would not provide the controlled traffic rerouting that CodeDeploy performs through the ALB's target groups. Option C is wrong because updating the existing Auto Scaling group in place is an in-place deployment, not blue/green, and would replace instances without the parallel green environment needed for zero downtime. Option D is wrong because terminating the old instances immediately removes the safety net and can cause dropped connections; the original environment must be kept until traffic has fully shifted and the deployment succeeds.

Answer

Create a new load balancer for the new environment.

Answer

Update the existing Auto Scaling group with the new application version.

Answer

Terminate the old EC2 instances immediately after deploying the new ones.

Question 4

The exhibit shows an IAM policy attached to a user who needs to deploy applications using AWS CodeDeploy. The user reports that they cannot create a deployment for the MyApplication/MyDeploymentGroup. What is the most likely reason?

Accepted Answer

The policy does not include permission on the application resource.. The IAM policy shown in the exhibit likely grants permissions on the deployment group resource (e.g., arn:aws:codedeploy:region:account:deploymentgroup:MyApplication/MyDeploymentGroup) but omits the corresponding application resource (arn:aws:codedeploy:region:account:application:MyApplication). AWS CodeDeploy requires permissions on both the application and the deployment group for operations like CreateDeployment. Without the application-level permission, the request is implicitly denied, causing the failure. Thus, the most likely reason is that the policy does not include permission on the application resource.

Answer

The policy restricts the user to a different deployment group.

Answer

The user does not have permission to call the codedeploy:CreateDeployment action.

Answer

The user does not have permission to call codedeploy:GetDeployment and codedeploy:GetDeploymentGroup.

Question 5

The exhibit shows the output of the describe-instances command. An Elastic Beanstalk environment is configured to use this EC2 instance as a web server. The application is not accessible. What is the most likely cause?

Accepted Answer

The instance has been terminated.. The instance state in the exhibit is 'terminated', meaning the instance is no longer running. This makes the application inaccessible. Option B is incorrect because the security group configuration is not indicated as an issue. Option C is incorrect because the Name tag is irrelevant to accessibility. Option D is incorrect because the instance exists but is terminated.

Answer

The security group does not allow HTTP traffic.

Answer

The instance does not have the correct Name tag.

Answer

The instance does not exist.

Question 6

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The build stage runs successfully, but the deploy stage fails with an error: 'The deployment failed because no instances were found for the environment.' What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment has no running instances due to a failed health check.. The error 'no instances were found for the environment' directly indicates that the Elastic Beanstalk environment has no running EC2 instances. This typically occurs when the environment's health checks have failed, causing all instances to be terminated or remain in a degraded state. Without any healthy instances, CodePipeline cannot deploy the application, as Elastic Beanstalk requires at least one running instance to perform a deployment.

Answer

The CodeDeploy application is not configured correctly.

Answer

The IAM role for CodePipeline lacks permissions to describe EC2 instances.

Answer

The build artifact is not named correctly for Elastic Beanstalk.

Question 7

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the 'Install' lifecycle event. The developer checks the logs and finds that the scripts in the 'appspec.yml' file are not being executed because the instances are not in a healthy state. What could be the reason for the instances being unhealthy?

Accepted Answer

The health check grace period on the Auto Scaling group is too short.. If the health check grace period is too short, instances may be marked unhealthy by the Auto Scaling group before the CodeDeploy installation scripts complete. This causes the deployment to fail during the 'Install' lifecycle event. Option B is incorrect because even if the ELB is not configured to route traffic, it would not directly cause instance health check failures during deployment; it would affect traffic routing. Option C is incorrect because an outdated CodeDeploy agent might cause script execution failures, but the logs indicate scripts are not executed because instances are unhealthy, not because of agent issues. Option D is incorrect because IAM permissions affect access to artifacts, but the error is about instance health, not access denied.

Answer

The Elastic Load Balancer is not configured to route traffic to the Auto Scaling group.

Answer

The CodeDeploy agent on the instances is outdated.

Answer

The IAM instance profile does not have permissions to access the S3 bucket where the artifacts are stored.

Question 8

A developer is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The build fails with a 'no basic auth credentials' error when trying to push the image. Which TWO actions should the developer take to resolve this issue? (Choose two.)

Accepted Answer

Add a pre-build command to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. The 'aws ecr get-login-password' command retrieves a temporary authentication token from AWS, which is then piped to 'docker login' to authenticate the Docker client with the Amazon ECR registry. This is the standard method for authenticating Docker to ECR, and it must be executed in the pre-build phase to ensure credentials are available before the 'docker push' command runs.

Answer

Install the AWS CLI in the buildspec.yml file.

Answer

Install Docker in the buildspec.yml file.

Answer

Configure SSH key-based authentication for ECR.

Question 9

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS with Fargate. The pipeline has a deploy stage that uses Amazon ECS Blue/Green deployment. The deployment fails intermittently with a 'Task failed to start' error. The developer needs to troubleshoot the issue. Which THREE steps should the developer take? (Choose three.)

Accepted Answer

Check the Amazon ECS service events for the task failure reason.. Option B is correct because Amazon ECS service events provide the most direct diagnostic messages for tasks that fail to start, including reasons such as image pull failures, resource constraints, or unhealthy load balancer targets. Option C is correct because a malformed task definition JSON or an incorrect container image reference will prevent ECS from launching the task, producing exactly the 'Task failed to start' symptom. Option E is correct because the task execution IAM role must have permissions such as ecr:GetAuthorizationToken and ecr:BatchGetImage to pull the image from ECR; missing permissions cause task startup failures. Option A is not appropriate because CodeBuild logs relate to the build stage, not the ECS deploy stage where the task fails to start. Option D is not appropriate because the pipeline uses Amazon ECS Blue/Green deployment, not a CloudFormation stack, so CloudFormation stack events would not explain the ECS task failure.

