DVA-C02 Deployment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create one ECS service with both containers in the same task definition, but only expose the web server port.

  Why it's wrong here

  If both containers are defined within the same task definition and managed by a single ECS service, they will always be deployed together on the same underlying compute resource (EC2 instance or Fargate task). This tightly couples their lifecycle and scaling, preventing independent scaling of the web server and worker components based on their individual load. Furthermore, placing this single task in a public subnet to expose the web server would inadvertently expose the worker container to the public internet, which is a significant security risk and poor architectural practice for backend processing.

• ✓

  Create two separate ECS services, each with its own task definition, and place the web server in a public subnet with the worker in a private subnet.

  Why this is correct

  This approach correctly leverages ECS services for independent lifecycle management and scaling of distinct application components. By defining separate task definitions and services for the web server and worker, each can be scaled independently based on its specific load requirements, optimizing resource utilization. Placing the web server service in a public subnet, typically behind an Application Load Balancer, allows it to serve internet traffic, while the worker service in a private subnet ensures it remains isolated from direct public access, enhancing security and adhering to best practices for backend components.

• ✗

  Create one ECS service with two tasks, each containing one container.

  Why it's wrong here

  An ECS service is designed to manage a desired count of tasks based on a *single* specified task definition. Therefore, the concept of "one ECS service with two tasks, each containing one container" implies that the service would be running two instances of the same task definition, or it fundamentally misunderstands how services and task definitions relate. Even if it were possible to configure a single service to manage tasks from different task definitions, that service would still apply uniform scaling policies and network configuration to all its managed tasks, preventing independent scaling or distinct subnet placement for the web server and worker components.

• ✗

  Create one ECS service with two containers in the same task, and use a service discovery to expose the worker.

  Why it's wrong here

  While AWS Cloud Map service discovery provides internal DNS resolution for services, it does not address the fundamental architectural issues of placing both containers in the same task definition within a single ECS service. This configuration still forces the web server and worker to scale together and share the same network placement. Consequently, if the task is placed in a public subnet to expose the web server, the worker container would also be exposed, regardless of service discovery, which is intended for internal communication, not external exposure or security segmentation.