DVA-C02 Deployment Practice Test 23 — 15 Questions

Question 1

A developer is using AWS CodePipeline to automate the deployment of a microservices application. The pipeline consists of a source stage (GitHub), a build stage (AWS CodeBuild), and a deploy stage (Amazon ECS). The developer wants to ensure that only approved changes are deployed to production. Which THREE actions should the developer take? (Choose THREE.)

Accepted Answer

Add a manual approval step before the deploy stage.. Options A, B, and D are correct. Manual approval gates, separate pipelines, and integration testing are best practices. Option C is wrong because automatic deployment bypasses approval. Option E is wrong because deploying all branches to production is risky.

Answer

Configure the pipeline to automatically deploy every commit to production.

Answer

Deploy all feature branches directly to production.

Question 2

A company is deploying a critical application using AWS CloudFormation. The stack contains a resource that, if deleted accidentally, would cause data loss. The company wants to protect this resource from being deleted during stack updates or deletions. Which THREE strategies can achieve this? (Choose THREE.)

Accepted Answer

Enable termination protection on the CloudFormation stack.. Options A, C, and D are correct. DeletionPolicy Retain, TerminationProtection, and StackPolicy can prevent deletion. Option B is wrong because it does not prevent deletion. Option E is wrong because NestedStacks do not protect individual resources.

Answer

Wrap the resource in a nested stack.

Answer

Set the UpdateReplacePolicy attribute to 'Retain' on the resource.

Question 3

Refer to the exhibit. A CloudFormation stack update resulted in a rollback. What is the most likely reason for the rollback?

Accepted Answer

A user manually cancelled the update of the Lambda function.. Option D is correct because the event shows that the Lambda function update failed with reason 'Resource update cancelled by user'. This indicates that someone cancelled the update. Option A is wrong because there is no permission error shown. Option B is wrong because the error is not about timeout. Option C is wrong because the error is explicit.

Answer

The Lambda function update timed out.

Answer

The Lambda function's IAM role did not have sufficient permissions.

Answer

The Lambda function code was invalid.

Question 4

Refer to the exhibit. A developer has the above IAM policy attached. The developer is trying to push code to a CodeCommit repository and trigger a CodePipeline. The push succeeds but the pipeline does not start. What is the most likely reason?

Accepted Answer

The CloudWatch Events rule that triggers the pipeline on code push does not have the necessary IAM role to invoke the pipeline.. Option C is correct because the pipeline requires a CloudWatch Events rule to start on code push, and that rule needs permissions to invoke the pipeline. Option A is wrong because the policy allows GitPush. Option B is wrong because the developer has StartPipelineExecution permission. Option D is wrong because the developer can push.

Answer

The developer does not have permissions to push to the repository.

Answer

The developer does not have permissions to start the pipeline.

Answer

The CodeCommit repository does not have a trigger configured.

Question 5

Refer to the exhibit. A developer deploys this CloudFormation template. After deployment, the S3 bucket is created but the developer notices that the lifecycle rule does not appear in the bucket's management console. What is the most likely cause?

Accepted Answer

The lifecycle rule is missing the 'Prefix' property, causing it to be invalid.. Option B is correct because lifecycle rules require the prefix to be specified; if omitted, the rule applies to the entire bucket but may not show in the console due to a display issue. However, the rule should be active. Option A is wrong because VersioningConfiguration is correct. Option C is wrong because the rule does not require a prefix. Option D is wrong because bucket name is unique.

Answer

The lifecycle rule must have a 'Transitions' property.

Answer

The VersioningConfiguration is incorrectly specified.

Answer

The bucket name contains an account ID, which is not allowed.

Question 6

A development team needs to deploy a containerized web application on AWS. The deployment must be automated, scalable, and minimize manual intervention. Which AWS service should the team use to orchestrate the deployment of containers across a cluster of Amazon EC2 instances?

Accepted Answer

Amazon ECS. Option C is correct because Amazon ECS is a fully managed container orchestration service that integrates with EC2 to run containers. Option A is wrong because S3 is object storage. Option B is wrong because Lambda is for serverless functions. Option D is wrong because CloudFormation is for infrastructure as code.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

Amazon S3

Question 7

A company uses AWS CodePipeline to deploy a web application. The deployment fails intermittently during the 'Deploy' stage. The pipeline includes a step that runs a shell script on an EC2 instance. The pipeline uses a CodeBuild project for the build stage. What is the MOST likely cause of the intermittent failure?

Accepted Answer

The EC2 instance used for deployment does not have the CodeDeploy agent installed.. Option B is correct because if the EC2 instance is terminated or replaced, the CodeDeploy agent may not be installed, causing intermittent failures. Option A is wrong because CodeBuild uses temporary instances. Option C is wrong because CodePipeline does not require a VPC. Option D is wrong because IAM roles are not updated automatically.

Answer

The CodeBuild project is using an outdated build image.

Answer

The pipeline is not configured to use a VPC.

Answer

The IAM role for CodePipeline does not have permissions to deploy.

Question 8

Refer to the exhibit. An IAM policy is attached to a user who needs to deploy a serverless application. The user reports that they cannot upload a new version of a Lambda function using the AWS CLI. What is the MOST likely reason?

