Courseiva

CCNA Deployment Questions

75 of 169 questions · Page 2/3 · Deployment · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQmedium

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function and an Amazon API Gateway REST API. The developer wants to configure the API Gateway stage to enable logging and set the stage name based on the SAM parameter Stage. In the SAM template, which property of the AWS::Serverless::Api resource should the developer use to set the stage name?

A.StageName
B.DefinitionBody
C.StageDescription
D.EndpointConfiguration
AnswerA

The StageName property within an AWS::Serverless::Api resource in AWS SAM is precisely what defines the name of the Amazon API Gateway deployment stage. This critical property allows developers to specify a logical identifier for a particular deployment, such as Prod, Dev, or Test, which is essential for managing different environments. It frequently leverages SAM parameters, like !Ref Stage, enabling dynamic stage naming based on deployment inputs, ensuring flexibility and reusability across various CI/CD pipelines.

Why this answer

The `StageName` property of the `AWS::Serverless::Api` resource directly sets the stage name for the API Gateway REST API. By using a SAM parameter like `Stage` (e.g., `StageName: !Ref Stage`), the developer can dynamically control the stage name at deployment time. This is the intended and simplest way to configure the stage name in an AWS SAM template.

Exam trap

The trap here is that candidates confuse `StageName` with `StageDescription` (Option C) because both relate to stage configuration, but `StageDescription` only provides metadata and does not control the actual stage identifier used in the API endpoint URL.

How to eliminate wrong answers

Option B (`DefinitionBody`) is wrong because it defines the OpenAPI specification for the API, not the stage name; it can include a `stageName` field within the OpenAPI definition, but that is not the SAM-level property for setting the stage name. Option C (`StageDescription`) is wrong because it provides a description of the stage (e.g., for documentation or tagging), not the stage name itself. Option D (`EndpointConfiguration`) is wrong because it specifies the endpoint type (e.g., REGIONAL, EDGE, PRIVATE) for the API, not the stage name.

Practice this question →
77
MCQhard

An ECS blue/green deployment with CodeDeploy and an Application Load Balancer fails because the replacement task set never receives test traffic. Which configuration should be checked?

A.S3 bucket versioning
B.Lambda provisioned concurrency
C.The test listener and target group mapping in the deployment group
D.DynamoDB TTL
AnswerC

In an AWS CodeDeploy Blue/Green deployment for Amazon ECS, the test listener and its mapping to a new target group are fundamental for validating the new task set (the 'green' environment). CodeDeploy uses this listener to route a small amount of traffic, or traffic from a specific test client, to the new target group associated with the updated application tasks. This crucial step allows for pre-validation and ensures the new application version is healthy and functional before the final production traffic cutover, enabling safe rollouts and easy rollbacks.

Why this answer

In an ECS blue/green deployment with CodeDeploy and an Application Load Balancer, the test listener and its associated target group are responsible for routing test traffic to the replacement task set. If the replacement task set never receives test traffic, the most likely cause is that the test listener is not correctly mapped to the target group in the CodeDeploy deployment group configuration. This mapping ensures that traffic from the test listener is directed to the replacement task set during the deployment lifecycle.

Exam trap

The trap here is that candidates may confuse the test listener with the production listener or assume the issue is with the ALB itself, rather than recognizing that the test listener-to-target-group mapping in the CodeDeploy deployment group is the specific configuration that controls test traffic routing.

How to eliminate wrong answers

Option A is wrong because S3 bucket versioning is unrelated to ECS deployment traffic routing; it is used for object version control and rollback in S3, not for CodeDeploy traffic routing. Option B is wrong because Lambda provisioned concurrency is a feature for managing concurrent execution capacity of Lambda functions, not for ECS task set traffic routing in blue/green deployments. Option D is wrong because DynamoDB TTL (Time to Live) is a feature for automatically expiring items in DynamoDB tables, and it has no role in CodeDeploy or ALB traffic routing.

Practice this question →
78
Multi-Selectmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The developer wants to ensure that the database connection string is not hard-coded in the application code. Which THREE methods can the developer use to pass the connection string securely? (Choose THREE.)

Select 3 answers
A.Read the connection string from Amazon RDS tags.
B.Use AWS Secrets Manager.
C.Use Elastic Beanstalk environment properties.
D.Store the connection string in a configuration file in the application bundle.
E.Use AWS Systems Manager Parameter Store.
AnswersB, C, E

AWS Secrets Manager is purpose-built for this task: it stores the connection string as a secret encrypted by a KMS key, provides fine-grained access control through IAM policies, and natively supports automatic rotation for Amazon RDS credentials. The application can retrieve the secret at runtime using the AWS SDK, and you can even integrate it with Elastic Beanstalk via a custom resource or startup script. This minimizes human exposure and lets you change credentials without rebuilding or redeploying the application.

Why this answer

To pass the database connection string securely without hard-coding it, developers can use AWS Secrets Manager (B) to store and retrieve secrets programmatically, Elastic Beanstalk environment properties (C) to inject configuration into the application environment, and AWS Systems Manager Parameter Store (E) to securely store strings and secrets. Option A is incorrect because RDS tags are not designed for sensitive data like connection strings. Option D is incorrect because storing the connection string in a configuration file within the application bundle would expose it in the source code and deployment package.

Practice this question →
79
Multi-Selecteasy

A developer is deploying an application using AWS Elastic Beanstalk. The developer wants to ensure that the application is highly available and can recover from an AZ failure. Which TWO configurations should be applied? (Choose TWO.)

Select 2 answers
A.Configure the environment to use multiple Availability Zones.
B.Select a larger EC2 instance type.
C.Enable Multi-AZ for the application's Amazon RDS database.
D.Attach an Elastic Load Balancer to the environment.
E.Use a single EC2 instance for simplicity.
AnswersA, D

Setting the Elastic Beanstalk environment to span multiple Availability Zones ensures that EC2 instances are distributed across physically separate data centers within the region. If one Availability Zone experiences an outage, instances in the other zones remain healthy and continue serving traffic, eliminating the risk of a single-AZ failure. Elastic Beanstalk automatically handles this distribution when you configure the environment with subnets in multiple AZs, providing a foundational layer of application-tier redundancy.

Why this answer

Options A and D are correct. A: Deploying to multiple Availability Zones ensures that if one AZ fails, the application remains available. D: An Elastic Load Balancer distributes traffic across instances in multiple AZs, improving fault tolerance.

Option B is incorrect because selecting a larger EC2 instance type increases compute capacity but does not provide AZ redundancy. Option C is incorrect because enabling Multi-AZ for an RDS database improves database availability, but the question asks about application-level high availability; it does not address the compute tier. Option E is incorrect because using a single EC2 instance creates a single point of failure and does not ensure high availability.

Practice this question →
80
MCQeasy

A developer wants to deploy a serverless application using AWS CloudFormation. The application consists of an API Gateway, Lambda functions, and DynamoDB tables. The developer wants to ensure that the stack can be updated without resource interruption when possible. Which CloudFormation feature should the developer use?

A.Use a Lambda alias with a DeploymentPreference update policy
B.Use a ChangeSet to review changes before applying them
C.Use a StackPolicy to protect critical resources
D.Use a Custom Resource to manage updates
AnswerA

CloudFormation's `AWS::Lambda::Alias` resource, when combined with a `DeploymentPreference` update policy, facilitates controlled, gradual traffic shifting between a Lambda function's current version and a newly deployed version. This strategy leverages AWS CodeDeploy to manage the rollout, allowing for canary deployments or linear shifts, which ensures that updates are applied without service interruption by routing traffic incrementally and automatically rolling back if issues are detected.

Why this answer

The `DeploymentPreference` update policy on a Lambda alias enables canary, linear, or all-at-once traffic shifting during stack updates. This allows the developer to update Lambda function versions without interrupting existing invocations, as traffic is gradually routed to the new version while the old version continues to serve requests until the transition completes.

Exam trap

The trap here is that candidates often confuse ChangeSets (which only preview changes) with the actual update mechanism, or they mistakenly think StackPolicies or Custom Resources can control update behavior, when in fact only the `DeploymentPreference` update policy on a Lambda alias provides the traffic-shifting capability needed for uninterrupted updates.

How to eliminate wrong answers

Option B is wrong because a ChangeSet only provides a preview of the changes that will be applied to the stack; it does not prevent resource interruption during the update itself. Option C is wrong because a StackPolicy is used to prevent accidental updates or deletions of specific resources by denying update/delete actions, but it does not control how updates are rolled out to avoid interruption. Option D is wrong because a Custom Resource is used to handle provisioning of resources not natively supported by CloudFormation, not to manage update strategies for Lambda functions.

Practice this question →
81
Multi-Selecteasy

A developer is using AWS CodePipeline to automate deployments. The pipeline has a Source stage using Amazon S3 and a Deploy stage using AWS Elastic Beanstalk. The developer notices that the pipeline fails at the Deploy stage with the error 'The deployment failed because the version of the application to be deployed could not be found.' Which TWO actions should the developer take to resolve this issue?

Select 2 answers
A.Ensure that the S3 bucket and the Elastic Beanstalk environment are in the same AWS region.
B.Make sure the source artifact is a valid zip file containing the application code and environment configuration.
C.Confirm that the S3 object key does not contain special characters.
D.Verify that the S3 bucket name is exactly as specified in the pipeline.
E.Check that the IAM role for CodePipeline has permissions to read from the S3 bucket and deploy to Elastic Beanstalk.
AnswersA, E

Cross-region deployments require additional configuration.

