DVA-C02 Deployment Practice Test 8 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The development team wants to make a change to a stack that involves replacing a critical resource. The team wants to minimize downtime and ensure that the replacement is successful before removing the old resource. Which CloudFormation feature should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a CreationPolicy on the resource to ensure it is fully created before the old one is deleted.. When AWS CloudFormation replaces a resource during a stack update, it creates the new resource first and then deletes the old one. To ensure that the new resource is fully functional and successful before the old one is deleted, you should use a `CreationPolicy`. This pauses the update process and prevents the deletion of the old resource until the new resource sends a success signal (e.g., via cfn-signal). If the signal is not received, the update rolls back, keeping the old resource intact and minimizing downtime. A change set (Option B) only previews what changes will occur; it does not ensure successful execution or control the runtime replacement behavior.

Answer

Use AWS CodeDeploy blue/green deployment.

Answer

Use a change set to review the changes before executing.

Answer

Use nested stacks to isolate the resource.

Question 2

A company is deploying a critical application using AWS CloudFormation. The stack contains a resource that, if deleted accidentally, would cause data loss. The company wants to protect this resource from being deleted during stack updates or deletions. Which THREE strategies can achieve this? (Choose THREE.)

Accepted Answer

Enable termination protection on the CloudFormation stack.. Option B is correct because enabling termination protection on the CloudFormation stack prevents the entire stack from being deleted, which protects the resource from accidental stack deletion (though it does not protect against resource replacement during updates). Option D is correct because a stack policy with an explicit Deny on Delete actions for the resource prevents CloudFormation from deleting or replacing that resource during stack updates, directly guarding against accidental deletion. Option E is correct because setting DeletionPolicy to 'Retain' on the resource ensures that when the stack is deleted or the resource is removed from the template, CloudFormation leaves the underlying resource intact instead of deleting it, preventing data loss. Option A is not correct because wrapping a resource in a nested stack does not by itself prevent deletion of the resource; the nested stack can still be deleted and would delete its resources unless a DeletionPolicy or stack policy is applied. Option C is not correct because UpdateReplacePolicy only applies during update-triggered replacements, not during stack deletion, so it does not fully protect the resource from deletion as required.

Answer

Wrap the resource in a nested stack.

Answer

Set the UpdateReplacePolicy attribute to 'Retain' on the resource.

Question 3

Refer to the exhibit. A developer deploys this CloudFormation template. After deployment, the S3 bucket is created but the developer notices that the lifecycle rule does not appear in the bucket's management console. What is the most likely cause?

Accepted Answer

The VersioningConfiguration is incorrectly specified.. The VersioningConfiguration might be incorrectly specified, such as setting it to 'Suspended' while the lifecycle rule requires versioning to be enabled for actions like 'NoncurrentVersionExpiration'. If versioning is not enabled, the lifecycle rule may not be applied or may not appear in the management console. Option A is incorrect because the 'Prefix' property is optional; an omitted prefix means the rule applies to all objects and is still valid. Option B is incorrect because lifecycle rules are not required to have a 'Transitions' property; they can have other actions like 'Expiration'. Option D is incorrect because bucket names can contain account IDs as long as they are globally unique.

Answer

The lifecycle rule is missing the 'Prefix' property, causing it to be invalid.

Answer

The lifecycle rule must have a 'Transitions' property.

Answer

The bucket name contains an account ID, which is not allowed.

Question 4

A company uses AWS CodePipeline to deploy a web application. The deployment fails intermittently during the 'Deploy' stage. The pipeline includes a step that runs a shell script on an EC2 instance. The pipeline uses a CodeBuild project for the build stage. What is the MOST likely cause of the intermittent failure?

Accepted Answer

The EC2 instance used for deployment does not have the CodeDeploy agent installed.. If the EC2 instance is terminated or replaced, the CodeDeploy agent may not be installed, causing intermittent failures. Option A is wrong because CodeBuild uses temporary instances. Option C is wrong because CodePipeline does not require a VPC. Option D is wrong because IAM roles are not updated automatically.

