DVA-C02 Deployment Practice Test 24 — 15 Questions

Question 1

Which THREE steps should a developer include in a CI/CD pipeline to deploy a serverless application using AWS SAM? (Choose three.)

Accepted Answer

Run 'sam build' to prepare the application. In a typical SAM CI/CD pipeline, the three essential steps are: (A) running 'sam build' to prepare the application, (E) running 'sam package' to upload the build artifacts to an S3 bucket, and (C) running 'sam deploy' to create or update the CloudFormation stack. Option B is incorrect because manually configuring API Gateway stages is not a standard automated step in a CI/CD pipeline; SAM manages API Gateway configurations as part of the deployment. Option D is incorrect because 'aws lambda update-alias' is not a typical step in a SAM deployment; traffic shifting can be handled via SAM's deployment preferences.

Answer

Manually configure API Gateway stages

Answer

Run 'aws lambda update-alias' to shift traffic

Question 2

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint and a Lambda function. The developer wants to ensure that the Lambda function can be invoked only by the API Gateway and not directly. Which configuration should be used?

Accepted Answer

Add a resource-based policy with 'aws:SourceArn' condition set to the API Gateway ARN.. Adding a resource-based policy with an `aws:SourceArn` condition set to the API Gateway ARN ensures that the Lambda function can only be invoked by that specific API Gateway. This uses the AWS Identity and Access Management (IAM) condition key to restrict the `lambda:InvokeFunction` action based on the ARN of the invoking resource, preventing direct invocation from other sources like the AWS CLI or SDK.

Answer

Configure a VPC endpoint policy that allows only API Gateway.

Answer

Add a resource-based policy with 'aws:SourceAccount' condition.

Answer

Add a resource-based policy with 'aws:SourceVpce' condition set to the API Gateway VPC endpoint ID.

Question 3

A company is implementing a CI/CD pipeline using AWS CodeCommit, CodeBuild, and CodeDeploy. The developer wants to ensure that the pipeline automatically deploys to production only after a manual approval step. Which TWO actions should the developer take?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline.. Both Option B and Option C are correct. In AWS CodePipeline, a manual approval action pauses the pipeline until the specified approver(s) approve or reject the change. To implement this, you add a manual approval action in the pipeline (Option B) and then configure that action to require a specific IAM user or group to approve (Option C). This ensures that only authorized personnel can approve the production deployment. Option A is incorrect because CloudWatch Events and Lambda can automate pipeline execution but do not provide a built-in manual approval mechanism. Option D is incorrect because CodeDeploy lifecycle hooks can pause the deployment process within the deployment group, but the requirement is a pipeline-level manual approval step, which is a native feature of CodePipeline. Option E is incorrect because SNS is used for notifications; while you can notify approvers via SNS, the approval action itself is configured within CodePipeline, not through SNS.

Answer

Create a CloudWatch Events rule to trigger a Lambda function that waits for approval.

Answer

Use a CodeDeploy lifecycle hook to pause the deployment.

Answer

Configure an SNS topic to send an email to the approver.

Question 4

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is set to use a 'OneAtATime' deployment configuration. The developer wants to ensure that the deployment does not cause downtime. Which TWO configurations are necessary?

Accepted Answer

Configure a load balancer for the Auto Scaling group.. Registering the Auto Scaling group with a load balancer allows CodeDeploy to deregister each instance before deployment and re-register it after the new application version is installed and passes health checks. This ensures traffic is shifted away from the instance being updated, preventing downtime during a 'OneAtATime' deployment.

Answer

Set the 'IgnoreApplicationStopFailures' flag to true.

Answer

Use an 'AllAtOnce' deployment configuration.

Answer

Install the CodeDeploy agent on each instance.

Question 5

A development team is using AWS Elastic Beanstalk to deploy a web application. The team wants to perform a blue/green deployment. Which THREE steps are required to complete the blue/green deployment?