Why this answer

CodePipeline and Elastic Beanstalk must be in the same AWS region for the pipeline to locate the application version. When the Source stage stores the artifact in an S3 bucket in a different region, the Deploy stage cannot find the version in Elastic Beanstalk, which expects the artifact to be in the same region. This cross-region mismatch causes the 'version of the application to be deployed could not be found' error.

Option E is also correct because the IAM role for CodePipeline must have permissions to read from the S3 bucket and to deploy to Elastic Beanstalk. Without these permissions, the pipeline cannot access the artifact or perform the deployment, leading to the 'could not be found' error.

Exam trap

The trap here is that candidates focus on artifact validity or permissions, but the error message 'could not be found' specifically points to a region mismatch or missing version, not a file format or IAM issue.

Practice this question →
82
MCQmedium

A team is using AWS CodeBuild to compile and test code. The build takes longer than expected. The team wants to reduce build times by caching dependencies. Which option should the team use to cache dependencies in CodeBuild?

A.Amazon DynamoDB
B.Amazon EFS
C.Amazon ECR
D.Local caching or Amazon S3 caching
AnswerD

AWS CodeBuild natively supports both local caching and Amazon S3 caching to significantly speed up build times. Local caching stores a cache directory on the build host's file system, reusing dependencies across subsequent builds on the same host. Amazon S3 caching, a more scalable option, uploads and downloads a compressed cache archive to and from an S3 bucket, making the cache available across different build hosts and providing durability and shareability for build dependencies and artifacts.

Why this answer

AWS CodeBuild supports two caching modes: local caching and Amazon S3 caching. Local caching stores dependencies on the build host's local file system, while S3 caching stores them in an S3 bucket. Both options reduce build times by reusing previously downloaded dependencies across builds, avoiding redundant downloads.

Exam trap

The trap here is that candidates may confuse caching mechanisms with storage services like DynamoDB or EFS, or assume that ECR (used for container images) can cache dependencies, when CodeBuild specifically supports only local and S3 caching for dependency reuse.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL database service, not a caching mechanism for build dependencies; it is used for storing structured data, not for caching build artifacts or dependency files. Option B is wrong because Amazon EFS is a scalable file system for use with AWS services and on-premises resources, but it is not a caching option supported by CodeBuild for build dependencies; CodeBuild does not natively integrate with EFS for caching. Option C is wrong because Amazon ECR is a container image registry, used for storing and managing Docker images, not for caching build dependencies; it is unrelated to dependency caching in CodeBuild.

Practice this question →
83
MCQmedium

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint backed by a Lambda function. The developer wants to enable canary deployments to shift 10% of traffic to the new version for 5 minutes before routing all traffic. Which configuration should the developer add to the SAM template?

A.DeploymentPreference with Type: Canary10Percent5Minutes
B.Add a CodeDeploy application and deployment group manually
C.DeploymentPreference with Type: Linear10PercentEvery1Minute
D.DeploymentPreference with Type: AllAtOnce
AnswerA

For serverless applications deployed with AWS SAM, `DeploymentPreference` integrates with AWS CodeDeploy to manage traffic shifting. A `Canary10Percent5Minutes` strategy first routes 10% of traffic to the new Lambda function version for 5 minutes. If no alarms are triggered during this period, CodeDeploy automatically shifts the remaining 90% of traffic to the new version, providing a controlled rollout and minimizing impact from potential issues. This phased approach is ideal for validating new deployments in a production environment.

Why this answer

The `DeploymentPreference` property with `Type: Canary10Percent5Minutes` instructs AWS SAM to use AWS CodeDeploy to shift 10% of traffic to the new Lambda version for 5 minutes, then automatically route the remaining 90% after the canary period ends. This matches the requirement exactly, leveraging SAM's built-in integration with CodeDeploy for canary deployments.

Exam trap

The trap here is that candidates confuse `Canary10Percent5Minutes` with `Linear10PercentEvery1Minute`, thinking both are canary deployments, but only the former holds traffic at 10% for a fixed duration before shifting all at once, while the latter shifts incrementally every minute.

How to eliminate wrong answers

Option B is wrong because manually adding a CodeDeploy application and deployment group is unnecessary and error-prone; AWS SAM automatically creates and manages the CodeDeploy resources when you specify `DeploymentPreference` in the template. Option C is wrong because `Linear10PercentEvery1Minute` shifts traffic in 10% increments every minute, which does not match the requirement of a single 10% shift for 5 minutes before routing all traffic. Option D is wrong because `AllAtOnce` routes 100% of traffic to the new version immediately, bypassing any canary or gradual deployment strategy.

Practice this question →
84
Multi-Selecteasy

Which TWO strategies can be used to reduce the risk of a failed deployment when using AWS CodeDeploy? (Select TWO.)

Select 2 answers
A.Configure automatic rollback based on CloudWatch alarms.
B.Use a canary deployment to shift traffic gradually.
C.Disable health checks to prevent false positives.
D.Require a manual approval step before deployment.
E.Deploy to all instances at once to ensure consistency.
AnswersA, B

When a deployment causes performance degradation or errors, CloudWatch alarms can detect these issues by monitoring key metrics such as error rates, latency, or CPU utilization. Configuring automatic rollback to trigger upon these alarm states ensures that the application quickly reverts to a stable previous version, minimizing the blast radius and user impact of a faulty deployment. This proactive measure significantly reduces the duration of service disruption and enhances reliability.

Why this answer

AWS CodeDeploy can automatically trigger a rollback when a CloudWatch alarm is breached, such as when error rates or latency exceed a threshold. This reduces the risk of a failed deployment by reverting to the last known good state without manual intervention. Option B is correct because a canary deployment shifts a small percentage of traffic to the new version first, allowing you to monitor for issues before routing all traffic, minimizing blast radius.

Exam trap

The trap here is that candidates often confuse manual approval (a pre-deployment gate) with a rollback mechanism, or they mistakenly think disabling health checks reduces false positives, when in fact health checks are critical for detecting failures during deployment.

Practice this question →
85
MCQeasy

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint and a Lambda function. The developer wants to ensure that the Lambda function can be invoked only by the API Gateway and not directly. Which configuration should be used?

A.Configure a VPC endpoint policy that allows only API Gateway.
B.Add a resource-based policy with 'aws:SourceAccount' condition.
C.Add a resource-based policy with 'aws:SourceVpce' condition set to the API Gateway VPC endpoint ID.
D.Add a resource-based policy with 'aws:SourceArn' condition set to the API Gateway ARN.
AnswerD

Adding a resource-based policy with an `aws:SourceArn` condition set to the specific API Gateway ARN is the most effective and secure method to restrict Lambda function invocation. This policy ensures that only requests originating from that particular API Gateway instance (e.g., `arn:aws:execute-api:region:account-id:api-id/*/*`) are authorized to invoke the Lambda function. This fine-grained control prevents unauthorized direct invocations of the Lambda function, enforcing that all traffic must flow through the API Gateway.

Why this answer

Adding a resource-based policy with an `aws:SourceArn` condition set to the API Gateway ARN ensures that the Lambda function can only be invoked by that specific API Gateway. This uses the AWS Identity and Access Management (IAM) condition key to restrict the `lambda:InvokeFunction` action based on the ARN of the invoking resource, preventing direct invocation from other sources like the AWS CLI or SDK.

Exam trap

The trap here is that candidates confuse resource-based policies with VPC-based controls, often selecting `aws:SourceVpce` (Option C) thinking API Gateway invokes Lambda through a VPC endpoint, but API Gateway uses a public endpoint or private integration without a VPC endpoint for Lambda invocation.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint policy controls traffic through a VPC endpoint, not invocation permissions for Lambda; it does not restrict which service can invoke the function. Option B is wrong because `aws:SourceAccount` condition only checks the AWS account ID of the caller, not the specific resource (API Gateway), so any service in the same account could still invoke the function. Option C is wrong because `aws:SourceVpce` condition checks for a VPC endpoint ID, but API Gateway does not use a VPC endpoint for invocation; it uses a public endpoint or a private integration, making this condition ineffective.

Practice this question →
86
Matchingmedium

Match each HTTP status code to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

OK

Created

Bad Request

Forbidden

Internal Server Error

Why these pairings

Correct matches: 200 OK, 404 Not Found, 500 Internal Server Error. Common confusions include mixing 200 and 201, or 404 and 403.

Practice this question →
87
MCQmedium

A CodePipeline source stage should start when code is pushed to a repository, without scheduled polling. Which integration pattern should be used?

A.Manual approval only
B.Event-based trigger from the source provider/EventBridge integration
C.A cron job on an EC2 instance
D.CloudWatch Logs Insights
AnswerB

AWS CodePipeline natively supports event-based triggers from integrated source providers such as AWS CodeCommit, GitHub, and Amazon S3. For CodeCommit, a push to a repository branch generates an event that is published to Amazon EventBridge. An EventBridge rule can then be configured to detect this specific event and automatically invoke the CodePipeline, ensuring the pipeline starts immediately upon a code push, which is the most direct and efficient solution.

Why this answer

AWS CodePipeline can integrate with Amazon EventBridge to listen for repository events (e.g., push events from CodeCommit, GitHub, or Bitbucket) and automatically start the pipeline. This event-driven pattern eliminates the need for scheduled polling, providing near-instantaneous execution when code changes are detected.

Exam trap

The trap here is that candidates may confuse manual approval (a pipeline action) with a trigger mechanism, or assume that CloudWatch Logs Insights can initiate pipeline executions, when in fact only EventBridge or webhook-based integrations provide the required event-driven, polling-free source trigger.