Answer

The CodeBuild project is using an outdated build image.

Answer

The pipeline is not configured to use a VPC.

Answer

The IAM role for CodePipeline does not have permissions to deploy.

Question 5

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. Recently, deployments have been failing because the CodeBuild project cannot download dependencies from the internet. The build environment does not have internet access due to VPC settings. Which THREE steps should a developer take to resolve this issue? (Choose THREE.)

Accepted Answer

Configure a NAT gateway in the public subnet to allow outbound internet access.. Corrected explanation: A NAT gateway in a public subnet allows instances in private subnets to access the internet, enabling CodeBuild to download dependencies. C: Placing the CodeBuild project in a private subnet is necessary for using the NAT gateway to route outbound traffic. E: VPC endpoints for Amazon S3 allow CodeBuild to access dependencies stored in S3 without requiring internet access. B is incorrect because moving the source to S3 does not address the lack of internet connectivity for downloading dependencies. D is incorrect because, although assigning a public IP is possible, it only works if the project is in a public subnet with an internet gateway; the standard recommended solution for this scenario is using a private subnet with a NAT gateway.

Answer

Move the source stage to use S3 instead of CodeCommit.

Answer

Assign a public IP address to the CodeBuild project.

Question 6

Refer to the exhibit. A developer is trying to deploy an EC2 instance using AWS CloudFormation. The stack creation fails with an 'AccessDenied' error when CloudFormation tries to create the EC2 instance. The developer has the IAM policy above. What is the MOST likely reason for the failure?

Accepted Answer

The IAM role specified in the CloudFormation template is not the same as the one in the PassRole resource.. CloudFormation assumes an IAM role to create resources on the user's behalf, and that role must be explicitly granted via iam:PassRole. If the role ARN referenced in the CloudFormation template (or stack role) does not match the Resource ARN allowed in the PassRole statement, CloudFormation receives AccessDenied when it tries to pass the role to EC2. This mismatch is the most likely cause given the exhibit.

Answer

The policy does not allow ec2:DescribeImages.

Answer

The policy does not allow ec2:RunInstances.

Answer

The policy does not allow ec2:TerminateInstances.

Question 7

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration is CodeDeployDefault.OneAtATime. The Auto Scaling group has 4 instances. What is the most likely cause?

Accepted Answer

The first instance in the deployment fails, and the deployment stops because only one instance is deployed at a time.. With CodeDeployDefault.OneAtATime, CodeDeploy deploys to one instance at a time and stops the deployment if any instance fails. The error message indicates too many individual instances failed. If the first instance fails, the deployment halts immediately, leaving the remaining instances undeployed. This is the most likely cause given the configuration.

Answer

The CodeDeploy agent on the instances is not running.

Answer

The target group health checks are misconfigured.

Answer

The Auto Scaling group is scaling down during deployment.

Question 8

A company uses AWS CodePipeline with CodeBuild and CodeDeploy. The pipeline deploys a web application to an Auto Scaling group. Recently, a deployment failed because the build output exceeded the CodeDeploy deployment limit for the number of files. The developer needs to prevent this issue in the future. What should the developer do?

Accepted Answer

Modify the buildspec.yml to compress the build output.. The CodeDeploy file count limit applies to the number of files extracted from the deployment archive. By compressing the build output into a single archive (e.g., a tar.gz file), the number of files in the archive is reduced to one, thereby staying within the limit. After extraction, the original files are restored, but the limit is checked on the archive contents, not the extracted files. This approach effectively bypasses the file count limit.

Answer

Use AWS CodeStar to manage the pipeline.

Answer

Increase the instance size in the Auto Scaling group to handle more files.

Answer

Store the build output in an S3 bucket and modify the CodeDeploy deployment to pull the archive from S3.

