DVA-C02 Deployment Practice Test 4 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The development team wants to ensure that the deployment does not cause any downtime and that new instances are fully registered with the load balancer before old instances are terminated. Which deployment policy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rolling with an additional batch. The Rolling with an additional batch deployment policy launches a new batch of instances in addition to the current ones, registers them with the load balancer, and only then terminates the old instances. This ensures zero downtime because the new instances are fully serving traffic before any old instances are removed, unlike standard rolling deployments which terminate old instances before new ones are fully ready.

Answer

Immutable

Answer

Rolling

Answer

All at once

Question 2

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an API Gateway endpoint backed by a Lambda function. The developer wants to enable canary deployments to shift traffic gradually. Which SAM resource attribute should they configure?

Accepted Answer

DeploymentPreference. The DeploymentPreference attribute is the SAM resource property that enables canary, linear, or all-at-once deployments for Lambda-backed APIs. It references a deployment preference type (e.g., Canary10Percent5Minutes) and an optional pre/post-traffic hook, and SAM uses AWS CodeDeploy under the hood to shift traffic gradually between the old and new Lambda versions. Without DeploymentPreference, SAM performs an all-at-once update with no gradual traffic shifting.

Answer

StageName

Answer

Events

Answer

AutoPublishAlias

Question 3

A team uses AWS CloudFormation to manage infrastructure. They want to update a stack that contains an Amazon RDS database. During the update, they need to modify the DB instance class. Which update policy should they use to minimize downtime?

Accepted Answer

SnapshotUpdate. When you modify the DBInstanceClass of an Amazon RDS instance, CloudFormation applies the change directly. For a Single-AZ DB instance, this causes a temporary outage while the instance type is changed. To minimize downtime, you should configure the DB instance as a Multi-AZ deployment. In a Multi-AZ deployment, Amazon RDS performs the modification on the standby instance first, then triggers a failover to the standby, and finally modifies the original primary instance. This reduces the downtime to the duration of the failover (typically under a minute).

Answer

AutoScalingReplacingUpdate

Answer

ReplacingUpdate

Answer

AutoScalingRollingUpdate

Question 4

Which TWO are valid ways to automate deployments to Amazon ECS? (Choose TWO.)

Accepted Answer

Use AWS CodeDeploy with an Amazon ECS blue/green deployment.. Option A is correct because AWS CodeDeploy natively supports Amazon ECS blue/green deployments, using a CodeDeploy application and deployment group to shift traffic between the original and replacement task sets via a load balancer. Option D is correct because AWS CodePipeline provides an Amazon ECS deploy action (the ECS standard deployment action) that updates an ECS service with a new task definition and image, enabling automated CI/CD pipelines. Option B is not a deployment automation mechanism specific to ECS; CloudFormation change sets update stack resources but do not perform ECS deployment orchestration such as traffic shifting or task set management. Option C is incorrect because AWS OpsWorks is a configuration management service (Chef/Puppet) and does not provide ECS deployment automation. Option E is incorrect because AWS Elastic Beanstalk with the Docker platform deploys to EC2 instances or ECS via its own environment model, not as a supported automation method for existing ECS services.

Answer

Use AWS CloudFormation to create a change set and update the service.

Answer

Use AWS OpsWorks with a Docker layer.

Answer

Use AWS Elastic Beanstalk with a Docker platform.

Question 5

Refer to the exhibit. A developer ran the AWS CLI command and received the output shown. What is the most likely cause of the UPDATE_FAILED status?

Accepted Answer

The CloudFormation template specified an unsupported runtime for the Lambda function.. The UPDATE_FAILED status is most likely caused by the CloudFormation template specifying an unsupported runtime for the Lambda function, as indicated by option C. CloudFormation validates the Runtime property against the list of runtimes supported by AWS Lambda, and if an invalid or deprecated runtime identifier (e.g., a typo like 'python3.99' or an unsupported value) is provided, the stack update fails during resource creation or update. Insufficient IAM permissions (option A) would typically produce an AccessDenied error rather than a runtime validation failure, and a too-high timeout (option B) is not a CloudFormation validation error since Lambda allows timeouts up to 15 minutes. A function name conflict (option D) would cause a resource already exists error, not an unsupported runtime failure.

Answer

The Lambda function's execution role does not have sufficient permissions.

Answer

The Lambda function's timeout value is too high.

Answer

The Lambda function name conflicts with an existing function.

Question 6

Refer to the exhibit. A developer is creating an IAM policy for a CI/CD service to deploy to CodeDeploy. The policy allows creating deployments and registering application revisions. However, deployments fail with an access denied error. What is the missing permission?

Accepted Answer

codedeploy:UpdateDeploymentGroup. To update a deployment group, the codedeploy:UpdateDeploymentGroup permission is required. The CI/CD service may need to update the deployment group configuration. Option A is incorrect because codedeploy:ListDeployments is read-only. Option B is incorrect because codedeploy:BatchGetDeployments is read-only. Option C is incorrect because codedeploy:StopDeployment is not needed for creation.