Accepted Answer

Swap the CNAMEs of the two environments.. In a blue/green deployment with Elastic Beanstalk, you first deploy the new application version to a separate environment (E). Then, you swap the CNAMEs of the two environments to route traffic to the new environment (B). After verifying the new environment works correctly, you terminate the old environment (C). Option A is incorrect because you do not update the existing environment; you create a new one. Option D is incorrect because you swap CNAMEs, not manually update Route 53 DNS records.

Answer

Update the existing environment with the new version.

Answer

Update the Route 53 DNS record to point to the new environment.

Question 6

A developer needs to deploy a serverless application using AWS CloudFormation. The application includes an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. The developer wants to create a stack that can be updated without downtime. Which CloudFormation feature should be used?

Accepted Answer

Change Sets. Change Sets allow you to preview how changes to your CloudFormation stack will affect your running resources before you apply them. By reviewing the change set, you can ensure that the update does not cause downtime, for example by replacing resources without interruptions. This makes Change Sets the appropriate feature for updating a stack without downtime.

Answer

Drift detection

Answer

StackSets

Answer

Nested stacks

Question 7

A company uses AWS CloudFormation to manage its infrastructure. The developer wants to update a stack but only if the update does not cause any resource replacement. Which CloudFormation stack update option should be used?

Accepted Answer

Create a change set and review the changes before executing it.. A change set allows you to preview the changes that CloudFormation will make to your stack, including whether any resources will be replaced. By reviewing the change set, you can see if any resource replacement is listed and choose not to execute it if you want to avoid replacements. This gives you full control to update the stack only when no replacements are required.

Answer

Use the direct update option with a template.

Answer

Use the 'Force rollback' option to ensure no replacement.

Answer

Use the 'Preserve stack settings' option when updating the stack.

Question 8

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to read configuration data from an Amazon S3 bucket. How should the developer securely provide the S3 bucket name to the container at runtime?

Accepted Answer

Define an environment variable in the ECS task definition with the bucket name.. Defining an environment variable in the ECS task definition is the simplest and most secure way to inject the S3 bucket name into the container at runtime. Environment variables are passed to the container when it starts, and they can be stored in the task definition itself or referenced from AWS Secrets Manager or Systems Manager Parameter Store for sensitive values. This approach avoids hardcoding and keeps the configuration decoupled from the application code.

Answer

Hardcode the bucket name in the application code.

Answer

Use AWS Systems Manager Parameter Store and retrieve the bucket name at startup.

Answer

Store the bucket name in the container image's environment file.

Question 9

A developer uses AWS SAM (Serverless Application Model) to define a serverless application. The developer wants to run the application locally for testing. Which AWS SAM CLI command should be used?

Accepted Answer

sam local start-api. `sam local start-api` starts a local HTTP server that emulates the API Gateway endpoint and invokes your Lambda functions defined in the SAM template. This allows you to test API requests and responses locally without deploying to AWS, making it the appropriate command for local testing of a serverless application.

Answer

sam build

Answer

sam deploy

Answer

sam package

Question 10

A company is deploying a new web application on Amazon EC2 instances behind an Application Load Balancer. The application must be deployed with no downtime. The deployment uses AWS CodeDeploy with a Blue/Green deployment configuration. Which TWO actions should be taken to achieve zero-downtime deployment? (Choose TWO.)

Accepted Answer

Create a new Auto Scaling group with the new application version and register it with the ALB.. In a Blue/Green deployment, you create a new Auto Scaling group with the new application version and register it with the existing ALB. Option E is correct because after the new environment is ready, you gradually shift traffic from the old environment to the new environment using the ALB to ensure zero downtime. Option A is incorrect because you should reuse the existing ALB to avoid re-creating DNS and other configurations. Option C is incorrect because updating the existing Auto Scaling group in-place would cause downtime (rolling update) rather than a true Blue/Green deployment. Option D is incorrect because terminating old instances immediately could cause downtime if the new environment fails; you should allow rollback by keeping old instances until traffic is fully shifted.

Answer

Create a new load balancer for the new environment.

Answer

Update the existing Auto Scaling group with the new application version.

Answer

Terminate the old EC2 instances immediately after deploying the new ones.

Question 11

A developer is deploying an application using AWS Elastic Beanstalk. The developer wants to ensure that the application is highly available and can recover from an AZ failure. Which TWO configurations should be applied? (Choose TWO.)