Question 9

A company is using AWS CodeBuild to compile and test a Java application. The build takes 15 minutes, but the company wants to reduce build time by caching dependencies. Which file should the developer modify to enable caching in the build project?

Accepted Answer

buildspec.yml. The buildspec.yml file can include a 'cache' section to specify paths to cache, such as the Maven local repository (~/.m2). Option A is incorrect because the CodeBuild console settings are not a file; the question specifically asks which file to modify. Option B is incorrect because pom.xml is a Maven project file used for dependency management, not for CodeBuild caching configuration. Option C is incorrect because buildspec.json is not the standard filename; CodeBuild expects buildspec.yml or buildspec.yaml.

Answer

CodeBuild console settings

Answer

pom.xml

Answer

buildspec.json

Question 10

A developer is deploying a microservice to Amazon ECS using Fargate. The service needs to be accessible from the internet via an Application Load Balancer. The developer creates the ECS service with a network load balancer by mistake. What is the minimal change required to fix the deployment?

Accepted Answer

Delete the ECS service and recreate it with an ALB.. Once an Amazon ECS service is created with a load balancer configuration, that configuration is immutable. You cannot update the service to point to a different load balancer or target group. Therefore, the only way to switch from a Network Load Balancer (NLB) to an Application Load Balancer (ALB) is to delete the existing ECS service and recreate it with the correct ALB configuration.

Answer

Create a new target group for the ALB and update the ECS service to use it.

Answer

Update the ECS service to point to the ALB listener.

Answer

Change the existing target group to use ALB protocol.

Question 11

A developer is using AWS OpsWorks for Chef Automate to manage a stack. The developer needs to deploy a new application version to existing instances. Which OpsWorks feature should the developer use?

Accepted Answer

Recipes. To resolve the technology contamination and terminology mismatch, the stem should refer to 'AWS OpsWorks Stacks' instead of 'AWS OpsWorks for Chef Automate'. In AWS OpsWorks Stacks, you use Chef Recipes (specifically associated with the Deploy lifecycle event) to deploy new application versions to existing instances.

Answer

Custom JSON

Answer

Stacks

Answer

Layers

Question 12

A developer is using AWS CodeDeploy to deploy an application to an Amazon EC2 Auto Scaling group. The deployment fails because the CodeDeploy agent on the instances is not running. Which TWO steps should the developer take to resolve this issue? (Choose TWO.)

Accepted Answer

Install the CodeDeploy agent on the instances.. The immediate cause of the failure is that the CodeDeploy agent is not running on the instances, so the developer must ensure the agent is actually installed on those instances (option B) — without the agent binary present, no deployment lifecycle events can be executed. Once installed, the agent must be started as a service (option C), since CodeDeploy communicates with the agent over HTTP on port 443 (or 80) and a stopped agent will not poll for or execute deployment instructions. Option A is not the fix here because an IAM instance profile granting CodeDeploy permissions is necessary for the agent to call CodeDeploy APIs, but it does not install or start the agent, and the scenario already states the agent is not running. Option D is irrelevant because rebooting does not install or start the CodeDeploy agent. Option E is a good preventive practice for future instances via launch configuration user data, but it does not resolve the current running instances where the agent is not running.

Answer

Attach an IAM role to the instances that allows CodeDeploy actions.

Answer

Reboot the instances.

Answer

Add a script in the Auto Scaling group's launch configuration user data to install the agent.

Question 13

A company is deploying a microservices-based application on Amazon ECS using Fargate. The application consists of three services: frontend, backend, and database. The database service uses Amazon Aurora Serverless. The frontend and backend services are deployed as separate ECS services. The company uses AWS CodePipeline for CI/CD. Each service has its own CodePipeline pipeline that builds a Docker image and pushes it to Amazon ECR, then updates the ECS service with the new image. Recently, the backend service deployment started causing intermittent errors. After investigation, the developer found that the backend service is being updated while the frontend service is still pointing to the old backend version, causing API incompatibility. The developer needs to ensure that the backend service is updated before the frontend service, and that both are updated atomically. The developer also wants to automate the update process using CodePipeline. What should the developer do?

