DVA-C02 Deployment Practice Test 8 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. They need to update a stack that includes an Amazon RDS DB instance. To minimize downtime, they want to perform a rolling update. Which THREE properties must be set in the CloudFormation template?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeletionPolicy attribute set to Snapshot. Rolling updates are not supported for AWS::RDS::DBInstance in CloudFormation. Instead, to minimize downtime during an RDS update, you should use a replacement update strategy with the DeletionPolicy attribute set to Snapshot to preserve data from the old instance. Options A, B, and C apply to Auto Scaling groups, not RDS. Option E (UseOnlineResizing) is not a valid CloudFormation attribute.

Answer

CreationPolicy attribute with ResourceSignal

Answer

UpdatePolicy attribute with AutoScalingReplacingUpdate

Answer

UpdatePolicy attribute with AutoScalingRollingUpdate

Answer

UpdatePolicy attribute with UseOnlineResizing

Question 2

A startup is deploying a Node.js application using AWS Elastic Beanstalk. They have configured the environment to use a load-balanced, auto-scaled environment with a minimum of 2 instances and a maximum of 4. The application connects to an Amazon RDS MySQL database. After a successful deployment, users report that the application is intermittently returning errors. The developer checks the Elastic Beanstalk logs and finds that the application is timing out when connecting to the database. The developer also notices that the database connection string is hardcoded in the application code. What is the most likely cause of the intermittent errors?

Accepted Answer

The RDS instance has reached its maximum number of concurrent connections because the application instances are not using connection pooling.. The hardcoded connection string means all instances use the same database user and no connection pooling is implemented. As the auto-scaling group scales up, multiple instances open many concurrent connections, potentially exceeding the RDS instance's max_connections limit (default for db.t2.micro is 66). This causes intermittent timeout errors when connections are refused. Option A is incorrect because the security group issue would cause persistent failures, not intermittent. Option C is incorrect because the bug would cause consistent errors, not intermittent timeouts. Option D is incorrect because Multi-AZ is for high availability, not connection limits.

Answer

The security group for the RDS instance does not allow inbound traffic from the Elastic Beanstalk environment's security group.

Answer

The application code has a bug that causes the database connection to be closed prematurely.

Answer

The RDS instance is not configured for Multi-AZ deployment, causing failover issues.

Question 3

A company is using AWS CodePipeline to automate the deployment of a microservices application to Amazon ECS. The pipeline has the following stages: Source (GitHub), Build (CodeBuild), Deploy (ECS). The Deploy stage uses an ECS task definition and updates the service. Recently, the pipeline failed at the Deploy stage with the error: 'The task definition family is inactive.' The developer checks the ECS console and sees that the task definition family exists but is inactive. The developer also notices that the pipeline uses a parameter 'TASK_DEFINITION_FAMILY' with the value 'my-app'. What is the most likely cause?

Accepted Answer

The pipeline is referencing the task definition family name without a specific revision number, and the latest revision is inactive.. The error 'The task definition family is inactive' indicates that the pipeline is using the task definition family name 'my-app' without specifying a revision number. When a task definition family is marked as inactive, it means the latest revision in that family is inactive. CodePipeline requires a specific active revision number to deploy successfully. Therefore, the most likely cause is that the pipeline is referencing only the family name, and the latest revision is inactive. Option D correctly identifies this issue. Option A is incorrect because the family exists. Option B is incorrect because environment variables are unrelated to the error. Option C is incorrect because the pipeline's IAM role permissions are not the issue; the error is about the task definition state, not permissions.

Answer

The task definition family 'my-app' does not exist in the ECS cluster.

Answer

The environment variables in the task definition are not correctly set.

Answer

The IAM role for ECS does not have permission to register new task definitions.

Question 4

A large enterprise is deploying a critical application across multiple AWS regions using AWS CodePipeline and AWS CodeDeploy. The application runs on EC2 instances in an Auto Scaling group. The deployment uses a blue/green strategy. During a cross-region deployment, the pipeline fails in the secondary region with the error 'The deployment group does not exist.' The developer confirms that the deployment group exists in the primary region and has been replicated via AWS CloudFormation StackSets. The developer also checks that the StackSet is successfully deployed in the secondary region. What is the most likely cause?

Accepted Answer

The CodePipeline in the secondary region references the deployment group ARN from the primary region instead of the secondary region.. The CodePipeline in the secondary region is likely misconfigured with the deployment group identifier from the primary region (e.g., using the primary deployment group's ARN as the deployment group name). This causes CodeDeploy to search for a deployment group with that exact string in the secondary region and fail. The pipeline should reference the deployment group by its local name (ApplicationName/DeploymentGroupName) in the secondary region, not by an ARN.