Answer

Review the CodeBuild build logs for errors.

Answer

Check the CloudFormation stack events for the ECS service.

Question 10

A developer is troubleshooting a deployment failure in AWS CodePipeline. The deploy stage uses the above IAM policy for the service role. The pipeline fails when trying to update the Elastic Beanstalk environment. What is the most likely cause?

Accepted Answer

The policy restricts the UpdateEnvironment action to a specific environment ARN, but the pipeline is updating a different environment.. The most likely cause is option A: the policy restricts the UpdateEnvironment action to a specific environment ARN, but the pipeline is updating a different environment. In Elastic Beanstalk, elasticbeanstalk:UpdateEnvironment must be allowed on the exact environment ARN being updated; if the Resource element names a different environment, the API call is denied and the deploy stage fails. Option B is not the issue because DescribeEnvironmentResources is a read-only action and is not required to perform the environment update. Option C is too broad and inaccurate, since the policy does not deny all actions on the environment. Option D is also incorrect because DeleteEnvironment is not needed to update an existing Elastic Beanstalk environment.

Answer

The policy does not allow DescribeEnvironmentResources, which is required for the deployment.

Answer

The policy denies all actions on the environment, preventing the update.

Answer

The policy denies DeleteEnvironment, which is required for the update.

Question 11

A developer is creating a deployment pipeline using AWS CodePipeline. The pipeline includes a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CloudFormation. The developer wants to ensure that the pipeline can automatically create the CloudFormation stack if it does not exist. Which action mode should the developer use in the CloudFormation deploy action?

Accepted Answer

CREATE_UPDATE. The CREATE_UPDATE action mode in AWS CodePipeline's CloudFormation deploy action creates the stack if it does not exist and updates it if it does. This is the default and most flexible mode, ensuring the pipeline can handle both initial deployment and subsequent updates without manual intervention.

Answer

UPDATE_ONLY

Answer

REPLACE_ON_FAILURE

Answer

CREATE_ONLY

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. The developer wants to perform a blue/green deployment to minimize downtime. The developer creates a new environment and deploys the new version. After verifying the new environment is healthy, the developer needs to swap the URLs so that traffic is routed to the new environment. Which AWS Elastic Beanstalk feature should the developer use?

Accepted Answer

Use the 'Swap environment URLs' feature in the Elastic Beanstalk console.. Use the 'Swap environment URLs' feature in the Elastic Beanstalk console. This feature swaps the CNAME records between two environments, allowing you to route traffic to the new, healthy environment with minimal downtime. Option B is not recommended because deleting the old environment before fully verifying the new one is risky. Option C involves Route 53 weighted routing, which is not an Elastic Beanstalk feature and requires manual DNS management outside of Elastic Beanstalk. Option D is incorrect because environment CNAMEs are managed by Elastic Beanstalk and cannot be changed manually.

Answer

Delete the old environment and update the DNS record to point to the new environment.

Answer

Use Amazon Route 53 weighted routing policies to shift traffic.

Answer

Change the environment's CNAME to point to the new environment.

Question 13

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a 'OneAtATime' deployment configuration. The developer notices that the deployment is taking a long time. What is the most likely reason?

Accepted Answer

The Auto Scaling group has a large number of instances, and deploying one at a time is slow.. The 'OneAtATime' deployment configuration deploys to one instance at a time, so if the Auto Scaling group has a large number of instances, the deployment will take a long time. Option A is incorrect because the load balancer configuration does not directly affect deployment speed when using 'OneAtATime'. Option C is incorrect because the deployment configuration is correctly set to 'OneAtATime', not 'AllAtOnce'. Option D is incorrect because if the CodeDeploy agent were not running, the deployment would likely fail entirely, not just be slow.

Answer

The deployment group is configured with an incorrect load balancer.

Answer

The deployment configuration is set to 'AllAtOnce', but the developer intended 'OneAtATime'.

Answer

The CodeDeploy agent on the instances is not running.

Question 14

A developer is trying to update a CloudFormation stack that includes a Lambda function. The stack rolls back with the error shown. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have a trust policy that allows Lambda to assume it.. The error message indicates that the IAM role cannot be assumed by Lambda. This typically means the trust policy of the execution role does not include 'lambda.amazonaws.com' as a trusted entity. Option A is incorrect because the error is about assuming the role, not about writing logs. Option B is incorrect because the error is not about the deployment package location. Option C is incorrect because the error is not about code size.

Answer

The Lambda function's execution role lacks permissions to write logs to CloudWatch.

Answer

The Lambda function's deployment package is not stored in Amazon S3.

Answer

The Lambda function's code is too large for the deployment.

Question 15

A developer is deploying a static website to Amazon S3. The developer wants to enable versioning to easily roll back to a previous version if the new deployment has issues. After enabling versioning on the bucket, the developer uploads the new files. How can the developer roll back to the previous version?

Accepted Answer

Copy the previous version of the object to the same key, making it the current version.. When S3 versioning is enabled, each object key holds a stack of versions with the latest one served by default. To roll back, you copy the desired previous version onto the same key; S3 creates a new 'current' version whose content matches the old one, so GET requests immediately serve the rolled-back content without deleting history. This is the standard, non-destructive rollback pattern.

Answer

Delete the current version of the object from the bucket.

Answer

Use the S3 console 'Restore' action on the bucket.

Answer

Enable 'Show versions' and then select the previous version to make it current.