DVA-C02 Deployment Practice Test 25 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment is successful, but the application health checks fail. The application runs on a single EC2 instance. What should a developer do to troubleshoot this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

View the application logs in the Elastic Beanstalk console.. Viewing the application logs in the Elastic Beanstalk console helps identify why the application is not responding to health checks. Logs can reveal application errors, missing dependencies, or configuration issues. Option D is wrong because SSH may not be configured for the instance, and restarting the web server without understanding the root cause may not resolve the issue. Option B is incorrect because modifying the CloudFormation template to increase instance size does not address health check failures. Option C is incorrect because adding an Application Load Balancer does not fix underlying application problems.

Answer

Modify the CloudFormation template to increase instance size.

Answer

Add an Application Load Balancer to the environment.

Answer

SSH into the EC2 instance and restart the web server.

Question 2

Refer to the exhibit. A developer tried to create a CloudFormation stack that includes an EC2 instance. The stack creation failed and rolled back. What should the developer do to get more details about the failure?

Accepted Answer

Run `aws cloudformation describe-stack-events` for the stack.. When a CloudFormation stack fails and rolls back, the authoritative source of failure details is the stack events log. Running aws cloudformation describe-stack-events returns the ordered event stream, including the specific resource that failed and the status reason containing the underlying error message.

Answer

Review the CloudFormation template syntax.

Answer

Use the `detect-stack-drift` command.

Answer

Update the stack with the same template to see the error.

Question 3

A developer wants to deploy a static website to AWS. The website content is stored in an S3 bucket. Which combination of actions is required to host the website? (Choose TWO.)

Accepted Answer

Enable static website hosting on the S3 bucket.. To host a static website on S3, you must enable static website hosting on the bucket (option B) and make the objects publicly readable (option E). Option A (server access logging) is optional for tracking requests, not required. Option C (restricting access to a specific IP) would prevent public access, which is needed for a public website. Option D (CloudFront) is an optional CDN service, not a requirement for S3 static website hosting.

Answer

Enable server access logging.

Answer

Set a bucket policy that restricts access to a specific IP.

Answer

Configure Amazon CloudFront as a CDN.

Question 4

Which TWO actions should a developer take to ensure that an AWS CodeDeploy deployment is successful when deploying to an Auto Scaling group? (Choose TWO.)

Accepted Answer

Create an IAM service role that allows CodeDeploy to access the instances.. Option A is correct because CodeDeploy requires an IAM service role (the CodeDeploy service role) that grants it permissions to perform actions on the developer's behalf, such as reading tags, accessing S3 revision bundles, and calling EC2 Auto Scaling APIs to manage instances during deployment. Option E is correct because the CodeDeploy agent must be installed and running on each EC2 instance in the Auto Scaling group so the instance can poll CodeDeploy, receive the revision, and execute the deployment lifecycle event hooks (ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService). Option B is not required because an Application Load Balancer is only needed for load-balanced or blue/green scenarios, not for a basic in-place deployment to an Auto Scaling group. Option C is incorrect because Application Discovery Service is used for migration planning and discovery, not for CodeDeploy deployments. Option D is not required because CodeDeploy supports in-place deployments to Auto Scaling groups, so blue/green is optional rather than mandatory.

Answer

Attach an Application Load Balancer to the Auto Scaling group.

Answer

Enable the Application Discovery Service for the instances.

Answer

Configure the deployment to use a blue/green deployment type.

Question 5

A developer is deploying a serverless application using AWS SAM. The application includes multiple Lambda functions and an API Gateway. Which THREE AWS CLI commands are part of the typical SAM deployment workflow? (Choose THREE.)

Accepted Answer

sam deploy. `sam deploy` is the AWS SAM CLI command that deploys the packaged application to AWS, creating or updating the CloudFormation stack with the Lambda functions and API Gateway resources. It reads the `template.yaml` and the packaged artifacts (from `sam package`) to provision the infrastructure. This command is the final step in the standard SAM deployment workflow.

Answer

sam init

Answer

aws s3 cp

Question 6

A team uses AWS CodeCommit for source control and wants to automatically trigger a build and deployment when code is pushed to the master branch. Which AWS service should be used to create this automation?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that can be configured to automatically start a pipeline execution when a change is pushed to a specific branch in AWS CodeCommit. By setting the source stage to the CodeCommit repository and master branch, CodePipeline triggers subsequent build and deploy actions without manual intervention, enabling a complete CI/CD workflow.

