DVA-C02 Deployment Practice Test 5 — 15 Questions

Question 1

A team uses AWS CloudFormation to manage infrastructure. They want to update a stack that contains an Amazon RDS database. During the update, they need to modify the DB instance class. Which update policy should they use to minimize downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SnapshotUpdate. When you modify the DBInstanceClass of an Amazon RDS instance, CloudFormation applies the change directly. For a Single-AZ DB instance, this causes a temporary outage while the instance type is changed. To minimize downtime, you should configure the DB instance as a Multi-AZ deployment. In a Multi-AZ deployment, Amazon RDS performs the modification on the standby instance first, then triggers a failover to the standby, and finally modifies the original primary instance. This reduces the downtime to the duration of the failover (typically under a minute).

Answer

AutoScalingReplacingUpdate

Answer

ReplacingUpdate

Answer

AutoScalingRollingUpdate

Question 2

Which THREE are best practices for deploying applications with AWS Elastic Beanstalk? (Choose THREE.)

Accepted Answer

Use environment configuration files (.ebextensions) to manage settings.. Ebextensions configuration files allow you to define environment settings, software configurations, and custom resources declaratively, ensuring consistent and repeatable deployments without manual intervention. This aligns with the best practice of infrastructure as code, as Elastic Beanstalk automatically applies these settings during environment creation and updates.

Answer

Manually update EC2 instances in the environment.

Answer

Always use the default Elastic Beanstalk domain for production.

Question 3

Which TWO are valid ways to automate deployments to Amazon ECS? (Choose TWO.)

Accepted Answer

Use AWS CodeDeploy with an Amazon ECS blue/green deployment.. AWS CodeDeploy natively supports Amazon ECS blue/green deployments, allowing you to automate the process of shifting traffic from an old task set to a new one. You can define the deployment configuration, including traffic routing and lifecycle hooks, directly in CodeDeploy.

AWS CodePipeline provides a native 'Amazon ECS' deploy action (as well as 'Amazon ECS (Blue/Green)' deploy action) that automates the deployment of container images to Amazon ECS services by updating the task definition with the new image URI and updating the service.

Answer

Use AWS CloudFormation to create a change set and update the service.

Answer

Use AWS OpsWorks with a Docker layer.

Answer

Use AWS Elastic Beanstalk with a Docker platform.

Question 4

Refer to the exhibit. A developer ran the AWS CLI command and received the output shown. What is the most likely cause of the UPDATE_FAILED status?

Accepted Answer

The CloudFormation template specified an unsupported runtime for the Lambda function.. The error message indicates that the runtime nodejs18.x is not supported, meaning the CloudFormation template specified an unsupported runtime for the Lambda function. Option A is incorrect because IAM permissions would result in a different error, not an unsupported runtime. Option B is incorrect because the timeout value does not affect runtime support. Option D is incorrect because a function name conflict would cause a different error.

Answer

The Lambda function's execution role does not have sufficient permissions.

Answer

The Lambda function's timeout value is too high.

Answer

The Lambda function name conflicts with an existing function.

Question 5

Refer to the exhibit. A developer is creating an IAM policy for a CI/CD service to deploy to CodeDeploy. The policy allows creating deployments and registering application revisions. However, deployments fail with an access denied error. What is the missing permission?

Accepted Answer

codedeploy:UpdateDeploymentGroup. To update a deployment group, the codedeploy:UpdateDeploymentGroup permission is required. The CI/CD service may need to update the deployment group configuration. Option A is incorrect because codedeploy:ListDeployments is read-only. Option B is incorrect because codedeploy:BatchGetDeployments is read-only. Option C is incorrect because codedeploy:StopDeployment is not needed for creation.

Answer

codedeploy:ListDeployments

Answer

codedeploy:BatchGetDeployments

Answer

codedeploy:StopDeployment

Question 6

A developer created a CloudFormation template to host a static website. After deployment, the website returns 403 Forbidden errors. What is the most likely cause?

Accepted Answer

The bucket policy does not allow public access.. An 'Access Denied' (403 Forbidden) error on an Amazon S3 static website endpoint indicates that the requester does not have permission to access the resource. By default, all new S3 buckets and objects are private. To allow public access to the website's assets, you must add a bucket policy that grants public read permissions (`s3:GetObject`) to anonymous users, and ensure that S3 Block Public Access settings are disabled. If static website hosting were not enabled, the website endpoint would not return a 403 Forbidden error; it would not resolve or would return a 404 error. Therefore, the missing bucket policy is the most likely cause.

Answer

The bucket has versioning enabled, which blocks public access.

Answer

The bucket name is not unique.

Answer

The bucket does not have static website hosting enabled.