Answer

The deployment group name is case-sensitive and differs between regions.

Answer

The CodePipeline in the secondary region is not configured with the correct source stage.

Answer

The IAM role for CodeDeploy in the secondary region does not have cross-region permissions.

Question 5

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an AWS Lambda function and an Amazon API Gateway REST API. The developer runs 'sam deploy' but the deployment fails with the error: 'Error: Security Constraints Not Satisfied'. The developer checks the IAM policies and confirms that the Lambda function has the necessary permissions. What is the most likely cause?

Accepted Answer

The API Gateway endpoint is configured with 'OPEN' access without any authorization.. SAM enforces security constraints during deployment. If the API Gateway endpoint is configured with 'OPEN' access (i.e., no authorization), the deployment fails with 'Security Constraints Not Satisfied'. Option A is incorrect because SAM does not require a Lambda function to be in a VPC. Option B is incorrect because SAM can automatically create an S3 bucket. Option D is incorrect because memory size does not cause this error.

Answer

The Lambda function is not configured to run inside a VPC.

Answer

The SAM template does not specify an S3 bucket for the deployment artifacts.

Answer

The Lambda function's memory size is set too high.

Question 6

A company uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. They have a CodePipeline that deploys the built artifacts to an Auto Scaling group using CodeDeploy. Recently, the build stage started failing with the error: 'BUILD FAILED: Could not resolve dependencies for project'. The developer checks the buildspec.yml and sees that it uses Maven to download dependencies from a private repository. The developer also notices that the build environment is a managed Docker image. What is the most likely cause?

Accepted Answer

The build environment does not have network access to the private Maven repository because it is not configured with a VPC.. A managed Docker image may not have network access to a private repository if it's not configured with a VPC or NAT gateway. Option A is wrong because CodeBuild supports private repositories with proper network configuration. Option C is wrong because the buildspec is correct. Option D is wrong because the error is about dependency resolution, not compilation.

Answer

The CodeBuild project does not have the necessary IAM permissions to access the private Maven repository.

Answer

The buildspec.yml has a syntax error in the 'phases' section.

Answer

The Java compiler version is incompatible with the project.

Question 7

A developer is deploying an AWS Lambda function that processes data from an Amazon Kinesis stream. The function must be idempotent and handle duplicate records. The developer notices that the same record is being processed multiple times. What is the most likely cause of this issue?

Accepted Answer

The Kinesis data stream's retention period is too long, causing old records to be reprocessed.. When an AWS Lambda function processing a Kinesis stream fails or times out, Lambda retries the entire batch of records until they succeed or expire. This head-of-line blocking causes the stream's IteratorAge metric to increase (not decrease) because the consumer is stuck on the failing batch while new records continue to arrive. This retry behavior results in the same records being processed multiple times.

Answer

The function's reserved concurrency is set too low, causing invocations to be throttled and retried.

Answer

The batch size is set too high, causing the function to process records in multiple batches.

Answer

The Kinesis stream's iterator age is too low, causing the function to reprocess records after a failure.

Question 8

A developer is deploying a serverless application using AWS SAM. The application consists of an API Gateway endpoint that triggers an AWS Lambda function. The developer wants to enable canary deployments to gradually shift traffic to a new Lambda version. Which SAM resource attribute should the developer configure?

Accepted Answer

AutoPublishAlias and DeploymentPreference. `AutoPublishAlias` automatically creates and updates a Lambda alias (e.g., `live`) that points to the latest version of your function, while `DeploymentPreference` enables canary, linear, or all-at-once traffic shifting between the old and new alias versions. Together, they allow gradual traffic migration to a new Lambda version without manual alias management.

Answer

ReservedConcurrentExecutions

Answer

Timeout

Answer

ProvisionedConcurrency

Question 9

A company uses AWS Elastic Beanstalk to deploy a web application. The developer wants to update the environment's configuration, such as instance type and environment variables, without causing downtime. Which deployment policy should the developer use?

Accepted Answer

Rolling. The Rolling deployment policy is the correct choice because it updates instances in batches, replacing a subset of instances with the new configuration while keeping the rest running, thereby avoiding downtime. This allows environment variables and instance types to be changed incrementally without taking the entire application offline, as each batch is updated only after the previous batch remains healthy.