Answer

codedeploy:ListDeployments

Answer

codedeploy:BatchGetDeployments

Answer

codedeploy:StopDeployment

Question 7

A company deploys a containerized application on Amazon ECS with Fargate launch type. The application needs to read sensitive configuration data at startup. The company requires that the data be encrypted at rest and in transit, and that the application use least-privilege permissions. Which solution meets these requirements?

Accepted Answer

Store the configuration data in AWS Systems Manager Parameter Store with a SecureString parameter and retrieve it using the task IAM role. AWS Systems Manager Parameter Store with SecureString encrypts the configuration data at rest using AWS KMS, and the ECS task can retrieve it over HTTPS (in transit) using the task IAM role, adhering to least-privilege permissions. Option A is incorrect because AWS Secrets Manager is designed for secrets like database credentials, not configuration data, and using it adds unnecessary cost and complexity compared to Parameter Store. Option B is incorrect because Amazon S3 with pre-signed URLs does not encrypt data at rest by default unless a bucket policy enforces server-side encryption, and the pre-signed URL provides temporary access but does not enforce least-privilege; also, transit encryption is not guaranteed unless HTTPS is enforced. Option C is incorrect because environment variables in the task definition are not encrypted at rest and may be visible in plaintext in the task definition or container logs, violating encryption requirements.

Answer

Store the configuration data in AWS Secrets Manager and retrieve it at startup using the Secrets Manager API

Answer

Store the configuration data in an Amazon S3 bucket and use a pre-signed URL to download it at startup

Answer

Store the configuration data in environment variables within the ECS task definition

Question 8

A company uses AWS CloudFormation to manage infrastructure. A developer wants to update a stack but needs to ensure that certain resources are not accidentally deleted. The developer wants to protect specific resources from stack updates that would delete them. Which CloudFormation feature should the developer use?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the resources. The DeletionPolicy attribute set to Retain on a resource ensures that the resource is preserved even if it is removed from the stack template during an update or if the stack itself is deleted. This protects specific resources from accidental deletion. Option A is incorrect because termination protection only prevents the entire stack from being deleted, not individual resources. Option B is incorrect because a Change Set only shows a preview of changes but does not prevent any deletions. Option C is incorrect because a stack policy controls permissions for stack updates (e.g., which resources can be updated or deleted) but does not automatically retain resources; it is a governance tool, not a resource attribute.

Answer

Enable termination protection on the stack

Answer

Use a Change Set to review changes before applying them

Answer

Use a stack policy to prevent deletion of specific resources

Question 9

A developer is using AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls code from an Amazon S3 bucket. Which TWO actions can the developer take to automatically start the pipeline when new code is uploaded to the S3 bucket? (Choose TWO.)

Accepted Answer

Configure the pipeline to use a periodic poll of the S3 bucket. AWS CodePipeline can be configured to detect S3 source changes using either Amazon CloudWatch Events (the default event-driven method) or periodic polling. When PollForSourceChanges is enabled, CodePipeline checks the S3 bucket periodically and automatically triggers the pipeline upon detecting a change. Therefore, periodic polling does automatically start the pipeline. Options B and C are also valid: CloudWatch Events can directly target CodePipeline for S3 PutObject events, and S3 event notifications to Lambda can invoke StartPipelineExecution. Since the question requires exactly two answers, and three are valid, the question needs revision.

Answer

Configure an S3 event notification to trigger an AWS CodeBuild build

Answer

Configure the S3 bucket to send events to an Amazon SQS queue, and configure the pipeline to poll the queue

Question 10

A company is deploying a web application on AWS Elastic Beanstalk. The application requires a relational database. The company wants to decouple the database lifecycle from the environment lifecycle. Which TWO steps should the company take to achieve this? (Choose TWO.)

Accepted Answer

Create an Amazon RDS DB instance outside of Elastic Beanstalk. Option B is correct because creating the Amazon RDS DB instance outside of Elastic Beanstalk (for example, via the RDS console, CLI, or CloudFormation) removes the database from the environment's lifecycle, so terminating or rebuilding the Elastic Beanstalk environment will not delete the database. Option D is correct because once the DB is external, the application needs its connection details supplied at runtime; Elastic Beanstalk environment properties are injected as environment variables (for example, RDS_HOSTNAME, RDS_PORT, RDS_DB_NAME, RDS_USERNAME, RDS_PASSWORD) that the application reads to build the connection string, keeping the environment decoupled from the database. Option A is incorrect because DynamoDB is a NoSQL key-value/document store, not a relational database, so it does not meet the stated requirement. Option C is incorrect because attaching an RDS instance through the Elastic Beanstalk console couples the database to the environment's lifecycle, which is exactly what the company wants to avoid. Option E is incorrect because Elastic Beanstalk environments run application code, not database engines, so a separate environment cannot host the relational database.