How to eliminate wrong answers

Option A is wrong because manual approval is a gate that pauses pipeline execution for human review, not a mechanism to trigger the pipeline on code push. Option C is wrong because a cron job on an EC2 instance would require custom scripting, polling the repository periodically, and introduces unnecessary complexity, latency, and maintenance overhead compared to a native event-driven integration. Option D is wrong because CloudWatch Logs Insights is a query tool for analyzing log data, not a trigger mechanism for CodePipeline source stages.

Practice this question →
88
Multi-Selecteasy

Which TWO are valid deployment strategies supported by AWS CodeDeploy? (Choose TWO.)

Select 2 answers
A.Immutable deployment
B.In-place deployment
C.Canary deployment
D.All at once deployment
E.Blue/Green deployment
AnswersB, E

In-place deployment is a valid deployment strategy supported by AWS CodeDeploy, where the application on the existing set of EC2 instances or on-premises servers is directly updated. During this process, CodeDeploy stops the application on each instance, deploys the new application revision, and then restarts the application. Traffic is not shifted between different environments; instead, the application files on the active servers are modified in place, potentially causing brief service interruptions on individual instances as they are updated.

Why this answer

AWS CodeDeploy supports in-place deployments (option B) where the application is updated on the existing instances without provisioning new ones. This is a valid deployment strategy that updates the current fleet by stopping and starting the application, and it is one of the two core strategies explicitly documented by AWS.

Exam trap

The trap here is that candidates confuse deployment strategies (in-place and blue/green) with deployment configuration options (like AllAtOnce) or with strategies from other AWS services (like immutable deployments in Elastic Beanstalk), leading them to select 'All at once' or 'Immutable' as valid CodeDeploy strategies.

Practice this question →
89
Multi-Selecthard

A developer is deploying a new version of an AWS Lambda function. The function is behind an API Gateway endpoint. The developer wants to use canary deployments to gradually shift traffic to the new version. Which TWO steps should the developer perform?

Select 2 answers
A.Create a Lambda alias that points to the current version and configure routing to shift a percentage of traffic to the new version.
B.Configure Amazon CloudFront to distribute traffic between two API Gateway endpoints.
C.Update the API Gateway integration to point to the Lambda alias instead of a specific version.
D.Update the Lambda function code and publish a new version.
E.Create a new API Gateway stage for the new version and update DNS.
AnswersA, C

An AWS Lambda alias provides a stable endpoint for your function while allowing you to manage traffic distribution across different versions. By configuring the alias to point to both the current and the new Lambda versions with a weighted routing strategy, a developer can gradually shift a small percentage of traffic to the new version. This enables a controlled canary deployment, allowing for real-time monitoring and quick rollback if issues arise, minimizing impact on users.

Why this answer

Lambda aliases support traffic shifting for canary deployments by allowing you to route a percentage of incoming requests to a new function version while the majority continues to the current version. This is done by configuring the alias's routing configuration with a `RoutingConfig` that specifies the new version and the weight (e.g., 5%) of traffic it should receive. This enables gradual, controlled rollouts without modifying the API Gateway integration endpoint.

Option C is also necessary because the API Gateway integration must point to the Lambda alias (rather than a fixed version) so that the routing configuration on the alias can take effect. Without updating the integration to use the alias, API Gateway would continue to invoke a specific version directly, bypassing the canary routing.

Exam trap

The trap here is that candidates often think canary deployments require separate infrastructure (like CloudFront or multiple stages), but AWS Lambda aliases with routing configuration provide a built-in, serverless-native mechanism for percentage-based traffic shifting without additional services.

Practice this question →
90
Drag & Dropmedium

Drag and drop the steps to set up a custom domain for an API Gateway API in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First have a domain, get a certificate, create custom domain in API Gateway, map to stage, and update DNS.

Practice this question →
91
MCQeasy

An e-commerce platform uses AWS CodePipeline to deploy a web application to an Auto Scaling group behind an Application Load Balancer. The deployment strategy must minimize downtime and allow immediate rollback if the new version fails health checks. Which deployment configuration meets these requirements?

A.Use blue/green deployment with an immutable infrastructure.
B.Use all-at-once deployment to the Auto Scaling group.
C.Use canary deployment shifting 10% traffic for 5 minutes.
D.Use in-place rolling update with a batch size of 50%.
AnswerA

Blue/green deployment with immutable infrastructure creates an entirely new, identical environment (green) with the updated application version, leaving the existing production environment (blue) untouched. Once the green environment passes all health checks and tests, traffic is atomically shifted from blue to green. This strategy ensures zero downtime during deployment and provides an instant rollback capability by simply reverting traffic back to the healthy, unchanged blue environment if any issues arise with the new version.

Why this answer

Blue/green deployment with immutable infrastructure minimizes downtime by running the new version (green) alongside the old (blue) and switching traffic only after health checks pass. If the new version fails, rollback is immediate by routing traffic back to the blue environment without redeploying. AWS CodePipeline supports this via CodeDeploy with a blue/green configuration, ensuring zero-downtime deployments and instant rollback capability.

Exam trap

The trap here is that candidates confuse canary or rolling updates with immediate rollback capability, but only blue/green provides an instant traffic switch without redeployment, as the old environment remains intact.

How to eliminate wrong answers

Option B is wrong because all-at-once deployment replaces all instances simultaneously, causing downtime during the deployment and no ability to rollback without redeploying the old version. Option C is wrong because canary deployment shifts only 10% traffic for 5 minutes, which does not guarantee immediate rollback of the entire fleet if the new version fails; it requires manual or automated traffic shifting back, which is not instantaneous. Option D is wrong because in-place rolling update with a batch size of 50% replaces instances gradually but still causes partial downtime and requires a full redeployment to rollback, as the old instances are terminated during the update.

Practice this question →
92
Multi-Selectmedium

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Select 2 answers
A.Set the '--on-failure' parameter to 'ROLLBACK' during stack update.
B.Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.
C.Use a change set to review the changes before updating.
D.Apply a stack policy that denies updates to critical resources.
E.Set the '--disable-rollback' parameter to 'false' during stack update.
AnswersB, E

Specifying a CloudWatch alarm within the '--rollback-configuration' parameter during a stack update is a powerful mechanism for enabling automatic rollback. This configuration allows CloudFormation to monitor the specified alarm(s) for a defined period after the update completes. If any of these alarms transition into an ALARM state, CloudFormation will automatically initiate a rollback of the stack to its previous stable state, ensuring operational stability.

Why this answer

The `--rollback-configuration` parameter allows you to specify a CloudWatch alarm that, when triggered during a stack update, automatically initiates a rollback. This is the intended mechanism for monitoring-based automatic rollback, as CloudFormation will monitor the alarm state and revert the update if the alarm enters the ALARM state. Option E is correct because setting `--disable-rollback` to `false` explicitly enables automatic rollback on any stack update failure, which is the default behavior but can be explicitly configured for clarity.

Exam trap

The trap here is that candidates confuse the `--on-failure` parameter (which only applies to stack creation) with stack update rollback, or they assume that a stack policy or change set can trigger automatic rollback, when in fact only `--rollback-configuration` and `--disable-rollback` control automatic rollback behavior during updates.

Practice this question →
93
MCQeasy

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'ScriptMissing' during the BeforeInstall lifecycle event. What is the most likely cause?

A.The BeforeInstall lifecycle event is not defined in the appspec.yml
B.The script file specified in the appspec.yml for the BeforeInstall hook is not present on the instance
C.The CodeDeploy agent on the instance is not running
D.The instance does not have the necessary permissions to execute the script
AnswerB

This is the correct explanation. When CodeDeploy executes a deployment, it first downloads the application revision to the instance. If the appspec.yml specifies a script for the BeforeInstall hook, and the CodeDeploy agent cannot locate that script file at the specified path within the downloaded revision on the target instance, it will explicitly fail with a "ScriptMissing" error. This error precisely indicates that the expected script file is physically absent from the instance's file system where the agent is looking.

Why this answer

The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment failed because a script file referenced in the appspec.yml for a lifecycle event (in this case, BeforeInstall) could not be found on the EC2 instance. CodeDeploy expects the script to be present at the specified path after the archive is extracted; if the file is missing or the path is incorrect, the agent reports this error. Option B correctly identifies that the script file is not present on the instance.

Exam trap

The trap here is that candidates confuse 'ScriptMissing' with permission issues or agent connectivity problems, but AWS CodeDeploy has distinct error codes for each failure mode, and 'ScriptMissing' specifically points to a missing file, not execution or agent status.

How to eliminate wrong answers

Option A is wrong because if the BeforeInstall lifecycle event is not defined in the appspec.yml, CodeDeploy would simply skip that event and not produce a 'ScriptMissing' error — the error specifically occurs when a hook is defined but its script is absent. Option C is wrong because if the CodeDeploy agent were not running, the deployment would fail with an 'AgentNotRunning' or 'InstanceUnreachable' error, not a 'ScriptMissing' error. Option D is wrong because insufficient permissions to execute the script would result in a 'ScriptFailed' error (e.g., exit code 126 or 127), not a 'ScriptMissing' error — the agent first checks for the file's existence before attempting execution.

Practice this question →
94
Multi-Selecteasy

A company uses AWS CodeBuild to compile and test a Java application. The build process takes a long time because dependencies are downloaded every time. Which TWO actions can reduce build time? (Choose TWO.)

