DVA-C02 Deployment Practice Test 9 — 15 Questions

Question 1

A DevOps engineer is implementing a blue/green deployment for a microservice running on Amazon ECS with Fargate. The service is fronted by an Application Load Balancer. During deployment, the new task set fails health checks, but the deployment does not automatically roll back. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ECS service deployment controller is set to 'ECS' instead of 'CODE_DEPLOY'.. For blue/green deployments on ECS, you must specify a deployment controller type of 'CODE_DEPLOY' to use CodeDeploy and enable automatic rollback. If the controller is 'ECS' (the default), the deployment is managed by ECS and does not support automatic rollback on health check failures in blue/green mode. Option B is wrong because ECS does roll back if health checks fail when using ECS deployment controller with rolling update, but not for blue/green. Option C is wrong because CodeDeploy is not used if deployment controller is not CODE_DEPLOY. Option D is wrong because health check grace period delays health checks but does not prevent rollback if checks fail after grace period.

Answer

The CodeDeploy application and deployment group are not configured for automatic rollback.

Answer

The health check grace period is set too high.

Answer

The ECS service is configured with a 'minimum healthy percent' of 100 percent.

Question 2

A team uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that includes an Amazon RDS DB instance. During deployment, the stack creation fails because the DB instance creation times out. The team wants to ensure that subsequent stack creation attempts do not recreate the DB instance from scratch but instead continue from the failed state. Which CloudFormation feature should they use?

Accepted Answer

Use a CloudFormation custom resource to check for an existing DB instance and create it only if it does not exist.. When a CloudFormation stack creation fails, by default CloudFormation rolls back and deletes any resources that were created. To avoid recreating a resource like an RDS DB instance from scratch on subsequent attempts, you can use a custom resource that checks for the existence of the DB instance. If the instance already exists, the custom resource can return success without creating a new one, effectively allowing the stack creation to continue from where it left off. Options A, B, and C do not solve the problem: WaitConditions (A) only pause creation but do not prevent rollback; separate stacks with Fn::ImportValue (B) avoid recreation but the question asks for a feature to continue from the failed state, not to manage dependencies; stack policies (C) protect resources during updates, not during initial creation.

Answer

Use a CloudFormation WaitCondition to pause stack creation until the DB instance is available.

Answer

Create the DB instance using a separate CloudFormation stack and reference it using Fn::ImportValue.

Answer

Apply a stack policy that prevents the DB instance from being deleted during stack updates.

Question 3

A developer is using AWS SAM to deploy a serverless application. The SAM template defines an API Gateway REST API and several Lambda functions. During deployment, the developer receives an error: 'Resource creation cancelled' for the API Gateway resource. The developer has sufficient IAM permissions. What is the MOST likely cause?

Accepted Answer

A stack policy is preventing the creation of the API Gateway resource.. When a CloudFormation deployment fails, the resource that encountered the actual error will show a specific failure reason (e.g., an IAM permission issue, a limit exceeded, or a configuration error). Any other resources that were in the process of being created or were waiting to be created are cancelled as the stack rolls back, displaying the status reason 'Resource creation cancelled'. Therefore, if the API Gateway resource shows 'Resource creation cancelled', it means another resource in the template (such as a Lambda function) failed to create.

Answer

The AWS account has reached the limit of API Gateway REST APIs.

Answer

The SAM template has a syntax error in the YAML file.

Answer

The SAM template does not include an AWS::Serverless::Api resource.

Question 4

A company uses AWS CodeDeploy to deploy an application to EC2 instances. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group consists of 4 EC2 instances. The deployment configuration is 'CodeDeployDefault.OneAtATime'. The CodeDeploy agent logs on the failed instance show: 'Error: Script at specified location: scripts/install_dependencies.sh failed with exit code 1.' What should the developer do to resolve this issue?

Accepted Answer

Review the install_dependencies.sh script for errors and correct them.. The error message from CodeDeploy indicates that the deployment failed because too many instances failed due to a script error. The CodeDeploy agent logs on the failed instance show that the script 'scripts/install_dependencies.sh' failed with exit code 1. This indicates a bug in the script. The correct action is to review and fix the script. Option A is incorrect because changing the deployment configuration to 'CodeDeployDefault.AllAtOnce' would not fix the script error and could cause all instances to fail simultaneously. Option C is incorrect because reinstalling the CodeDeploy agent does not fix a script error. Option D is incorrect because increasing the number of EC2 instances does not resolve the script issue.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce'.

Answer

Reinstall the CodeDeploy agent on the failed instance.

Answer

Increase the number of EC2 instances in the deployment group.

Question 5

A developer is deploying a web application using AWS Elastic Beanstalk. The application experiences high traffic during peak hours. The developer wants to ensure that the environment can scale out quickly without manual intervention. Which Elastic Beanstalk configuration should be used?