Answer

Use Amazon DynamoDB instead of Amazon RDS

Answer

Add an Amazon RDS DB instance to the Elastic Beanstalk environment using the Elastic Beanstalk console

Answer

Create a separate Elastic Beanstalk environment for the database

Question 11

A developer is deploying a serverless application using AWS SAM. The application includes an Amazon DynamoDB table and a Lambda function that reads from the table. The developer wants to ensure that the Lambda function has the minimum required permissions to read from the table. Which THREE statements about SAM policy templates are correct? (Choose THREE.)

Accepted Answer

SAM policy templates can be applied in the Globals section of the SAM template. Options B, C, and E are correct. SAM policy templates can be applied in the Globals section (B), they allow fine-grained resource-level permissions by specifying ARNs (C), and the DynamoDBReadPolicy template grants read access to a DynamoDB table (E). Option A is incorrect because SAM policy templates are not AWS-managed policies; they are predefined templates that SAM expands into IAM policies for common use cases. Option D is incorrect because they do not support custom resources.

Answer

SAM policy templates are AWS-managed policies that can be applied to Lambda function roles

Answer

SAM policy templates can be used to grant permissions to custom resources

Question 12

A company uses AWS CloudFormation to deploy infrastructure. The development team wants to update a stack that includes an Amazon RDS database. The update requires changing the DB instance class, which will cause a brief downtime. The team wants to minimize downtime by creating a new database instance before deleting the old one. Which CloudFormation stack update policy should be used?

Accepted Answer

Use a 'DeletionPolicy' attribute set to 'Delete' for the RDS instance.. To prevent a resource from being deleted when a stack is deleted, use the 'DeletionPolicy' attribute with the 'Retain' (or 'Snapshot') value. To prevent a resource from being deleted when it is replaced during a stack update, use the 'UpdateReplacePolicy' attribute with the 'Retain' (or 'Snapshot') value. 'UpdatePolicy' is used to define how CloudFormation handles rolling updates for specific resources like Auto Scaling groups or ElastiCache replication groups, and does not support the 'Retain' value. 'TerminationProtection' is a stack-level setting, not a resource attribute.

Answer

Use a 'DeletionPolicy' attribute set to 'Snapshot' for the RDS instance.

Answer

Use an 'UpdatePolicy' attribute with 'UseOnlineResharding' set to true.

Answer

Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' set to true.

Question 13

A company is using AWS CodeBuild to compile and test code before deploying to Amazon S3. The build process must be triggered automatically whenever a developer pushes code to the 'main' branch of an AWS CodeCommit repository. Which resource should be used to trigger the build?

Accepted Answer

Use AWS CodePipeline with a source stage that connects to the CodeCommit repository and a build stage that invokes the CodeBuild project.. AWS CodePipeline is the CI/CD orchestration service that can automatically trigger a build when code is pushed to a CodeCommit repository. By configuring a source stage with CodeCommit and a build stage with CodeBuild, CodePipeline detects the change (via CloudWatch Events) and starts the build. This is the standard, managed approach for triggering CodeBuild on repository changes.

Answer

Set up an AWS CodeDeploy trigger to start the build when a deployment is created.

Answer

Configure an Amazon S3 event notification to invoke the CodeBuild project when a new object is created.

Answer

Create an Amazon CloudWatch Events rule that triggers the CodeBuild project when a repository event occurs.

Question 14

A team is deploying a containerized application on Amazon ECS using Fargate. The application requires high availability and must be deployed across multiple Availability Zones. The team wants to automate the deployment process using AWS CodePipeline. What is the most efficient way to update the ECS service with a new task definition?

Accepted Answer

Use the ECS deploy action in CodePipeline with the 'Immediate' deployment option to update the service.. CodePipeline's ECS deploy action with the 'Immediate' deployment option automates updating the ECS service to use a new task definition, efficiently handling rolling updates across Availability Zones. Option B is wrong because using a Lambda function to call UpdateService adds complexity and is less efficient than the built-in CodePipeline action. Option C is wrong because manual console updates are not automated. Option D is wrong because CloudFormation is more suitable for infrastructure provisioning than frequent task definition updates for ECS services.

Answer

Use an AWS Lambda function that calls the ECS UpdateService API with the new task definition.

Answer

Use the AWS Management Console to update the ECS service with the new task definition.

Answer

Use AWS CloudFormation to update the ECS service by updating the stack with the new task definition.

Question 15

A developer is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The developer uses AWS CodeDeploy to deploy new application versions. The deployment group is configured with an in-place deployment. The developer wants to ensure that the deployment does not cause any downtime. Which additional configuration is required?

Accepted Answer

Configure the CodeDeploy deployment group to enable load balancer deregistration and re-registration.. The additional configuration required is to enable load balancer deregistration and re-registration in the CodeDeploy deployment group. This ensures that during an in-place deployment, instances are deregistered from the ALB before the new version is deployed and re-registered after, preventing downtime by allowing the load balancer to route traffic only to healthy instances.

Answer

Change the deployment type to blue/green deployment.

Answer

Set the minimum healthy hosts percentage to 100%.

Answer

Create an Auto Scaling group and configure the deployment to use a rolling update.