Select 2 answers
A.Increase the compute type of the build environment to have more CPU and memory.
B.Change the build runtime to a language that compiles faster.
C.Configure the build project to run builds in parallel.
D.Enable local caching in the CodeBuild project to reuse dependency files between builds.
E.Use Amazon S3 to cache dependencies and restore them at the start of each build.
AnswersD, E

Local caching in CodeBuild stores specific directories, such as /root/.m2 for Maven or /root/.gradle for Gradle, on the build instance's local disk, keyed by the project and optionally by a custom cache key. On subsequent builds, if the same instance is reused, downloaded dependency JARs are restored from the local cache instead of being fetched from the internet, eliminating the network latency that dominates a cold build. To make it effective, you must configure a cache key that changes only when dependencies actually change, so identical builds skip the download entirely.

Why this answer

Options D and E are correct. Both local caching (D) and S3 caching (E) allow CodeBuild to reuse previously downloaded dependencies, reducing build time. Option A (increasing compute type) improves CPU/memory but does not affect dependency download time.

Option B (changing runtime language) is unrelated to dependency caching. Option C (parallel builds) runs multiple builds concurrently but does not reduce the time for a single build's dependency download.

Practice this question →
95
MCQmedium

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group of EC2 instances. The developer wants to minimize the number of instances that are taken out of service at any given time during the deployment. Which predefined deployment configuration should the developer use?

A.AllAtOnce
B.OneAtATime
C.HalfAtATime
D.Custom with 50% at a time
AnswerB

The OneAtATime deployment configuration updates instances sequentially, taking only one instance out of service at any given moment while the remaining instances continue to serve traffic. This rolling update strategy ensures that the application maintains high availability throughout the deployment process, significantly minimizing the impact on end-users. It is the most effective method for ensuring continuous service and reducing downtime in an Auto Scaling environment.

Why this answer

The OneAtATime deployment configuration shifts traffic to one new instance at a time, ensuring that only a single instance is taken out of service during the deployment. This minimizes the number of instances removed from the Auto Scaling group at any given moment, which directly meets the developer's requirement to reduce service disruption.

Exam trap

The trap here is that candidates might think 'HalfAtATime' is not a predefined configuration, but AWS CodeDeploy does offer 'HalfAtATime' as a predefined option. However, 'HalfAtATime' takes half the instances out of service at once, which does not minimize the number. The correct choice to minimize instances taken out of service is 'OneAtATime'.

How to eliminate wrong answers

Option A (AllAtOnce) is wrong because it deploys to all instances simultaneously, taking the entire fleet out of service at once, which maximizes disruption. Option C (HalfAtATime) is wrong because it is not a predefined deployment configuration in AWS CodeDeploy; the correct predefined option for deploying to half the instances is 'HalfAtATime' but it would take 50% of instances out of service at a time, which is more than the single instance the developer wants. Option D (Custom with 50% at a time) is wrong because while custom configurations are possible, the developer specifically asked for a predefined configuration, and using a custom one would not be the simplest or most direct solution; moreover, deploying 50% at a time would still take more instances out of service than the desired minimum.

Practice this question →
96
Multi-Selectmedium

A developer is deploying an application using AWS CloudFormation. The stack includes an Amazon RDS DB instance. To ensure secure credential management, which TWO actions should the developer take? (Choose TWO.)

Select 2 answers
A.Use AWS Systems Manager Parameter Store with a SecureString parameter for the password.
B.Use AWS Secrets Manager to store the master password and reference it dynamically.
C.Hardcode the master password in the CloudFormation template.
D.Use IAM database authentication to manage credentials.
E.Leave the master password empty so that CloudFormation generates a random password.
AnswersA, B

Using AWS Systems Manager Parameter Store with a SecureString parameter is a robust solution for storing sensitive data like passwords. SecureString parameters are encrypted at rest using AWS Key Management Service (KMS) and can be securely referenced within CloudFormation templates using dynamic references or `Fn::Sub` functions. This method ensures the password is never exposed in plain text within the template or CloudFormation console, adhering to security best practices for non-rotating secrets.

Why this answer

AWS Systems Manager Parameter Store with a SecureString parameter is correct because it allows you to securely store the RDS master password as an encrypted parameter and reference it in the CloudFormation template using the `resolve:ssm` or `resolve:ssm-secure` dynamic reference. This avoids hardcoding the password in the template or exposing it in plaintext, while still enabling automated deployment.

Exam trap

The trap here is that candidates may confuse IAM database authentication (which handles user-level access) with master password management, or assume CloudFormation can auto-generate passwords for RDS, but neither is correct for securely setting the initial master password.

Practice this question →
97
MCQeasy

A developer is using AWS CodeBuild to compile and package a Java application. The build process takes longer than expected. The developer wants to speed up the build by reusing dependencies that have not changed between builds. Which feature should the developer enable?

A.Configure the build project to run builds concurrently
B.Enable build artifacts in the CodeBuild project
C.Enable caching for the CodeBuild project by specifying an S3 bucket for cache storage
D.Store the build's output artifacts in an S3 bucket
AnswerC

Enabling caching for the CodeBuild project by specifying an S3 bucket for cache storage is the intended solution: CodeBuild downloads a cache archive from the given S3 bucket before the build and uploads it again afterward. This lets package managers like Maven, Gradle, npm, or pip reuse previously downloaded dependencies, dramatically reducing build time and network traffic for untouched dependencies. You can configure cache paths in the buildspec to collect and restore the correct directories. This is the standard, documented way to cache dependencies in CodeBuild.

Why this answer

Enable caching for the CodeBuild project by specifying an S3 bucket for cache storage. CodeBuild caching allows reusing previously downloaded dependencies, reducing build time. Option A is incorrect because running builds concurrently does not reuse dependencies across builds; it runs separate builds simultaneously.

Option B is incorrect because enabling build artifacts does not affect dependency caching; artifacts are outputs. Option D is incorrect because storing artifacts in S3 does not provide caching for dependencies; it only stores the build output.

Practice this question →
98
MCQeasy

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and a Lambda function. The developer wants to set up a custom domain name for the API in the production stage. Which resource should the developer define in the SAM template to achieve this with minimal effort?

A.AWS::ApiGateway::DomainName
B.AWS::Serverless::Api
C.AWS::ApiGateway::BasePathMapping
D.AWS::Route53::RecordSet
AnswerB

The AWS::Serverless::Api resource in AWS SAM provides a high-level abstraction for defining an Amazon API Gateway REST API, including its custom domain configuration. By utilizing its `Domain` property, developers can specify a custom domain name, a certificate ARN from AWS Certificate Manager (ACM), and base path mappings directly within the SAM template. SAM then automatically provisions the underlying `AWS::ApiGateway::DomainName` and `AWS::ApiGateway::BasePathMapping` CloudFormation resources, simplifying the setup of custom domains for serverless APIs.

Why this answer

The AWS::Serverless::Api resource in an AWS SAM template provides a high-level abstraction that simplifies the configuration of API Gateway REST APIs, including the ability to set up a custom domain name via the Domain property. This approach requires minimal effort because SAM automatically creates the underlying AWS::ApiGateway::DomainName and AWS::ApiGateway::BasePathMapping resources, handles the TLS certificate association, and manages the stage deployment. Defining a raw AWS::ApiGateway::DomainName would require additional manual configuration for base path mapping and stage integration, making the Serverless::Api the most efficient choice.

Exam trap

The trap here is that candidates often think they must define the low-level AWS::ApiGateway::DomainName resource directly, overlooking that AWS SAM's AWS::Serverless::Api provides a built-in Domain property that automates the entire custom domain setup with minimal code.

How to eliminate wrong answers

Option A is wrong because AWS::ApiGateway::DomainName only defines the custom domain name and its TLS certificate; it does not automatically create the base path mapping or integrate with the API stage, so additional resources and manual wiring are needed. Option C is wrong because AWS::ApiGateway::BasePathMapping maps a base path to an API stage but does not create the custom domain name itself; it must be used in conjunction with a DomainName resource, increasing complexity. Option D is wrong because AWS::Route53::RecordSet creates a DNS record (e.g., CNAME or A alias) to point a custom domain to the API Gateway endpoint, but it does not configure the API Gateway custom domain name or TLS termination; it is a DNS-only resource and cannot replace the DomainName configuration.

Practice this question →
99
Multi-Selecteasy

A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)

Select 2 answers
A.Store credentials in AWS Secrets Manager and retrieve them at runtime.
B.Store credentials in an Amazon S3 bucket with server-side encryption.
C.Hardcode credentials in the application configuration file.
D.Store credentials in AWS Systems Manager Parameter Store with SecureString parameter type.
E.Store credentials as environment variables in the Elastic Beanstalk environment.
AnswersA, D

AWS Secrets Manager encrypts secrets with KMS keys and provides a dedicated GetSecretValue API for runtime retrieval, so application code never contains or resolves the secret itself. It also supports automatic rotation of database credentials via Lambda, fine-grained IAM policies, and cross-account access, making it the most built-for-purpose option for dynamically fetching secrets in an Elastic Beanstalk environment.

Why this answer

Options A and D are correct. AWS Secrets Manager and AWS Systems Manager Parameter Store (with SecureString parameter type) are secure services for storing and retrieving database credentials at runtime. Option B is incorrect because storing credentials in an S3 bucket is not a secure practice for secrets management, even with server-side encryption, as access policies may inadvertently expose the bucket and it is not designed for secret rotation or fine-grained access control.

Option C is incorrect because hardcoding credentials in the application code exposes them in version control and to anyone with access to the code. Option E is incorrect because environment variables in Elastic Beanstalk can be viewed in the environment configuration and may be exposed in logs or through other AWS services if not carefully managed.

Practice this question →
100
MCQmedium

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that uses S3 deployment action. The website is served via Amazon CloudFront. After a successful pipeline run, the updated files are in S3, but CloudFront still serves old content. What is the MOST efficient solution?