Accepted Answer

Create a single pipeline with separate stages: first deploy backend, then after successful deployment, deploy frontend.. A single CodePipeline with sequential stages (backend deploy stage followed by frontend deploy stage) enforces ordering and makes the release atomic from the pipeline's perspective — the frontend stage only runs after the backend stage succeeds. This directly addresses the API incompatibility caused by the frontend being updated while the backend is still on the old version. CodePipeline natively supports multiple deploy actions across stages, so no external orchestration is needed.

Answer

Add a manual approval step between the backend and frontend pipelines.

Answer

Create a single pipeline that deploys both services simultaneously by updating both ECS services in a single CodeDeploy deployment.

Answer

Configure the frontend pipeline to trigger after the backend pipeline completes using Amazon CloudWatch Events.

Question 14

A company deploys a serverless application using AWS SAM. The application includes an API Gateway REST API and multiple Lambda functions. The developer wants to deploy a new version of the API with a canary release strategy, sending 10% of traffic to the new version initially. Which SAM template configuration should the developer use?

Accepted Answer

Set Type: Canary in the DeploymentPreference of the Lambda function and add CanarySetting: { Percent: 10 } under DeploymentPreference.. To implement a canary release strategy for a Lambda function using AWS SAM, you must configure the `DeploymentPreference` property under the `AWS::Serverless::Function` resource. AWS SAM integrates with AWS CodeDeploy to manage the traffic shifting. You must specify a predefined CodeDeploy configuration for the `Type` property, such as `Canary10Percent5Minutes` (which routes 10% of traffic to the new version for 5 minutes before shifting 100% of traffic). Additionally, you must specify the `AutoPublishAlias` property on the Lambda function, which tells SAM to create an alias and detect new deployments to trigger the CodeDeploy traffic shifting. Custom percentages like `Percent: 10` or `Type: Canary` are not valid configurations for Lambda deployment preferences in SAM.

Answer

Set CanarySetting: { Percent: 10 } in the API Gateway resource's properties.

Answer

Set Type: Canary and TrafficShiftType: Canary in the DeploymentPreference of the Lambda function.

Answer

Set Type: Canary in the DeploymentPreference of the Lambda function and add a Percentage: 10 property.

Question 15

A developer is deploying a web application using AWS Elastic Beanstalk. The application requires a custom platform that is not provided by Elastic Beanstalk. The developer has created a custom platform using the Packer tool and has stored the platform artifacts in an Amazon S3 bucket. Which TWO steps are necessary to use this custom platform in Elastic Beanstalk? (Choose TWO.)

Accepted Answer

Define a custom platform version in the Elastic Beanstalk environment's configuration using a platform definition file.. Option A is correct because Elastic Beanstalk custom platforms are registered by supplying a platform definition file (platform.yaml) that declares the platform version, and this definition is used when creating the custom platform version in the environment's configuration. Option D is correct because once the custom platform version is created, the environment must reference that specific platform version by its ARN (for example, arn:aws:elasticbeanstalk:region:account:platform/name/version) in the environment configuration so Elastic Beanstalk knows which custom platform to launch. Option B is incorrect because there is no 'Custom' platform setting that accepts an S3 URL directly; custom platforms are registered as platform versions, not selected via an S3 artifact URL. Option C is incorrect because a Dockerfile defines a Docker-based application/platform on the standard Docker platform, not a Packer-built custom platform. Option E is incorrect because the Packer template is used locally with the Packer tool to build the platform artifacts; it is not uploaded to the Elastic Beanstalk console to register the platform.

Answer

Set the environment's platform to 'Custom' and provide the S3 URL of the platform artifacts.

Answer

Create a Dockerfile in the application source bundle to define the custom platform.

Answer

Upload the Packer template to the Elastic Beanstalk console.