Accepted Answer

Configure Auto Scaling triggers based on CloudWatch alarms.. Elastic Beanstalk integrates with Auto Scaling to automatically adjust the number of EC2 instances based on demand. By configuring Auto Scaling triggers that respond to CloudWatch alarms (e.g., CPU utilization > 70%), the environment can scale out quickly and without manual intervention during peak hours.

Answer

Use a scheduled scaling action to increase capacity during peak hours.

Answer

Manually add EC2 instances during peak hours.

Answer

Set the environment to use a fixed number of EC2 instances.

Question 6

A developer deploys a new version of an AWS Lambda function using the AWS CLI. The deployment fails with a 'ResourceConflictException' error. What is the most likely cause?

Accepted Answer

Another deployment is currently in progress for the same Lambda function.. The 'ResourceConflictException' error in AWS Lambda occurs when an operation conflicts with another operation in progress. The most common cause is attempting to update the Lambda function's code while another deployment is already in progress (option D). Options A, B, and C lead to different errors: an incorrect handler name causes an 'InvalidParameterValueException', missing IAM permissions cause an 'AccessDeniedException', and a low memory limit does not cause a conflict but may result in performance issues or an error during invocation, not deployment.

Answer

The function's handler name is incorrect in the deployment package.

Answer

The Lambda function's IAM role is missing necessary permissions.

Answer

The Lambda function's memory limit is set too low for the deployment package.

Question 7

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails, and the rollback is triggered. However, the rollback also fails. What is a likely cause?

Accepted Answer

The rollback deployment uses an AppSpec file that references a lifecycle hook that does not exist in the current environment.. A rollback in AWS CodeDeploy uses the previous version's AppSpec file. If that file references a lifecycle hook (e.g., an AfterInstall script) that no longer exists in the current environment—such as a deleted script file or missing directory—the rollback will fail. Option B is incorrect: a misconfigured target group would affect load balancing but does not cause a rollback deployment to fail. Option C is incorrect: if the S3 bucket were missing, the original deployment would have failed, and rollback would use the previously deployed artifact (still available), not the missing bucket. Option D is incorrect: insufficient capacity would prevent the original deployment or rollback from starting, but the scenario describes a deployment that succeeded initially and then rolled back, so capacity was sufficient.

Answer

The target group for the load balancer is not properly configured.

Answer

The Amazon S3 bucket containing the deployment artifacts is missing.

Answer

The Auto Scaling group does not have sufficient capacity to run the rollback.

Question 8

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to deploy updates to the production environment gradually and automatically roll back if health checks fail. Which AWS service and deployment configuration should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment and a CloudWatch alarm to trigger automatic rollback.. AWS CodeDeploy supports canary deployments, which allow gradual traffic shifting to a new version, and can be configured with CloudWatch alarms to automatically roll back if health checks fail. Option A is incorrect because CloudFormation blue/green deployments do not natively support automatic rollback based on health checks; rollback requires manual intervention or custom scripting. Option B is incorrect because Elastic Beanstalk rolling updates update instances in batches but do not support canary-based traffic shifting or automatic rollback based on CloudWatch alarms. Option D is incorrect because CodePipeline is a CI/CD orchestration service that does not directly handle deployment strategies or health check-based rollbacks; it relies on deployment services like CodeDeploy for that functionality.

Answer

Use AWS CloudFormation with a blue/green deployment and a CloudWatch alarm to trigger rollback.

Answer

Use AWS Elastic Beanstalk with a rolling update and a CloudWatch alarm to trigger rollback.

Answer

Use AWS CodePipeline with a manual approval step and a CloudWatch alarm to trigger rollback.

Question 9

A company is deploying a critical application using AWS CloudFormation. The stack creation fails with a 'ROLLBACK_COMPLETE' status. The engineer wants to troubleshoot the failure without deleting the stack. What should the engineer do?

Accepted Answer

Use the 'aws cloudformation describe-stack-events' command to view the error messages.. The 'aws cloudformation describe-stack-events' command retrieves the events for the stack, including error messages that caused the rollback. This allows the engineer to troubleshoot without deleting the stack. Option A is incorrect because a change set is used to preview changes, not to view rollback errors. Option B is incorrect because the '--on-failure DO_NOTHING' option is only available during stack creation and does not prevent rollback. Option D is incorrect because the '--disable-rollback' flag prevents rollback on failure, but the stack already failed and rolled back; deleting and recreating is unnecessary.

Answer

Use the 'aws cloudformation create-change-set' command with a rollback trigger.

Answer

Recreate the stack using the '--on-failure DO_NOTHING' option.