A.Manually create a CloudFront invalidation after each deployment.
B.Reduce the CloudFront distribution's default TTL to 0.
C.Add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation.
D.Update the S3 bucket policy to allow public read access.
AnswerC

This automates cache invalidation after each deployment, ensuring fresh content.

Why this answer

It automates the creation of a CloudFront invalidation as part of the CodePipeline post-deploy stage. This ensures that after new files are uploaded to S3, CloudFront's edge caches are purged of the old content, forcing it to fetch the updated files from the origin. This is the most efficient solution as it requires no manual intervention and does not compromise caching performance.

Exam trap

The trap here is that candidates may think reducing TTL to 0 is a valid solution, but this ignores the fact that TTL controls how long objects are cached, not how to purge already-cached content, and it would severely degrade CDN performance.

How to eliminate wrong answers

Option A is wrong because manually creating a CloudFront invalidation after each deployment is inefficient, error-prone, and does not scale; it also contradicts the goal of an automated CI/CD pipeline. Option B is wrong because setting the default TTL to 0 would force CloudFront to re-fetch every object from the origin on every request, defeating the purpose of a CDN and significantly increasing latency and origin load. Option D is wrong because the S3 bucket policy for public read access is unrelated to CloudFront cache invalidation; CloudFront can serve private S3 content via Origin Access Control (OAC) and still serve stale cached content.

Practice this question →
101
MCQhard

A developer is using AWS CodeDeploy with a blue/green deployment strategy for an EC2 Auto Scaling group. The deployment must automatically roll back if any of the new instances fail a health check within the first 10 minutes after deployment. Which configuration should the developer set?

A.Set the deployment configuration to 'CodeDeployDefault.EC2AllAtOnce'
B.Configure the deployment group to use an alarm-based rollback with a CloudWatch alarm on the ELB health check
C.Enable automatic rollback in the deployment group configuration and set the event to 'DEPLOYMENT_FAILURE' or 'DEPLOYMENT_STOP_ON_REQUEST'
D.Configure the deployment group with a 'LoadBalancerInfo' and enable 'originalInstanceTermination' for rollback
AnswerB

Configuring the deployment group with alarm-based rollback, specifically using a CloudWatch alarm on the ELB health check, is the correct and most robust solution for Blue/Green deployments. This approach allows CodeDeploy to monitor critical metrics from the ELB, such as the count of unhealthy hosts or HTTP 5xx errors, on the newly deployed environment. If the specified thresholds are breached, indicating application issues, the CloudWatch alarm will trigger CodeDeploy to automatically revert traffic to the original, stable environment, ensuring high availability and minimizing user impact.

Why this answer

The requirement is to automatically roll back based on health check failures within a specific time window after deployment. AWS CodeDeploy supports alarm-based rollbacks where you can configure a CloudWatch alarm that monitors the ELB health check status of the new instances. When the alarm triggers within the configured monitoring period (e.g., 10 minutes), CodeDeploy automatically rolls back the deployment to the previous version, meeting the exact condition described.

Exam trap

The trap here is that candidates often confuse deployment configuration settings (like traffic shifting speed) with rollback triggers, or assume that enabling automatic rollback for deployment failures alone will cover post-deployment health check failures, but CodeDeploy requires a separate alarm-based rollback configuration to monitor health after instances are in service.

How to eliminate wrong answers

Option A is wrong because 'CodeDeployDefault.EC2AllAtOnce' is a deployment configuration that controls the traffic shifting speed (all instances at once), not a rollback mechanism based on health checks. Option C is wrong because enabling automatic rollback for 'DEPLOYMENT_FAILURE' or 'DEPLOYMENT_STOP_ON_REQUEST' only triggers rollback on deployment failures or manual stops, not on post-deployment health check failures within a time window. Option D is wrong because 'LoadBalancerInfo' and 'originalInstanceTermination' are used to configure traffic routing and instance termination behavior in blue/green deployments, not to trigger automatic rollbacks based on health checks.

Practice this question →
102
MCQmedium

A developer needs different configuration values for dev, test, and prod in the same SAM template. Which feature is suitable?

A.Parameters and environment-specific parameter overrides
B.Hardcoded ARNs in every function
C.One AWS root account per environment
D.Disabling stack updates
AnswerA

This approach is highly effective for managing environment-specific configurations. By defining parameters in Infrastructure as Code (IaC) templates, such as AWS CloudFormation, developers can specify different values for resources like database endpoints, API keys, or instance types depending on the target environment (dev, test, production). Parameter overrides allow the same template to be deployed multiple times with distinct configurations, ensuring consistency in infrastructure definition while adapting to environmental needs.

Why this answer

AWS SAM supports Parameters and environment-specific parameter overrides, allowing you to define a single template and supply different configuration values (e.g., database URLs, API keys) for dev, test, and prod environments at deployment time. This is achieved by passing a JSON or YAML file with the `--parameter-overrides` flag in the `sam deploy` command, or by using the `parameters` section in a `samconfig.toml` file. This approach avoids duplicating templates and keeps infrastructure-as-code DRY and maintainable.

Exam trap

The trap here is that candidates may think hardcoding ARNs or using separate root accounts is simpler, but the exam tests knowledge of AWS-recommended patterns like parameter overrides and multi-account strategies using AWS Organizations, not root accounts.

How to eliminate wrong answers

Option B is wrong because hardcoding ARNs in every function violates the principle of environment isolation and requires manual changes for each environment, increasing the risk of misconfiguration and deployment errors. Option C is wrong because using one AWS root account per environment is an anti-pattern; it introduces unnecessary administrative overhead, security risks, and violates the AWS Well-Architected Framework's recommendation to use separate AWS accounts (not root accounts) for environment isolation. Option D is wrong because disabling stack updates prevents any future changes to the stack, making it impossible to update configuration values or deploy new features, which is impractical for ongoing development and deployment.

Practice this question →
103
MCQmedium

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the BeforeInstall lifecycle event. What should the developer do to troubleshoot the issue?

A.Check the deployment group configuration.
B.Verify the build output from CodeBuild.
C.Check the appspec.yml file for errors in the BeforeInstall hook.
D.Review the deployment configuration settings.
AnswerC

The BeforeInstall hook is defined in the appspec.yml file under the hooks section, so a malformed YAML, an incorrect hook name, a missing script path, or a script without the execute permission will cause CodeDeploy to fail at that stage. You need to inspect the appspec.yml and the script it references to identify the exact error, because lifecycle hooks are entirely driven by that file, not by the deployment group or deployment configuration.

Why this answer

The BeforeInstall hook scripts are defined in the appspec.yml file, and a failure during that lifecycle event typically indicates an error in the script or the hook configuration. Option A is wrong because the deployment group configuration (e.g., Auto Scaling group, tags) does not directly cause a script failure in the BeforeInstall hook. Option B is wrong because the build output from CodeBuild is already successful and not related to the deployment failure.

Option D is wrong because deployment configuration settings (e.g., deployment type, rollback triggers) do not affect the execution of the BeforeInstall hook scripts.

Exam trap

A common trap is to overlook the appspec.yml file and instead check deployment group or configuration settings when the issue is clearly with the script specified in the appspec hooks.

Practice this question →
104
MCQhard

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of several Lambda functions and an API Gateway. The developer wants to enable gradual deployment of Lambda function versions with automatic rollback based on CloudWatch alarms. What should the developer add to the SAM template?

A.Use 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' resources to manually shift traffic and set up CloudWatch alarms to revert the alias if needed.
B.Add a 'DeploymentPreference' property with 'Type' set to 'Linear' and specify a 'Alarms' list for rollback.
C.Add 'AutoPublishAlias' and 'DeploymentPreference' properties to the Lambda function resource, specifying a canary deployment with a CloudWatch alarm for rollback.
D.Add a 'CodeDeployLambdaAlias' resource to the template and configure the deployment group with a canary deployment configuration.
AnswerC

This is the correct approach for implementing automated canary deployments with rollback in SAM. The 'AutoPublishAlias' property on an 'AWS::Serverless::Function' resource automatically creates a new Lambda version and updates an alias to point to it, enabling traffic shifting. Coupled with 'DeploymentPreference', SAM integrates with AWS CodeDeploy to manage the gradual traffic shift (e.g., canary) and automatically rolls back to the previous stable version if specified CloudWatch alarms are breached during the deployment.

Why this answer

The SAM template supports gradual deployments through the 'AutoPublishAlias' property combined with 'DeploymentPreference'. This allows you to specify a canary deployment (or linear) and define CloudWatch alarms for automatic rollback. Option A is incorrect because manually managing 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' does not provide automated rollback.

Option B is incorrect because while 'DeploymentPreference' with 'Type: Linear' does enable gradual deployment, the question specifically asks for the SAM-native approach using 'AutoPublishAlias' and 'DeploymentPreference' together; also the 'Alarms' list is specified within 'DeploymentPreference'. Option D is incorrect because 'CodeDeployLambdaAlias' is not a valid SAM resource; SAM abstracts CodeDeploy configuration through the 'DeploymentPreference' property on the Lambda function resource.

Practice this question →
105
MCQhard

A developer is deploying a serverless application using AWS SAM. The application consists of multiple Lambda functions and an Amazon API Gateway. The developer wants to enable canary deployments for the API Gateway stage to gradually shift traffic. Which SAM resource attribute should the developer use?

A.DeploymentPreference
B.CanarySetting
C.StageName
D.MethodSettings
AnswerA

The DeploymentPreference attribute in SAM is used to define traffic shifting and canary deployment settings for Lambda and API Gateway.

