DVA-C02 Deployment Practice Test 6 — 15 Questions

Question 1

A developer is using AWS CodeBuild to build a Java application. The buildspec.yml file includes commands to run unit tests and package the application. Recently, the build started failing with the error 'No space left on device.' The developer notices that the build environment is using the general1.large compute type with 8 GB of disk space. The developer needs to resolve the disk space issue without modifying the application code. The build environment is managed by CodeBuild and the developer cannot change the instance type. What should the developer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a command in the buildspec.yml to clean the cache directory before the build phase.. Cleaning the cache directory before the build phase frees up disk space, resolving the 'No space left on device' error. Option B is incorrect because using an EFS file system as a cache does not free up space on the build container; it only provides additional storage for dependencies, but CodeBuild does not natively support EFS as a cache. Option C is incorrect because changing the compute type to general1.medium does not change disk space; it still has 8 GB, and the developer cannot change the instance type anyway. Option D is incorrect because mounting an additional EBS volume is not supported in CodeBuild build environments; the developer cannot modify the underlying instance.

Answer

Use an Amazon EFS file system as a cache to store dependencies.

Answer

Change the compute type to general1.medium with 8 GB disk space.

Answer

Mount an additional Amazon EBS volume to the build container.

Question 2

A company uses AWS CodeBuild to compile and package code, and AWS CodePipeline to orchestrate deployments to Amazon ECS. The pipeline includes a manual approval step. During a recent deployment, the build succeeded but the pipeline failed at the deploy stage with the error 'CannotPullContainerError: manifest for image:tag not found'. The ECS task definition references the image:tag. What is the most likely cause?

Accepted Answer

The CodeBuild project does not have permissions to push to Amazon ECR.. When the ECS task execution role lacks the necessary permissions (such as `ecr:BatchGetImage` and `ecr:GetDownloadUrlForLayer`) to pull the image from Amazon ECR, ECR returns a 'not found' error to prevent exposing whether a private repository exists. This results in the ECS agent throwing the 'CannotPullContainerError: manifest for image:tag not found' error.

Answer

The ECS cluster does not have internet access to pull the image from ECR.

Answer

The image tag used is 'latest', and a subsequent build pushed a new 'latest' image, overwriting the original before the manual approval was granted.

Answer

The task definition references an incorrect image name.

Question 3

A company uses AWS CloudFormation to manage infrastructure. They need to update a stack that includes an Amazon RDS DB instance. To minimize downtime, they want to perform a rolling update. Which THREE properties must be set in the CloudFormation template?

Accepted Answer

DeletionPolicy attribute set to Snapshot. Rolling updates are not supported for AWS::RDS::DBInstance in CloudFormation. Instead, to minimize downtime during an RDS update, you should use a replacement update strategy with the DeletionPolicy attribute set to Snapshot to preserve data from the old instance. Options A, B, and C apply to Auto Scaling groups, not RDS. Option E (UseOnlineResizing) is not a valid CloudFormation attribute.

Answer

CreationPolicy attribute with ResourceSignal

Answer

UpdatePolicy attribute with AutoScalingReplacingUpdate

Answer

UpdatePolicy attribute with AutoScalingRollingUpdate

Answer

UpdatePolicy attribute with UseOnlineResizing

Question 4

A developer is using AWS CodePipeline to automate deployments. The pipeline has a Source stage using Amazon S3 and a Deploy stage using AWS Elastic Beanstalk. The developer notices that the pipeline fails at the Deploy stage with the error 'The deployment failed because the version of the application to be deployed could not be found.' Which TWO actions should the developer take to resolve this issue?

Accepted Answer

Ensure that the S3 bucket and the Elastic Beanstalk environment are in the same AWS region.. Option A is correct because CodePipeline's S3 source and Elastic Beanstalk deploy actions must operate in the same AWS region; if the S3 bucket holding the source artifact is in a different region than the Elastic Beanstalk environment, the deploy action cannot locate the application version, producing the 'version of the application to be deployed could not be found' error. Option E is correct because the CodePipeline service role (or the role used by the deploy action) must have s3:GetObject on the source bucket and elasticbeanstalk permissions such as CreateApplicationVersion and UpdateEnvironment; without these permissions, the application version is never created in Elastic Beanstalk, so the deployment cannot find it. Option B is not the cause here because an invalid zip would typically fail earlier in the Source or Build stage or produce a different artifact/validation error, not a missing application version. Option C is not required since S3 object keys with special characters are generally handled by CodePipeline and would not specifically cause this 'version not found' error. Option D is not the issue because an incorrect bucket name would fail at the Source stage with an access or not-found error rather than at the Deploy stage.

Answer

Make sure the source artifact is a valid zip file containing the application code and environment configuration.

Answer

Confirm that the S3 object key does not contain special characters.

Answer

Verify that the S3 bucket name is exactly as specified in the pipeline.