Question 7

A company has a production environment using AWS Elastic Beanstalk with a multi-container Docker platform. The application consists of a PHP web server and a Redis cache, each running in separate containers. The deployment uses a rolling update policy with a batch size of 1. Recently, during deployments, some users experience intermittent 502 Bad Gateway errors for about 30 seconds. The errors occur when the old containers are terminated and new containers are not yet ready to serve traffic. The development team wants to eliminate this downtime without increasing the deployment time significantly. The team has access to modify the Elastic Beanstalk environment configuration and the Dockerrun.aws.json file. Which action should the team take to resolve the issue?

Accepted Answer

Configure a health check grace period in the Elastic Beanstalk environment to delay load balancer registration until the containers are healthy.. Configuring a health check grace period allows new containers time to become healthy before the load balancer routes traffic to them, preventing the 502 errors during the transition. Option A is incorrect because increasing the batch size would cause more containers to be replaced simultaneously, potentially increasing downtime. Option C is incorrect because 'All at once' deployment would terminate all old containers before starting new ones, causing full downtime. Option D is incorrect because reducing the health check interval would make the load balancer check more frequently, which could cause premature routing to unhealthy instances and exacerbate the issue.

Answer

Increase the batch size to 2 to reduce the number of deployment cycles.

Answer

Change the deployment policy to 'All at once' to complete the deployment faster.

Answer

Reduce the health check interval on the load balancer to detect healthy instances faster.

Question 8

A developer is deploying a new version of a Lambda function using an AWS CodePipeline pipeline. The deployment fails during the 'Deploy' stage with an error indicating that the function's code is too large. What should the developer do to resolve this issue?

Accepted Answer

Upload the Lambda deployment package to Amazon S3 and reference it from the function. AWS Lambda has a hard limit of 50 MB for direct uploads via the console or API. When a deployment package exceeds this limit, the correct approach is to upload the package to Amazon S3 and configure the Lambda function to reference the S3 object. CodePipeline can then use the S3 location to deploy the function, bypassing the direct upload size restriction.

Answer

Increase the Lambda function's timeout setting

Answer

Use Amazon CloudFront to distribute the Lambda code

Answer

Enable AWS X-Ray tracing on the Lambda function

Question 9

A team uses AWS Elastic Beanstalk to deploy a web application. The application experiences intermittent high latency. The team notices that the environment's Auto Scaling group is not scaling out quickly enough. Which configuration change should the team make to improve scaling responsiveness?

Accepted Answer

Decrease the Auto Scaling group's cooldown period. Decreasing the Auto Scaling group's cooldown period reduces the time that the group waits after a scaling activity before it can launch another instance, thereby improving scaling responsiveness. Option A is incorrect because a lighter health check path does not affect scaling speed—it only affects how quickly unhealthy instances are detected. Option B is incorrect; while detailed CloudWatch metrics provide more granular data, they do not directly reduce the cooldown period. Option C is incorrect because increasing instance size improves per-instance capacity but does not change how quickly the group scales out.

Answer

Modify the Elastic Load Balancer health check path to a lighter endpoint

Answer

Enable detailed CloudWatch metrics for the Auto Scaling group

Answer

Increase the instance type to a larger size

Question 10

A company deploys a containerized application on Amazon ECS with Fargate launch type. The application needs to read sensitive configuration data at startup. The company requires that the data be encrypted at rest and in transit, and that the application use least-privilege permissions. Which solution meets these requirements?

Accepted Answer

Store the configuration data in AWS Systems Manager Parameter Store with a SecureString parameter and retrieve it using the task IAM role. AWS Systems Manager Parameter Store with SecureString encrypts the configuration data at rest using AWS KMS, and the ECS task can retrieve it over HTTPS (in transit) using the task IAM role, adhering to least-privilege permissions. Option A is incorrect because AWS Secrets Manager is designed for secrets like database credentials, not configuration data, and using it adds unnecessary cost and complexity compared to Parameter Store. Option B is incorrect because Amazon S3 with pre-signed URLs does not encrypt data at rest by default unless a bucket policy enforces server-side encryption, and the pre-signed URL provides temporary access but does not enforce least-privilege; also, transit encryption is not guaranteed unless HTTPS is enforced. Option C is incorrect because environment variables in the task definition are not encrypted at rest and may be visible in plaintext in the task definition or container logs, violating encryption requirements.