Answer

Delete the stack and recreate it with the '--disable-rollback' flag.

Question 10

A developer is using AWS CodeBuild to compile and test code. The build phase fails with the error: 'BUILD_FAILED: Error: No such file or directory.' What is the most likely cause?

Accepted Answer

The buildspec.yml file references a file or directory that does not exist in the source code.. The error 'No such file or directory' indicates that the build process is trying to access a file or directory that does not exist in the source code, typically due to an incorrect path in the buildspec.yml file. Option A is incorrect because a network timeout would produce a different error (e.g., 'Connection timed out'). Option C is incorrect because insufficient IAM permissions would result in an 'Access Denied' error, not a file not found error. Option D is incorrect because missing environment variables would cause errors related to undefined variables, not file not found.

Answer

The build environment has a network timeout when accessing external dependencies.

Answer

The IAM role for CodeBuild does not have permissions to access the source repository.

Answer

The build environment does not have the required environment variables set.

Question 11

A company is implementing a CI/CD pipeline for a containerized application using Amazon ECS and AWS CodePipeline. The team wants to ensure zero-downtime deployments. Which THREE strategies should the team implement? (Choose THREE.)

Accepted Answer

Use a blue/green deployment strategy with an Application Load Balancer.. Options A, C, and D are correct. A blue/green deployment with an ALB (A) switches traffic after new tasks are healthy, ensuring zero downtime. ECS service auto scaling (C) maintains the desired count during deployment, preventing scale-down. A health check grace period (D) allows new tasks time to become healthy before being considered unhealthy. Option B (rolling update with 100% batch) would replace all tasks at once, causing downtime. Option E (stop all tasks before starting new ones) also causes downtime.

Answer

Use a rolling update with a fixed batch size of 100% of tasks.

Answer

Stop all existing tasks before starting new tasks.

Question 12

A developer is using AWS SAM to deploy a serverless application. The developer wants to enable canary deployments for the Lambda function. Which TWO resources must be configured in the SAM template? (Choose TWO.)

Accepted Answer

DeploymentPreference property on the AWS::Serverless::Function resource.. The `DeploymentPreference` property on the `AWS::Serverless::Function` resource enables canary deployments by specifying a deployment strategy (e.g., `Canary10Percent5Minutes`). This tells AWS SAM to use AWS CodeDeploy to shift traffic gradually to the new Lambda version, allowing you to monitor for errors before full rollout. Without this property, SAM defaults to an all-at-once deployment, which does not support canary traffic shifting.

Answer

The function's CodeUri property pointing to the deployment package.

Answer

An event source mapping for the function.

Answer

The function's alias resource with a routing configuration.

Question 13

A developer needs to deploy a new version of a Lambda function that uses environment variables for database credentials. Which AWS service should be used to securely store and retrieve the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the best choice because it is designed specifically for securely storing secrets like database credentials and offers automatic rotation. Option C (AWS Systems Manager Parameter Store) can store secrets but lacks automatic rotation and is not as feature-rich for secret management. Option A (DynamoDB) and Option B (S3) are not intended for secret storage and lack native secret management capabilities such as rotation and fine-grained access control for secrets.

Answer

Amazon DynamoDB with encryption at rest

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store

Question 14

Which TWO actions should a developer take to minimize downtime when deploying a new version of a production application running on Amazon ECS with Fargate?

Accepted Answer

Configure the ECS service to use a blue/green deployment with CodeDeploy. Blue/green deployments with AWS CodeDeploy allow you to create a new 'green' environment alongside the existing 'blue' environment, route traffic gradually, and instantly roll back if issues arise. This minimizes downtime by ensuring the old version remains fully available until the new version passes health checks and traffic is fully shifted.

Answer

Delete the existing service and recreate it with the new task definition

Answer

Update the target group health check settings to a more lenient threshold

Answer

Stop all running tasks and then start new tasks with the updated image

Question 15

A developer uses CodePipeline to deploy a new task definition to an ECS service. The pipeline fails with an access denied error when updating the service. Which missing permission is the most likely cause?

Accepted Answer

Missing iam:PassRole permission for the task execution role used by the new task definition. The error occurs when CodePipeline attempts to update an ECS service with a new task definition. The `ecs:UpdateService` action requires the caller to have the `iam:PassRole` permission for the task execution role specified in the new task definition. If the pipeline's IAM role does not include `iam:PassRole` for that specific role, the API call fails with an access denied error. This is the most likely missing permission because the pipeline must pass the task execution role to ECS when updating the service. Option A correctly identifies this missing permission.

Answer

Missing ecs:UpdateService permission for the service resource

Answer

Missing ecs:DescribeServices permission

Answer

Missing ecs:RegisterTaskDefinition permission for the new task definition