Answer

AWS CodeBuild

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 7

A company wants to deploy an application using AWS Elastic Beanstalk. The application requires a relational database. What is the BEST practice for managing the database?

Accepted Answer

Create an Amazon RDS database instance separately and configure the application to connect to it.. The best practice for managing a relational database in Elastic Beanstalk is to decouple the database from the application lifecycle by creating an Amazon RDS instance separately. This ensures the database is not deleted when the Elastic Beanstalk environment is terminated, provides better control over backups, scaling, and maintenance, and allows the application to connect via environment variables or configuration files. Using a separate RDS instance aligns with production best practices for durability and operational flexibility.

Answer

Use the Elastic Beanstalk console to add an RDS database to the environment.

Answer

Use an S3 bucket to store data.

Answer

Use Amazon DynamoDB as the database.

Question 8

A developer is deploying a Lambda function that processes images uploaded to an S3 bucket. The function is triggered by S3 events. After deployment, the function does not execute when new images are uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured for the Lambda function.. The most likely cause is that the S3 bucket does not have an event notification configured to invoke the Lambda function. S3 event notifications must be explicitly set on the bucket to trigger a Lambda function when objects are created; without this configuration, S3 will not send any invocation request to Lambda, regardless of the function's permissions or settings.

Answer

The Lambda function memory is set too low.

Answer

The Lambda function does not have permission to read from the S3 bucket.

Answer

The Lambda function is not in the same region as the S3 bucket.

Question 9

A company has a production environment running on AWS. The environment includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is deployed using AWS CodeDeploy with a blue/green deployment strategy. Recently, the deployment started failing because the new instances do not pass the health checks configured on the ALB. The health check path is '/health'. The developer has verified that the application starts correctly and responds to the health check on the new instances when accessed directly via the instance's private IP. However, the health checks from the ALB are failing. The security group for the ALB allows inbound traffic on port 80 from 0.0.0.0/0, and the security group for the EC2 instances allows inbound traffic on port 80 from the ALB's security group. The VPC has both public and private subnets. The Auto Scaling group launches instances in private subnets. The ALB is in public subnets. What is the MOST likely cause of the health check failure?

Accepted Answer

The network ACL on the private subnets is blocking inbound traffic from the ALB's subnets.. The correct answer is D: the network ACL on the private subnets is blocking inbound traffic from the ALB's subnets. Network ACLs are stateless and operate at the subnet level, so even though the EC2 security group allows port 80 from the ALB's security group, a NACL rule denying inbound traffic from the ALB's public subnet CIDR would silently drop the ALB health check packets before they reach the instances. This matches the symptom that the app responds on its private IP directly but ALB health checks to '/health' fail. Option A is wrong because the developer confirmed the application starts and responds on port 80 directly. Option B is wrong because the path '/health' was verified as working on the instances. Option C is wrong because an ALB can only target instances in the same VPC (or peered VPCs), and the scenario implies they are in the same VPC.

Answer

The application is not listening on port 80 on the new instances.

Answer

The health check path is configured incorrectly in the ALB target group.

Answer

The ALB is not in the same VPC as the instances.

Question 10

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application needs to read environment-specific configuration variables. Which configuration file should the developer use to define these variables within the Elastic Beanstalk environment?

Accepted Answer

.ebextensions/*.config. Ebextensions/*.config files in YAML or JSON format are used to define environment-specific configuration, including environment variables, in Elastic Beanstalk. Option A is wrong because package.json is for Node.js dependencies and cannot set environment variables. Option C is wrong because Dockerfile is for Docker containers, not Elastic Beanstalk configuration. Option D is wrong because buildspec.yml is used by AWS CodeBuild, not Elastic Beanstalk.

Answer

package.json

Answer

Dockerfile

Answer

buildspec.yml

Question 11

A company is migrating a monolithic application to microservices on AWS. They want to use a blue/green deployment strategy for a new version of a service running on Amazon ECS with Fargate. The service is behind an Application Load Balancer. Which combination of actions should be taken to implement blue/green deployment with minimal downtime? (Choose the correct answer.)

Accepted Answer

Use AWS CodeDeploy to orchestrate a blue/green deployment by creating a new task set and shifting traffic.. AWS CodeDeploy supports blue/green deployments on Amazon ECS with Fargate. It creates a new task set and gradually shifts traffic from the existing (blue) task set to the new (green) task set, minimizing downtime. Option A is incorrect because managing a second ALB and updating DNS is more complex and not the typical approach for ECS blue/green; AWS CodeDeploy automates this. Option C is incorrect because a rolling update updates the existing service in place, which may cause downtime or require careful orchestration; it is not a blue/green deployment. Option D is incorrect because manually creating a new target group and modifying the ALB listener rule is error-prone and does not provide automated traffic shifting or rollback capabilities.