Why this answer

The `DeploymentPreference` attribute in AWS SAM's `AWS::Serverless::Api` resource enables canary deployments for API Gateway stages. This attribute allows you to configure traffic shifting patterns, such as linear or canary, by specifying settings like `Type` (e.g., `Canary10Percent5Minutes`) and `Alarms` to automatically roll back on failures. It directly integrates with AWS CodeDeploy to manage the gradual traffic shift without manual intervention.

Exam trap

The trap here is that candidates confuse `CanarySetting` (a direct CloudFormation property for API Gateway stages) with the SAM-specific `DeploymentPreference` attribute, which is the correct abstraction for canary deployments in SAM templates.

How to eliminate wrong answers

Option B is wrong because `CanarySetting` is a property of the API Gateway `Stage` resource in AWS CloudFormation, not a SAM-specific attribute; SAM abstracts this into `DeploymentPreference` for simplicity. Option C is wrong because `StageName` is a property that defines the stage name (e.g., 'prod') but does not control traffic shifting or canary deployments. Option D is wrong because `MethodSettings` configures per-method settings like throttling or caching, not deployment strategies like canary releases.

Practice this question →
106
MCQmedium

A company uses AWS CodeBuild to run tests and build artifacts for a Java application. The build process is taking longer than expected. The developer wants to speed up the build by caching dependencies. What should the developer do?

A.Use a CodeCommit repository to store dependencies.
B.Store dependencies in an S3 bucket and download them in each build.
C.Enable local caching in the CodeBuild project configuration.
D.Mount an Amazon EFS file system to the build environment and store dependencies there.
AnswerC

Enabling local caching in the CodeBuild project configuration is the most effective and direct solution for significantly speeding up build times by reusing previously downloaded dependencies. CodeBuild offers various local caching options, including caching artifacts in the build host's Docker layer or a specified local directory, or even using an S3 bucket for more persistent, shared caching. This mechanism ensures that common dependencies are stored and quickly retrieved for subsequent builds, drastically reducing network I/O, package installation times, and overall build execution duration.

Why this answer

CodeBuild's local caching feature allows the build environment to cache dependencies (e.g., Maven local repository) in a local directory that persists across build runs for the same project. This eliminates the need to re-download dependencies on every build, significantly reducing build time. The cache is stored on the build instance's local storage and is automatically managed by CodeBuild.

Exam trap

The trap here is that candidates often assume external storage (S3 or EFS) is required for caching, but CodeBuild's built-in local caching is specifically designed for this purpose and avoids the latency of network-based storage.

How to eliminate wrong answers

Option A is wrong because CodeCommit is a Git-based source control service, not a dependency cache; storing dependencies there would require manual management and does not integrate with CodeBuild's caching mechanism. Option B is wrong because downloading dependencies from S3 in each build still incurs network latency and download time, negating the performance benefit of caching. Option D is wrong because mounting an EFS file system adds network filesystem overhead and latency, and EFS is designed for shared file storage across multiple instances, not for low-latency build caching within a single build environment.

Practice this question →
107
Multi-Selecthard

A company is deploying a critical application using AWS CloudFormation. The stack contains a resource that, if deleted accidentally, would cause data loss. The company wants to protect this resource from being deleted during stack updates or deletions. Which THREE strategies can achieve this? (Choose THREE.)

Select 3 answers
A.Wrap the resource in a nested stack.
B.Enable termination protection on the CloudFormation stack.
C.Set the UpdateReplacePolicy attribute to 'Retain' on the resource.
D.Use a stack policy to deny delete actions on the resource.
E.Set the DeletionPolicy attribute to 'Retain' on the resource.
AnswersB, D, E

Termination protection prevents accidental stack deletion.

Why this answer

The correct strategies to protect a resource from accidental deletion during stack updates or deletions are: Enable termination protection on the CloudFormation stack (Option B) prevents the entire stack from being deleted, thus protecting all resources. Use a stack policy to deny delete actions on the resource (Option D) can explicitly deny updates or deletions to specific resources. Set the DeletionPolicy attribute to 'Retain' on the resource (Option E) ensures the resource is retained even if the stack is deleted.

Option A is incorrect because wrapping a resource in a nested stack does not inherently protect it from deletion; the nested stack itself could be deleted. Option C is incorrect because UpdateReplacePolicy only affects behavior during stack updates that replace the resource, not during deletions; it is used to retain the old resource when a replacement occurs, but does not prevent deletion during stack deletion.

Practice this question →
108
MCQmedium

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 instances and a maximum of 4. The deployment configuration is CodeDeployDefault.OneAtATime. What is the most likely cause of the failure?

A.The deployment group's maximum instances is set to 4, which exceeds the number of instances in the Auto Scaling group.
B.The Auto Scaling group has only 2 instances, and one instance fails during deployment, leaving less than the required healthy instances.
C.The IAM role attached to the instances does not have sufficient permissions to download the revision from Amazon S3.
D.The revision is not properly zipped or the AppSpec file is missing.
AnswerB

This scenario directly addresses a common CodeDeploy failure mode when using conservative deployment strategies like CodeDeployDefault.OneAtATime on small Auto Scaling groups. If the Auto Scaling group has only two instances, and one instance fails its health checks or application startup during the deployment, the number of healthy instances immediately drops to one. If the deployment configuration's MinimumHealthyHosts threshold requires more than one healthy instance (e.g., 50% of 2 instances, which rounds up to 1, but if the next step requires taking another instance out of service, it would fail), or if the deployment is configured to halt if any instance fails, the deployment will stop due to insufficient healthy hosts, preventing further degradation.

Why this answer

The deployment configuration CodeDeployDefault.OneAtATime deploys to one instance at a time, and the deployment group has a minimum of 2 healthy instances. If one instance fails during deployment, only 1 healthy instance remains, which is below the minimum required threshold of 2. This causes CodeDeploy to stop the deployment and mark it as failed, as it cannot maintain the required number of healthy instances.

Exam trap

The trap here is that candidates may overlook the interaction between the deployment configuration (OneAtATime) and the minimum healthy instances setting, assuming any instance failure is due to a code or permission issue rather than a capacity constraint.

How to eliminate wrong answers

Option A is wrong because the maximum instances setting of 4 does not cause a deployment failure; it only limits the number of instances that can be deployed to at once, and the Auto Scaling group can have fewer instances than the maximum. Option B is correct as explained. Option C is wrong because insufficient IAM permissions would cause a specific error related to S3 access, not the generic 'too few healthy instances' error.

Option D is wrong because a malformed revision or missing AppSpec file would result in a different error, such as 'ScriptFailed' or 'InvalidRevision', not the healthy instances error.

Practice this question →
109
Multi-Selecteasy

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an Amazon DynamoDB table and a Lambda function that reads from the table. The developer wants to define the DynamoDB table and the Lambda function in the SAM template. Which THREE resource types should the developer include in the template? (Choose THREE.)

Select 3 answers
A.AWS::DynamoDB::Table
B.AWS::Lambda::Function
C.AWS::Serverless::DynamoDB
D.AWS::Serverless::SimpleTable
E.AWS::Serverless::Function
AnswersA, D, E

AWS::DynamoDB::Table is a native CloudFormation resource that can be embedded directly in a SAM template. It gives you full control over DynamoDB settings such as key schema, billing mode, global secondary indexes, and stream specification, whereas SAM's Serverless::SimpleTable only exposes a subset of these properties. Using this resource is appropriate when you need advanced configuration, like TTL or point-in-time recovery, without leaving the template.

Why this answer

The correct options are A (AWS::DynamoDB::Table), D (AWS::Serverless::SimpleTable), and E (AWS::Serverless::Function). In an AWS SAM template, you can define a DynamoDB table using either the standard CloudFormation resource AWS::DynamoDB::Table (for full control) or the SAM shorthand AWS::Serverless::SimpleTable (for simpler use cases). For a Lambda function, the recommended SAM resource is AWS::Serverless::Function, which provides additional SAM features like event mappings and policies.

Option B (AWS::Lambda::Function) is a CloudFormation resource that could be used but is not the typical SAM choice; the question asks for resource types to include in a SAM template, so the serverless type is expected. Option C (AWS::Serverless::DynamoDB) is not a valid AWS resource type.

Practice this question →
110
MCQhard

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error message 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The developer checks the deployment logs and finds that the ApplicationStop hook failed on some instances. What is the most likely cause of this failure?

A.The ValidateService hook script is failing.
B.The BeforeInstall hook script is incorrectly configured.
C.The Auto Scaling group does not have enough capacity to perform the deployment.
D.The ApplicationStop script is not compatible with the instance operating system or is missing.
AnswerD

The ApplicationStop hook is one of the earliest lifecycle events in a CodeDeploy deployment, especially crucial for in-place updates where the existing application must be gracefully shut down. If this script is missing from the appspec.yml, has incorrect file permissions, contains syntax errors, or uses commands incompatible with the instance's operating system or shell, the deployment will immediately fail at this critical initial stage. This directly prevents subsequent deployment steps from executing, causing a hook failure.

Why this answer

The error message indicates that the ApplicationStop hook failed on some instances. The ApplicationStop hook is a lifecycle event that runs a script to stop the application before a new deployment begins. If the script is missing, incompatible with the instance's operating system, or has incorrect permissions, it will fail, causing the deployment to abort.

This is the most direct cause of the failure described.

Exam trap

The trap here is that candidates may confuse the order of lifecycle hooks or assume a capacity issue, but the specific error message points directly to the ApplicationStop hook, making the missing or incompatible script the most likely cause.