Accepted Answer

Configure the environment to use multiple Availability Zones.. Options A and D are correct. A: Deploying to multiple Availability Zones ensures that if one AZ fails, the application remains available. D: An Elastic Load Balancer distributes traffic across instances in multiple AZs, improving fault tolerance. Option B is incorrect because selecting a larger EC2 instance type increases compute capacity but does not provide AZ redundancy. Option C is incorrect because enabling Multi-AZ for an RDS database improves database availability, but the question asks about application-level high availability; it does not address the compute tier. Option E is incorrect because using a single EC2 instance creates a single point of failure and does not ensure high availability.

Answer

Select a larger EC2 instance type.

Answer

Enable Multi-AZ for the application's Amazon RDS database.

Answer

Use a single EC2 instance for simplicity.

Question 12

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The build stage runs successfully, but the deploy stage fails with an error: 'The deployment failed because no instances were found for the environment.' What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment has no running instances due to a failed health check.. The error 'no instances were found for the environment' directly indicates that the Elastic Beanstalk environment has no running EC2 instances. This typically occurs when the environment's health checks have failed, causing all instances to be terminated or remain in a degraded state. Without any healthy instances, CodePipeline cannot deploy the application, as Elastic Beanstalk requires at least one running instance to perform a deployment.

Answer

The CodeDeploy application is not configured correctly.

Answer

The IAM role for CodePipeline lacks permissions to describe EC2 instances.

Answer

The build artifact is not named correctly for Elastic Beanstalk.

Question 13

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS with Fargate. The pipeline has a deploy stage that uses Amazon ECS Blue/Green deployment. The deployment fails intermittently with a 'Task failed to start' error. The developer needs to troubleshoot the issue. Which THREE steps should the developer take? (Choose three.)

Accepted Answer

Check the Amazon ECS service events for the task failure reason.. Options B, C, and E are correct. Checking Amazon ECS service events (B) provides the task failure reason directly from the ECS service. Validating the task definition JSON (C) ensures correct container image references and configuration. Verifying the task execution IAM role (E) ensures it has permissions to pull the container image from ECR. Option A (CodeBuild logs) is incorrect because the failure occurs during deployment, not build. Option D (CloudFormation stack events) is incorrect because the ECS service may not be created via CloudFormation or events there are not relevant for task failures.

Answer

Review the CodeBuild build logs for errors.

Answer

Check the CloudFormation stack events for the ECS service.

Question 14

A developer is setting up a CI/CD pipeline for a Python application using AWS CodeCommit, CodeBuild, and CodeDeploy. The developer wants to trigger the pipeline automatically when code is pushed to the master branch. Which TWO actions are required? (Choose two.)

Accepted Answer

Set the source stage in the pipeline to use AWS CodeCommit as the source provider.. Options B and D are correct because B is necessary: the pipeline source stage must use AWS CodeCommit as the provider to detect pushes to the repository. D is also required: a webhook configured in CodeCommit sends push events to the pipeline, triggering it automatically. Option A is incorrect because CodeDeploy is a deployment stage, not a trigger. Option C is incorrect because a scheduled CloudWatch Events rule would trigger the pipeline on a schedule, not on code pushes. Option E is incorrect because CloudTrail logs API calls but does not trigger pipelines.

Answer

Configure CodeDeploy to run after the build stage.

Answer

Create a CloudWatch Events rule to trigger the pipeline on a schedule.

Answer

Enable AWS CloudTrail to log API calls.

Question 15

A developer is deploying an application using AWS Elastic Beanstalk. The application needs to connect to an Amazon RDS database. What is the best practice for storing database credentials?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. AWS Secrets Manager provides a secure, auditable service for rotating and managing database credentials. By retrieving secrets at runtime via the AWS SDK, the application avoids embedding sensitive data in code or configuration, which is a key security best practice for Elastic Beanstalk deployments.

Answer

Hardcode the credentials in the application code.

Answer

Store credentials in Elastic Beanstalk environment properties.

Answer

Store credentials in an Amazon S3 bucket with public read access.