Question 5

A large enterprise is deploying a critical application across multiple AWS regions using AWS CodePipeline and AWS CodeDeploy. The application runs on EC2 instances in an Auto Scaling group. The deployment uses a blue/green strategy. During a cross-region deployment, the pipeline fails in the secondary region with the error 'The deployment group does not exist.' The developer confirms that the deployment group exists in the primary region and has been replicated via AWS CloudFormation StackSets. The developer also checks that the StackSet is successfully deployed in the secondary region. What is the most likely cause?

Accepted Answer

The CodePipeline in the secondary region references the deployment group ARN from the primary region instead of the secondary region.. The CodePipeline in the secondary region is likely misconfigured with the deployment group identifier from the primary region (e.g., using the primary deployment group's ARN as the deployment group name). This causes CodeDeploy to search for a deployment group with that exact string in the secondary region and fail. The pipeline should reference the deployment group by its local name (ApplicationName/DeploymentGroupName) in the secondary region, not by an ARN.

Answer

The deployment group name is case-sensitive and differs between regions.

Answer

The CodePipeline in the secondary region is not configured with the correct source stage.

Answer

The IAM role for CodeDeploy in the secondary region does not have cross-region permissions.

Question 6

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an AWS Lambda function and an Amazon API Gateway REST API. The developer runs 'sam deploy' but the deployment fails with the error: 'Error: Security Constraints Not Satisfied'. The developer checks the IAM policies and confirms that the Lambda function has the necessary permissions. What is the most likely cause?

Accepted Answer

The API Gateway endpoint is configured with 'OPEN' access without any authorization.. SAM enforces security constraints during deployment. If the API Gateway endpoint is configured with 'OPEN' access (i.e., no authorization), the deployment fails with 'Security Constraints Not Satisfied'. Option A is incorrect because SAM does not require a Lambda function to be in a VPC. Option B is incorrect because SAM can automatically create an S3 bucket. Option D is incorrect because memory size does not cause this error.

Answer

The Lambda function is not configured to run inside a VPC.

Answer

The SAM template does not specify an S3 bucket for the deployment artifacts.

Answer

The Lambda function's memory size is set too high.

Question 7

A developer is deploying an AWS Lambda function that processes data from an Amazon Kinesis stream. The function must be idempotent and handle duplicate records. The developer notices that the same record is being processed multiple times. What is the most likely cause of this issue?

Accepted Answer

The Kinesis data stream's retention period is too long, causing old records to be reprocessed.. When an AWS Lambda function processing a Kinesis stream fails or times out, Lambda retries the entire batch of records until they succeed or expire. This head-of-line blocking causes the stream's IteratorAge metric to increase (not decrease) because the consumer is stuck on the failing batch while new records continue to arrive. This retry behavior results in the same records being processed multiple times.

Answer

The function's reserved concurrency is set too low, causing invocations to be throttled and retried.

Answer

The batch size is set too high, causing the function to process records in multiple batches.

Answer

The Kinesis stream's iterator age is too low, causing the function to reprocess records after a failure.

Question 8

A company uses AWS Elastic Beanstalk to deploy a web application. The developer wants to update the environment's configuration, such as instance type and environment variables, without causing downtime. Which deployment policy should the developer use?

Accepted Answer

Rolling. The Rolling deployment policy is the correct choice because it updates instances in batches, replacing a subset of instances with the new configuration while keeping the rest running, thereby avoiding downtime. This allows environment variables and instance types to be changed incrementally without taking the entire application offline, as each batch is updated only after the previous batch remains healthy.

Answer

All at once

Answer

Blue/green

Answer

Immutable

Question 9

A company is deploying a containerized application on Amazon EKS. The developer wants to automate the deployment process using a CI/CD pipeline that builds a Docker image, pushes it to Amazon ECR, and updates the Kubernetes deployment. Which tool should the developer use to update the Kubernetes deployment?

Accepted Answer

AWS CodeBuild with a buildspec that runs kubectl commands. To automate the deployment of a containerized application to Amazon EKS within a CI/CD pipeline, AWS CodeBuild is the ideal service. A buildspec.yml file is configured in CodeBuild to install the AWS CLI and kubectl, authenticate with the EKS cluster, and run the necessary kubectl commands (such as `kubectl apply` or `kubectl set image`) to update the deployment with the new container image from Amazon ECR.

Answer

kubectl set image command

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation with a custom resource

Question 10

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance in a CodeDeploy deployment group. The deployment fails with 'Access Denied' when the CodeDeploy agent tries to register the application revision. What is the most likely cause?

Accepted Answer

The policy does not include the 'codedeploy:PutApplicationRevision' action.. The CodeDeploy agent requires the `codedeploy:RegisterApplicationRevision` permission to register an application revision. The policy in the exhibit omits this action, causing the 'Access Denied' error. Note that the option text uses 'PutApplicationRevision' which is an older or alternative name for the same permission in some contexts; the core issue is the missing permission required for revision registration.

Answer

The resource is set to '*' which is not allowed for CodeDeploy actions.

Answer

The role is not associated with the CodeDeploy service.

Answer

The policy is missing an explicit deny for other actions.