How to eliminate wrong answers

Option A is wrong because the ValidateService hook runs after the deployment completes to verify the application is running correctly; a failure there would not cause the ApplicationStop hook to fail. Option B is wrong because the BeforeInstall hook runs after ApplicationStop and before the new application version is installed; an incorrect configuration there would not affect the ApplicationStop hook. Option C is wrong because insufficient Auto Scaling group capacity would cause a different error related to instance launch or health checks, not a specific hook failure on existing instances.

Practice this question →
111
MCQeasy

A developer is using AWS CodeDeploy to deploy an application to an Amazon ECS service using the Fargate launch type. The developer wants to ensure that the deployment rolls back automatically if the new task set fails health checks. Which configuration should the developer set?

A.Set the deployment type to in-place.
B.Enable rollback in the deployment group settings.
C.Set the deployment configuration to CodeDeployDefault.OneAtATime.
D.Configure CloudWatch alarms to trigger a rollback.
AnswerB

Enabling rollback in the CodeDeploy deployment group settings for an Amazon ECS blue/green deployment directly configures the system to monitor the health of the newly deployed task set. If the new tasks fail to pass the configured health checks (e.g., ELB target group health checks or ECS task health checks) within a specified period, CodeDeploy will automatically revert traffic to the original, stable task set, ensuring service continuity.

Why this answer

Enabling rollback in the deployment group settings allows CodeDeploy to automatically revert the deployment to the previous working task set if the new task set fails health checks. This is a native feature of CodeDeploy that monitors the health of the ECS service and triggers a rollback without manual intervention.

Exam trap

The trap here is that candidates often confuse CloudWatch alarms as the only way to trigger a rollback, but CodeDeploy's built-in rollback feature directly responds to health check failures without needing an alarm.

How to eliminate wrong answers

Option A is wrong because in-place deployments are not supported for Amazon ECS with the Fargate launch type; ECS deployments using CodeDeploy must use blue/green deployments. Option C is wrong because CodeDeployDefault.OneAtATime is a deployment configuration for Lambda or EC2/On-Premises, not for ECS; ECS deployments use a different set of configurations like CodeDeployDefault.ECSAllAtOnce. Option D is wrong because CloudWatch alarms can be configured to trigger a rollback, but they are an additional optional feature, not the primary mechanism to ensure automatic rollback on health check failure; the core requirement is enabling rollback in the deployment group settings.

Practice this question →
112
MCQeasy

A developer wants to deploy a new version of an application to an EC2 Auto Scaling group using AWS CodeDeploy. The developer wants to minimize downtime and ensure that if the deployment fails, it automatically rolls back to the previous version. Which deployment type should the developer choose?

A.In-place
B.Blue/green
C.Canary
D.Linear
AnswerB

Blue/green deployments are the recommended strategy for EC2 Auto Scaling groups when zero downtime and easy rollback are critical. This method involves provisioning an entirely new "green" environment with the updated application version, while the existing "blue" environment continues to serve traffic. Once the new instances in the green environment are validated, traffic is seamlessly shifted from the blue to the green environment, typically via a load balancer. This approach ensures minimal disruption and provides an immediate rollback option by simply reverting traffic to the original blue environment if issues arise post-deployment.

Why this answer

Blue/green deployment is the correct choice because it creates a separate, new Auto Scaling group (green) alongside the existing one (blue), allowing traffic to be shifted to the new environment after validation. This minimizes downtime by keeping the old environment fully operational during the deployment, and CodeDeploy can automatically roll back by redirecting traffic to the blue environment if the deployment fails.

Exam trap

The trap here is that candidates often confuse deployment types across compute platforms, mistakenly applying canary or linear (which are valid for Lambda/ECS) to EC2 Auto Scaling groups, where only in-place or blue/green are supported by CodeDeploy.

How to eliminate wrong answers

Option A is wrong because in-place deployment updates instances in the existing Auto Scaling group one at a time, which can cause partial downtime and does not support automatic rollback to a previous version without manual intervention or a separate rollback configuration. Option C is wrong because canary is a traffic-shifting pattern used in AWS CodeDeploy for Lambda or ECS deployments, not for EC2 Auto Scaling groups, and it does not inherently provide automatic rollback. Option D is wrong because linear is also a traffic-shifting pattern for Lambda or ECS, not applicable to EC2 Auto Scaling groups, and it lacks built-in automatic rollback behavior.

Practice this question →
113
MCQeasy

A company uses AWS Elastic Beanstalk to deploy a Python web application. After a recent deployment, the environment health turns 'Severe' and the application becomes unresponsive. The developer checks the logs and finds multiple '502 Bad Gateway' errors from the nginx proxy. The application was working before the deployment. What is the MOST likely cause?

A.The new application code has a bug that causes the application to crash.
B.The Procfile is missing from the application source.
C.The environment's load balancer is not configured correctly.
D.The environment variables are not set correctly.
AnswerA

Crashing application causes nginx to return 502.

Why this answer

A 502 Bad Gateway error from nginx means the reverse proxy cannot communicate with the application backend. Since the application was working before the deployment and became unresponsive immediately after, the most likely cause is a bug in the new code that causes the application process to crash or hang. Elastic Beanstalk's nginx proxy expects a healthy response from the application on the designated port; if the application fails to start or crashes repeatedly, nginx returns 502 errors.

Exam trap

The trap here is that candidates often confuse a 502 error with a load balancer misconfiguration or environment variable issue, but the key clue is that the problem started immediately after a code deployment, pointing directly to a bug in the new application code.

How to eliminate wrong answers

Option B is wrong because a missing Procfile would cause the environment to fail at the platform initialization stage, not produce intermittent 502 errors after a successful deployment. Option C is wrong because the load balancer configuration did not change between deployments; if it were misconfigured, the application would have been unhealthy before the deployment as well. Option D is wrong because environment variables are managed separately from the application source code and are not typically altered during a code deployment; incorrect variables would likely cause application logic errors, not a complete crash leading to 502 responses.

Practice this question →
114
MCQhard

A company is using AWS CodeDeploy with an in-place deployment to an Auto Scaling group. The deployment fails with the error 'Deployment failed because the deployment group does not have enough instances to deploy to'. The Auto Scaling group has a minimum size of 2, maximum size of 5, and desired capacity of 2. The deployment configuration is CodeDeployDefault.AllAtOnce. What is the most likely cause?

A.The Auto Scaling group needs to have at least 3 instances to use AllAtOnce.
B.The deployment configuration is not compatible with Auto Scaling groups.
C.The instances in the Auto Scaling group are not passing health checks.
D.The deployment group has only 2 instances, and the deployment failed on one instance, causing the minimum healthy hosts threshold to be violated.
AnswerC

Correct. If instances fail health checks, they are not considered healthy, leading to zero healthy instances in the deployment group, which causes this error.

Why this answer

The error 'Deployment failed because the deployment group does not have enough instances to deploy to' occurs when there are zero healthy instances in the deployment group at the start of deployment. With CodeDeployDefault.AllAtOnce, the minimum number of healthy hosts is 0, so a single instance failure during deployment would not trigger this error. The most likely cause is that the instances in the Auto Scaling group are not passing health checks, resulting in no healthy instances available for deployment.

Option C is correct.

Exam trap

Candidates often misinterpret this error as a sizing or threshold issue, but it actually indicates that no healthy instances exist at deployment start, typically due to health check failures.

How to eliminate wrong answers

Option A is wrong because CodeDeployDefault.AllAtOnce does not require a minimum of 3 instances; it deploys to all instances simultaneously and the minimum healthy hosts threshold is 0, meaning it can work with any number of instances as long as at least one remains healthy. Option B is wrong because CodeDeployDefault.AllAtOnce is fully compatible with Auto Scaling groups; in-place deployments to Auto Scaling groups are a standard use case for CodeDeploy. Option C is wrong because the error message specifically indicates a lack of instances to deploy to, not a health check failure; while health check failures could cause instances to be terminated, the error here is about the deployment group size, not instance health status.

Practice this question →
115
MCQmedium

A developer is using AWS CodeBuild to build a Java application. The build succeeds locally but fails in CodeBuild with the error 'BUILD FAILED: Unable to find a Java installation.' The buildspec.yml file includes a 'runtime-versions' section specifying Java 11. The CodeBuild project uses the 'aws/codebuild/amazonlinux2-x86_64-standard:4.0' image. What is the MOST likely cause of the failure?

A.The runtime-versions section in buildspec.yml is not correctly formatted.
B.The CodeBuild project does not have sufficient permissions to download Java.
C.The buildspec.yml file is not in the root of the source directory.
D.The build commands reference a non-existent Maven dependency.
AnswerA

The runtime-versions section in buildspec.yml is crucial for specifying the language runtime environment, such as Java, that CodeBuild should provision. If this section contains incorrect YAML syntax or an unsupported version string, CodeBuild will fail to properly install or configure the specified Java Development Kit (JDK). This misconfiguration prevents the build environment from having the necessary Java runtime, leading to errors when build commands attempt to invoke Java or Maven.

Why this answer

The error 'Unable to find a Java installation' indicates that the CodeBuild environment does not have Java available at runtime. When using a standard managed image like 'aws/codebuild/amazonlinux2-x86_64-standard:4.0', Java must be explicitly declared in the 'runtime-versions' section of buildspec.yml. The most likely cause is that the 'runtime-versions' section is incorrectly formatted (e.g., using 'java: 11' instead of the correct 'java: corretto11'), causing CodeBuild to skip installing Java.

Exam trap

The trap here is that candidates assume 'java: 11' is a valid runtime identifier, but CodeBuild requires the exact runtime name (e.g., 'corretto11' or 'openjdk11'), and a formatting error in runtime-versions leads to a missing Java installation rather than a syntax error.