Accepted Answer

The policy does not include lambda:UpdateFunctionCode.. The error occurs because the IAM policy attached to the user does not include the `lambda:UpdateFunctionCode` permission, which is required to upload a new version of a Lambda function via the AWS CLI. Without this action, the `update-function-code` command fails, even if other Lambda permissions like `lambda:InvokeFunction` are present. The policy must explicitly allow `lambda:UpdateFunctionCode` to enable code updates.

Answer

The Lambda invoke permission is scoped to a specific function.

Answer

The user does not have permission to write to the S3 bucket.

Answer

The user is not in the same AWS region as the Lambda function.

Question 9

An organization wants to deploy a microservices architecture using AWS Lambda functions. They need to manage environment variables for each function across different stages (dev, test, prod). Which approach is the MOST secure and maintainable?

Accepted Answer

Use AWS Systems Manager Parameter Store with separate paths for each stage.. Option C is correct because AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data. Option A is wrong because hardcoding is insecure. Option B is wrong because environment variables in the function code are not environment-specific. Option D is wrong because CloudFormation parameters are for infrastructure, not runtime config.

Answer

Use AWS CloudFormation parameters to pass values at deployment.

Answer

Hardcode the environment variables in each Lambda function code.

Answer

Store environment variables in the Lambda function configuration.

Question 10

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment is successful, but the application health checks fail. The application runs on a single EC2 instance. What should a developer do to troubleshoot this issue?

Accepted Answer

View the application logs in the Elastic Beanstalk console.. Option D is correct because viewing the logs in the Elastic Beanstalk console helps identify why the application is not responding to health checks. Option A is wrong because SSH access may not be configured. Option B is wrong because CloudFormation is not directly related. Option C is wrong because the environment may not be load-balanced.

Answer

Modify the CloudFormation template to increase instance size.

Answer

Add an Application Load Balancer to the environment.

Answer

SSH into the EC2 instance and restart the web server.

Question 11

Refer to the exhibit. A developer tried to create a CloudFormation stack that includes an EC2 instance. The stack creation failed and rolled back. What should the developer do to get more details about the failure?

Accepted Answer

Run `aws cloudformation describe-stack-events` for the stack.. Option B is correct because the `describe-stack-events` command shows detailed events including resource status reasons. Option A is wrong because the template itself is not the issue. Option C is wrong because the stack has rolled back. Option D is wrong because there is no drift on a failed creation.

Answer

Review the CloudFormation template syntax.

Answer

Use the `detect-stack-drift` command.

Answer

Update the stack with the same template to see the error.

Question 12

A developer wants to deploy a static website to AWS. The website content is stored in an S3 bucket. Which combination of actions is required to host the website? (Choose TWO.)

Accepted Answer

Enable static website hosting on the S3 bucket.. Option A and D are correct because enabling static website hosting and making objects publicly readable are required. Option B is wrong because CloudFront is optional. Option C is wrong because bucket policy is not required if ACLs are used. Option E is wrong because logging is optional.

Answer

Enable server access logging.

Answer

Set a bucket policy that restricts access to a specific IP.

Answer

Configure Amazon CloudFront as a CDN.

Question 13

Which TWO actions should a developer take to ensure that an AWS CodeDeploy deployment is successful when deploying to an Auto Scaling group? (Choose TWO.)

Accepted Answer

Create an IAM service role that allows CodeDeploy to access the instances.. Option B and D are correct because the CodeDeploy agent must be installed on each instance, and the service role must have permissions to access the instances. Option A is wrong because CodeDeploy supports in-place deployments. Option C is wrong because a load balancer is optional. Option E is wrong because CodeDeploy does not require an Application Discovery Service.

Answer

Attach an Application Load Balancer to the Auto Scaling group.

Answer

Enable the Application Discovery Service for the instances.

Answer

Configure the deployment to use a blue/green deployment type.

Question 14

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. Recently, deployments have been failing because the CodeBuild project cannot download dependencies from the internet. The build environment does not have internet access due to VPC settings. Which THREE steps should a developer take to resolve this issue? (Choose THREE.)

Accepted Answer

Configure a NAT gateway in the public subnet to allow outbound internet access.. Option B, C, and D are correct because placing CodeBuild in a private subnet with VPC endpoints for S3 and using a NAT gateway allows internet access for dependencies. Option A is wrong because CodeBuild does not need public IP. Option E is wrong because CodeCommit is not the issue.

Answer

Move the source stage to use S3 instead of CodeCommit.

Answer

Assign a public IP address to the CodeBuild project.

Question 15

A developer is deploying a serverless application using AWS SAM. The application includes multiple Lambda functions and an API Gateway. Which THREE AWS CLI commands are part of the typical SAM deployment workflow? (Choose THREE.)

Accepted Answer

sam deploy. Option A is correct because `sam deploy` is the AWS SAM CLI command that deploys the packaged application to AWS, creating or updating the CloudFormation stack with the Lambda functions and API Gateway resources. It reads the `template.yaml` and the packaged artifacts (from `sam package`) to provision the infrastructure. This command is the final step in the standard SAM deployment workflow.

Answer

sam init

Answer

aws s3 cp