Question 11

A DevOps engineer is implementing a blue/green deployment for a microservice running on Amazon ECS with Fargate. The service is fronted by an Application Load Balancer. During deployment, the new task set fails health checks, but the deployment does not automatically roll back. What is the MOST likely reason?

Accepted Answer

The ECS service deployment controller is set to 'ECS' instead of 'CODE_DEPLOY'.. For blue/green deployments on ECS, you must specify a deployment controller type of 'CODE_DEPLOY' to use CodeDeploy and enable automatic rollback. If the controller is 'ECS' (the default), the deployment is managed by ECS and does not support automatic rollback on health check failures in blue/green mode. Option B is wrong because ECS does roll back if health checks fail when using ECS deployment controller with rolling update, but not for blue/green. Option C is wrong because CodeDeploy is not used if deployment controller is not CODE_DEPLOY. Option D is wrong because health check grace period delays health checks but does not prevent rollback if checks fail after grace period.

Answer

The CodeDeploy application and deployment group are not configured for automatic rollback.

Answer

The health check grace period is set too high.

Answer

The ECS service is configured with a 'minimum healthy percent' of 100 percent.

Question 12

A team uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that includes an Amazon RDS DB instance. During deployment, the stack creation fails because the DB instance creation times out. The team wants to ensure that subsequent stack creation attempts do not recreate the DB instance from scratch but instead continue from the failed state. Which CloudFormation feature should they use?

Accepted Answer

Use a CloudFormation custom resource to check for an existing DB instance and create it only if it does not exist.. When a CloudFormation stack creation fails, by default CloudFormation rolls back and deletes any resources that were created. To avoid recreating a resource like an RDS DB instance from scratch on subsequent attempts, you can use a custom resource that checks for the existence of the DB instance. If the instance already exists, the custom resource can return success without creating a new one, effectively allowing the stack creation to continue from where it left off. Options A, B, and C do not solve the problem: WaitConditions (A) only pause creation but do not prevent rollback; separate stacks with Fn::ImportValue (B) avoid recreation but the question asks for a feature to continue from the failed state, not to manage dependencies; stack policies (C) protect resources during updates, not during initial creation.

Answer

Use a CloudFormation WaitCondition to pause stack creation until the DB instance is available.

Answer

Create the DB instance using a separate CloudFormation stack and reference it using Fn::ImportValue.

Answer

Apply a stack policy that prevents the DB instance from being deleted during stack updates.

Question 13

A developer is using AWS SAM to deploy a serverless application. The SAM template defines an API Gateway REST API and several Lambda functions. During deployment, the developer receives an error: 'Resource creation cancelled' for the API Gateway resource. The developer has sufficient IAM permissions. What is the MOST likely cause?

Accepted Answer

A stack policy is preventing the creation of the API Gateway resource.. When a CloudFormation deployment fails, the resource that encountered the actual error will show a specific failure reason (e.g., an IAM permission issue, a limit exceeded, or a configuration error). Any other resources that were in the process of being created or were waiting to be created are cancelled as the stack rolls back, displaying the status reason 'Resource creation cancelled'. Therefore, if the API Gateway resource shows 'Resource creation cancelled', it means another resource in the template (such as a Lambda function) failed to create.

Answer

The AWS account has reached the limit of API Gateway REST APIs.

Answer

The SAM template has a syntax error in the YAML file.

Answer

The SAM template does not include an AWS::Serverless::Api resource.

Question 14

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Accepted Answer

An Application Load Balancer. Option B is correct because an Application Load Balancer is required to route traffic between the blue and green target groups during an ECS blue/green deployment, allowing CodeDeploy to shift traffic via listener rules. Option C is correct because a CodeDeploy deployment group defines the target ECS service, the load balancer, and the blue/green deployment configuration that CodeDeploy uses to execute the shift. Option D is correct because a CodeDeploy application is the top-level container that groups deployment groups and is a prerequisite for creating any CodeDeploy deployment, including ECS blue/green. Option A is not required as a distinct component because the ECS cluster is referenced through the ECS service and deployment group configuration, not as a separately mandated CodeDeploy component. Option E is not required because a target tracking scaling policy is an Application Auto Scaling feature for adjusting task count, not a component of the CodeDeploy blue/green deployment mechanism.

Answer

An Amazon ECS cluster

Answer

A target tracking scaling policy

Question 15

A developer uses CodePipeline to deploy a new task definition to an ECS service. The pipeline fails with an access denied error when updating the service. Which missing permission is the most likely cause?

Accepted Answer

Missing iam:PassRole permission for the task execution role used by the new task definition. When CodePipeline deploys a new ECS task definition, the ECS service must assume the task execution role to pull images and write logs, and the pipeline's IAM principal needs iam:PassRole to hand that role to ECS. Without iam:PassRole scoped to the task execution role ARN, the UpdateService call fails with AccessDenied even if ecs:UpdateService is granted.

Answer

Missing ecs:UpdateService permission for the service resource

Answer

Missing ecs:DescribeServices permission

Answer

Missing ecs:RegisterTaskDefinition permission for the new task definition