Answer

Create a second ALB pointing to the new service, then update DNS to switch traffic.

Answer

Update the existing ECS service with the new task definition and allow rolling update.

Answer

Manually create a new target group with the new service and update the ALB listener rule.

Question 12

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with user data. The user data script installs software and configures the application. The developer wants to ensure that the stack creation waits for the user data script to complete before marking the stack as CREATE_COMPLETE. What should the developer do?

Accepted Answer

Add a CreationPolicy with a timeout to the EC2 instance resource and use cfn-signal in the user data.. The correct approach is to add a CreationPolicy to the EC2 instance resource and use cfn-signal in the user data script. The CreationPolicy tells CloudFormation to wait for a signal from the instance before considering the resource created. The user data script runs, installs software, and then calls cfn-signal to indicate success. If the signal is not received within the timeout, the stack creation fails. Option A (DependsOn) only orders resource creation, not waits for user data. Option B (WaitCondition) is a legacy method that is more complex; CreationPolicy is the recommended modern approach. Option D (running as a service) does not send any signal to CloudFormation.

Answer

Add a DependsOn attribute to the EC2 instance resource.

Answer

Use a CloudFormation WaitCondition and a WaitConditionHandle.

Answer

Configure the EC2 instance to run the user data script as a service.

Question 13

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway endpoint and an AWS Lambda function. The developer wants to define a stage name for the API Gateway deployment. Which section of the SAM template should the developer use?

Accepted Answer

Globals. The `Globals` section in an AWS SAM template allows you to define shared configuration settings that apply to all resources in the template. For API Gateway, you can set properties like `StageName` under `Globals.Api`, which will be inherited by all API Gateway resources defined in the template, ensuring consistent stage naming without repeating the configuration.

Answer

Conditions

Answer

Outputs

Answer

Parameters

Question 14

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Accepted Answer

View the stack events in the CloudFormation console.. Option A is correct because CloudFormation records every resource-level status transition (CREATE_IN_PROGRESS, CREATE_FAILED, etc.) as a stack event, and the event for the failed resource includes the exact StatusReason returned by the underlying service, which is the fastest way to pinpoint the root cause. Option D is correct because a resource creation failure is frequently caused by an invalid template definition — for example a bad property value, an incorrect intrinsic function reference, or a missing required parameter — so reviewing the template for logical errors validates the resource configuration against the service's requirements. Option B is not appropriate because stack outputs are only populated after resources are successfully created and are not generated for a failed stack, so they contain no troubleshooting data. Option C is not appropriate because deleting and recreating with identical parameters reproduces the same failure without gathering any diagnostic information. Option E is not appropriate because CloudTrail logs API calls made to AWS services (such as CreateStack), not the internal per-resource failure reasons that CloudFormation surfaces in stack events.

Answer

Check the stack outputs.

Answer

Delete the stack and recreate it with the same parameters.

Answer

Check AWS CloudTrail logs for the stack creation attempt.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment is successful, but the application health checks fail. The application runs on a single EC2 instance. What should a developer do to troubleshoot this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Secrets Manager.. Option B is correct because AWS Secrets Manager is purpose-built to store and retrieve secrets such as database connection strings, supporting encryption at rest with KMS and fine-grained access via IAM, so the application can fetch the string at runtime instead of hard-coding it. Option C is correct because Elastic Beanstalk environment properties are injected into the application as environment variables (for example, RDS_HOSTNAME, RDS_USERNAME, RDS_PASSWORD that Beanstalk itself sets for attached RDS instances), letting the code read the connection string from the environment rather than embedding it. Option E is correct because AWS Systems Manager Parameter Store can hold the connection string as a SecureString parameter encrypted with KMS, and the application can retrieve it via the SSM API or the EC2/Beanstalk instance role. Option A is not appropriate because RDS tags are metadata for resource organization, cost allocation, and access control, not a secure mechanism for delivering secrets to an application. Option D is not appropriate because a configuration file inside the application bundle is still effectively hard-coded and travels with the source artifact, so it does not securely externalize the connection string.

Answer

Read the connection string from Amazon RDS tags.

Answer

Store the connection string in a configuration file in the application bundle.