Answer

Store the configuration data in AWS Secrets Manager and retrieve it at startup using the Secrets Manager API

Answer

Store the configuration data in an Amazon S3 bucket and use a pre-signed URL to download it at startup

Answer

Store the configuration data in environment variables within the ECS task definition

Question 11

A company uses AWS CloudFormation to manage infrastructure. A developer wants to update a stack but needs to ensure that certain resources are not accidentally deleted. The developer wants to protect specific resources from stack updates that would delete them. Which CloudFormation feature should the developer use?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the resources. The DeletionPolicy attribute set to Retain on a resource ensures that the resource is preserved even if it is removed from the stack template during an update or if the stack itself is deleted. This protects specific resources from accidental deletion. Option A is incorrect because termination protection only prevents the entire stack from being deleted, not individual resources. Option B is incorrect because a Change Set only shows a preview of changes but does not prevent any deletions. Option C is incorrect because a stack policy controls permissions for stack updates (e.g., which resources can be updated or deleted) but does not automatically retain resources; it is a governance tool, not a resource attribute.

Answer

Enable termination protection on the stack

Answer

Use a Change Set to review changes before applying them

Answer

Use a stack policy to prevent deletion of specific resources

Question 12

A company uses AWS OpsWorks to manage a stack of EC2 instances. The operations team needs to deploy a new configuration file to all instances in a layer. Which approach should the team use to automate this deployment?

Accepted Answer

Add a Chef recipe to the layer's custom cookbooks that copies the configuration file to the instances. AWS OpsWorks uses Chef for configuration management. By adding a Chef recipe to the layer's custom cookbooks, the recipe can be executed on all instances in that layer to copy the configuration file. Option A is incorrect: while AWS Systems Manager Run Command can execute scripts on EC2 instances, it is not integrated with OpsWorks and would require manual targeting. Option C is incorrect: AWS CloudFormation is used for provisioning infrastructure, not for deploying configuration files to running instances. Option D is incorrect: AWS CodeDeploy is designed for deploying applications, not for system configuration files.

Answer

Use AWS Systems Manager Run Command to execute a script that deploys the file

Answer

Create a new AWS CloudFormation stack to update the instances

Answer

Use AWS CodeDeploy to deploy the configuration file

Question 13

A developer is using AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls code from an Amazon S3 bucket. Which TWO actions can the developer take to automatically start the pipeline when new code is uploaded to the S3 bucket? (Choose TWO.)

Accepted Answer

Configure the pipeline to use a periodic poll of the S3 bucket. AWS CodePipeline can be configured to detect S3 source changes using either Amazon CloudWatch Events (the default event-driven method) or periodic polling. When PollForSourceChanges is enabled, CodePipeline checks the S3 bucket periodically and automatically triggers the pipeline upon detecting a change. Therefore, periodic polling does automatically start the pipeline. Options B and C are also valid: CloudWatch Events can directly target CodePipeline for S3 PutObject events, and S3 event notifications to Lambda can invoke StartPipelineExecution. Since the question requires exactly two answers, and three are valid, the question needs revision.

Answer

Configure an S3 event notification to trigger an AWS CodeBuild build

Answer

Configure the S3 bucket to send events to an Amazon SQS queue, and configure the pipeline to poll the queue

Question 14

A company is deploying a web application on AWS Elastic Beanstalk. The application requires a relational database. The company wants to decouple the database lifecycle from the environment lifecycle. Which TWO steps should the company take to achieve this? (Choose TWO.)

Accepted Answer

Create an Amazon RDS DB instance outside of Elastic Beanstalk. Creating an Amazon RDS DB instance outside of Elastic Beanstalk decouples the database lifecycle from the environment lifecycle. This means the database can be retained, modified, or terminated independently of the Elastic Beanstalk environment, preventing data loss when the environment is terminated or recreated. The application can then connect to the external RDS instance via environment properties passed to the EC2 instances.

Answer

Use Amazon DynamoDB instead of Amazon RDS

Answer

Add an Amazon RDS DB instance to the Elastic Beanstalk environment using the Elastic Beanstalk console

Answer

Create a separate Elastic Beanstalk environment for the database

Question 15

A developer is deploying a serverless application using AWS SAM. The application includes an Amazon DynamoDB table and a Lambda function that reads from the table. The developer wants to ensure that the Lambda function has the minimum required permissions to read from the table. Which THREE statements about SAM policy templates are correct? (Choose THREE.)

Accepted Answer

SAM policy templates can be applied in the Globals section of the SAM template. Options B, C, and E are correct. SAM policy templates can be applied in the Globals section (B), they allow fine-grained resource-level permissions by specifying ARNs (C), and the DynamoDBReadPolicy template grants read access to a DynamoDB table (E). Option A is incorrect because SAM policy templates are not AWS-managed policies; they are predefined templates that SAM expands into IAM policies for common use cases. Option D is incorrect because they do not support custom resources.

Answer

SAM policy templates are AWS-managed policies that can be applied to Lambda function roles

Answer

SAM policy templates can be used to grant permissions to custom resources