Answer

All at once

Answer

Blue/green

Answer

Immutable

Question 10

A company is deploying a containerized application on Amazon EKS. The developer wants to automate the deployment process using a CI/CD pipeline that builds a Docker image, pushes it to Amazon ECR, and updates the Kubernetes deployment. Which tool should the developer use to update the Kubernetes deployment?

Accepted Answer

AWS CodeBuild with a buildspec that runs kubectl commands. To automate the deployment of a containerized application to Amazon EKS within a CI/CD pipeline, AWS CodeBuild is the ideal service. A buildspec.yml file is configured in CodeBuild to install the AWS CLI and kubectl, authenticate with the EKS cluster, and run the necessary kubectl commands (such as `kubectl apply` or `kubectl set image`) to update the deployment with the new container image from Amazon ECR.

Answer

kubectl set image command

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation with a custom resource

Question 11

A developer is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. The pipeline must automatically build and deploy the application when changes are pushed to a CodeCommit repository. The application uses AWS CloudFormation for infrastructure provisioning. Which TWO actions should the developer include in the pipeline?

Accepted Answer

Use AWS CodeBuild to run unit tests and package the application.. AWS CodeBuild can compile source code, run unit tests, and produce deployment artifacts, which is a standard build phase in a CI/CD pipeline. Option E is correct because AWS CloudFormation is the native AWS service for provisioning and updating infrastructure as code, making it the appropriate deployment action for a serverless application defined in templates.

Answer

Use AWS CodeDeploy to deploy the application to EC2 instances.

Answer

Use AWS CodeCommit as a deployment action.

Answer

Use AWS Lambda to run integration tests.

Question 12

A company is using AWS CloudFormation to deploy and manage infrastructure. The developer wants to implement a CI/CD pipeline that automatically deploys CloudFormation stacks. The pipeline should be able to create, update, and delete stacks. Which THREE AWS services should the developer use together?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can be used as a build and test action within a pipeline to run custom scripts (e.g., using the AWS CLI) that create, update, or delete CloudFormation stacks. In a CI/CD pipeline, CodeBuild can execute `aws cloudformation deploy` or `aws cloudformation delete-stack` commands, providing the flexibility to handle stack operations beyond simple template deployment.

Answer

AWS CodeDeploy

Answer

AWS Lambda

Question 13

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance in a CodeDeploy deployment group. The deployment fails with 'Access Denied' when the CodeDeploy agent tries to register the application revision. What is the most likely cause?

Accepted Answer

The policy does not include the 'codedeploy:PutApplicationRevision' action.. The CodeDeploy agent requires the `codedeploy:RegisterApplicationRevision` permission to register an application revision. The policy in the exhibit omits this action, causing the 'Access Denied' error. Note that the option text uses 'PutApplicationRevision' which is an older or alternative name for the same permission in some contexts; the core issue is the missing permission required for revision registration.

Answer

The resource is set to '*' which is not allowed for CodeDeploy actions.

Answer

The role is not associated with the CodeDeploy service.

Answer

The policy is missing an explicit deny for other actions.

Question 14

Refer to the exhibit. A developer creates this CloudFormation template and tries to deploy it. The deployment fails with 'CREATE_FAILED' for the S3 bucket resource. What is the most likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts. If the bucket name specified in the template is already in use by another account, CloudFormation will fail with CREATE_FAILED for the S3 bucket resource. This is a fundamental requirement of the S3 service, not a template syntax or configuration issue.

Answer

The template does not enable versioning on the bucket.

Answer

The bucket name must be in all lowercase letters.

Answer

The template does not specify a bucket policy.

Question 15

Refer to the exhibit. A developer is troubleshooting a failed CodeDeploy deployment to an EC2 Auto Scaling group. The instance logs show that the 'BeforeInstall' script failed with exit code 1. What should the developer do to resolve the issue?

Accepted Answer

Review the BeforeInstall script for errors and fix them.. The 'BeforeInstall' script failed with exit code 1, which is a generic error indicating the script itself encountered an issue during execution. The developer should review the script for errors, such as syntax mistakes, missing dependencies, or incorrect commands, and fix them. This is the most direct and appropriate action because the failure is explicitly tied to the script's execution, not to infrastructure or permissions.

Answer

Ensure the CodeDeploy agent is installed and running on the instance.

Answer

Verify that the scripts location in the AppSpec file is correct.

Answer

Check that the instance's IAM role has permissions to download the revision.