How to eliminate wrong answers

Option B is wrong because CodeBuild managed images already include the necessary package repositories and permissions to download and install runtimes specified in 'runtime-versions'; insufficient permissions would cause a different error (e.g., access denied to S3 artifacts). Option C is wrong because if the buildspec.yml were not in the root directory, CodeBuild would fail with a 'buildspec.yml not found' error, not a Java installation error. Option D is wrong because a non-existent Maven dependency would produce a Maven build error (e.g., 'Could not resolve dependency'), not a missing Java installation error.

Practice this question →
116
MCQeasy

A developer is using AWS CodeDeploy to deploy a revision to an EC2/On-Premises deployment group. The deployment fails because the specified deployment configuration requires a minimum of 1 healthy host, but the deployment group has 0 instances. What is the most likely cause?

A.The deployment group is not associated with any Auto Scaling group.
B.The deployment configuration requires too many healthy hosts.
C.The CodeDeploy agent is not installed on the instances.
D.The deployment group does not have any Amazon EC2 instances registered.
AnswerD

A CodeDeploy deployment group must have target Amazon EC2 instances explicitly registered with it, either individually or dynamically via an Auto Scaling group, for a deployment to proceed. If no instances are associated with or discovered by the deployment group, CodeDeploy has no endpoints to send the application revision to. Consequently, the deployment will fail immediately because there are simply no target hosts available to receive the deployment, regardless of deployment configuration or agent status. This is a foundational requirement for any deployment.

Why this answer

The deployment failed because the deployment group had zero registered instances, making it impossible to meet the minimum of 1 healthy host required by the deployment configuration. Option D is correct because the error message directly indicates that the deployment group contains no EC2 instances, so there are no hosts to deploy to.

Exam trap

The trap here is that candidates often assume the error is due to a missing CodeDeploy agent or an Auto Scaling group requirement, but the specific error message 'minimum of 1 healthy host' with '0 instances' directly points to an empty deployment group.

How to eliminate wrong answers

Option A is wrong because a deployment group does not need to be associated with an Auto Scaling group; it can contain manually registered EC2 instances or on-premises instances, and the lack of an Auto Scaling group does not cause a '0 instances' error. Option B is wrong because the deployment configuration requiring a minimum of 1 healthy host is not excessive; it is the standard minimum, and the issue is that there are zero hosts, not that the requirement is too high. Option C is wrong because the CodeDeploy agent not being installed would cause a different error (e.g., 'agent not reachable' or 'timeout') during deployment, not a failure due to zero instances in the group.

Practice this question →
117
MCQmedium

A developer is deploying a containerized application to Amazon ECS with the Fargate launch type using AWS CodeDeploy for blue/green deployments. The application is behind an Application Load Balancer (ALB). What is the minimum number of ALB target groups required for a blue/green deployment?

A.1
B.2
C.3
D.4
AnswerB

Two target groups are precisely what AWS CodeDeploy requires for a blue/green deployment with Amazon ECS. One target group is associated with the currently active "blue" task set, receiving all production traffic. The second target group is then associated with the newly deployed "green" task set, allowing for validation before CodeDeploy automatically shifts traffic from the "blue" target group to the "green" target group via Application Load Balancer listener rule updates, ensuring a controlled, zero-downtime transition.

Why this answer

In a blue/green deployment with Amazon ECS (Fargate) and AWS CodeDeploy, the deployment process requires two distinct target groups: one for the 'blue' (current) environment and one for the 'green' (new) environment. CodeDeploy shifts traffic from the blue target group to the green target group during the deployment, allowing for instant rollback by switching back. A single target group cannot differentiate between the two environments, and three or more are unnecessary because the blue/green model only needs two active target groups at any time.

Exam trap

The trap here is that candidates often assume a single target group is sufficient because they think of the ALB as handling traffic routing on its own, but they miss that blue/green deployments require two separate target groups to isolate the old and new environments for traffic shifting and rollback.

How to eliminate wrong answers

Option A is wrong because a single target group cannot support blue/green deployments; it would force an in-place update, which defeats the purpose of having separate environments for traffic shifting and rollback. Option C is wrong because three target groups are not required; the blue/green model only needs one for the current version and one for the new version, with no third group needed for routing or testing. Option D is wrong because four target groups are excessive and would add unnecessary complexity; the standard blue/green deployment with ECS and CodeDeploy uses exactly two target groups.

Practice this question →
118
Multi-Selectmedium

A company is deploying a critical application using AWS CodeDeploy. To minimize downtime, they want to perform a blue/green deployment. Which TWO strategies should they implement?

Select 2 answers
A.Create an Elastic Load Balancer to route traffic between the blue and green environments.
B.Use an Amazon Route 53 weighted routing policy to gradually shift traffic.
C.Configure an AWS Lambda function to perform A/B testing during deployment.
D.Use an Amazon CloudFront distribution with multiple origins.
E.Ensure the new instances are registered with the target group before switching traffic.
AnswersA, E

An Elastic Load Balancer is essential to an AWS CodeDeploy blue/green deployment because CodeDeploy uses it as the traffic-control mechanism. The deployment registers the new environment's instances with a replacement target group, allows them to pass health checks, and then shifts production traffic away from the original target group. Without an ELB, there is no managed way to atomically reroute traffic and deregister the old instances.

Why this answer

Blue/green deployments with AWS CodeDeploy involve two environments: the current (blue) and the new (green). To minimize downtime, traffic must be seamlessly switched from blue to green. This is achieved by using an Elastic Load Balancer (ELB) to route traffic between the environments (option A).

Additionally, the new instances must be registered with the target group before traffic is switched (option E). Option B (Route53 weighted routing) is not the primary mechanism; CodeDeploy leverages the ELB for traffic shifting. Option C (Lambda for A/B testing) is unrelated to blue/green deployment.

Option D (CloudFront with multiple origins) can be used but is not a required strategy for CodeDeploy blue/green; it is more relevant for content delivery. Therefore, the correct strategies are A and E.

Practice this question →
119
MCQeasy

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The deployment must ensure zero downtime. Which ECS deployment configuration should be used?

A.Rolling update with a minimum healthy percent of 50% and maximum percent of 200%
B.Set the task placement strategy to REPLICA
C.Use the DAEMON scheduling strategy with a deployment circuit breaker
D.Blue/green deployment using AWS CodeDeploy
AnswerD

Blue/green deployment using AWS CodeDeploy is the most effective strategy for achieving zero-downtime updates for containerized applications on Amazon ECS. This method involves deploying the new application version (green environment) completely separate from the current production version (blue environment). Traffic is then atomically shifted from the blue to the green environment only after the new version has been thoroughly validated, allowing for quick rollback if issues arise, thus ensuring continuous service availability without user impact.

Why this answer

Blue/green deployment using AWS CodeDeploy is correct because it creates a separate, fully functional replacement environment (green) alongside the existing one (blue), allowing traffic to be switched instantly after validation. This ensures zero downtime by avoiding in-place updates that could temporarily reduce capacity or serve errors during the transition. For ECS Fargate, CodeDeploy orchestrates the shift using an AppSpec file and can automatically roll back on health check failures.

Exam trap

The trap here is that candidates assume a rolling update with high maximum percent (like 200%) guarantees zero downtime, but they overlook that the minimum healthy percent of 50% can still cause a capacity dip, and in-place updates inherently risk serving errors during the transition, whereas blue/green deployments provide true isolation and instant traffic switching.

How to eliminate wrong answers

Option A is wrong because a rolling update with minimum healthy percent of 50% and maximum percent of 200% can cause a brief period where only 50% of the original tasks remain, potentially reducing capacity and risking downtime if traffic spikes or tasks fail during the update. Option B is wrong because setting the task placement strategy to REPLICA only controls how tasks are distributed across Availability Zones, not the deployment method, and does not inherently provide zero-downtime updates. Option C is wrong because the DAEMON scheduling strategy is not supported with the Fargate launch type (it is only for EC2), and a deployment circuit breaker only stops a failed deployment but does not prevent downtime during the update process.

Practice this question →
120
MCQeasy

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer wants to ensure that the Lambda function's environment variables are encrypted at rest. What is the most straightforward way to achieve this?

A.No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.
B.Enable encryption in the SAM template using the 'Encrypt' property.
C.Modify the Lambda function's code to encrypt environment variables before deployment.
D.Create a customer managed KMS key and specify it in the SAM template.
AnswerA

AWS Lambda automatically encrypts environment variables at rest using an AWS Key Management Service (KMS) key. When deploying a serverless application with SAM, this default behavior applies, meaning the environment variables specified in your SAM template are automatically encrypted by an AWS-managed KMS key without any explicit configuration. Therefore, no additional action is required from the developer to ensure these variables are encrypted while stored.

Why this answer

AWS SAM, by default, encrypts Lambda function environment variables at rest using an AWS managed KMS key (aws/lambda). This is a built-in behavior of the Lambda service, so no additional configuration is required in the SAM template to achieve encryption at rest. The developer does not need to take any action beyond deploying the function.

Exam trap

The trap here is that candidates often assume they must explicitly enable encryption or use a custom KMS key, overlooking that Lambda automatically encrypts environment variables at rest by default with an AWS managed key.

How to eliminate wrong answers

Option B is wrong because there is no 'Encrypt' property in the SAM template for environment variables; encryption at rest is automatic and not controlled via a template property. Option C is wrong because encrypting environment variables in code before deployment is unnecessary and would require the function to decrypt them at runtime, adding complexity without benefit since Lambda already handles encryption at rest. Option D is wrong because while you can specify a customer managed KMS key for encryption, it is not the most straightforward way; the default AWS managed key works without any extra configuration.

Practice this question →
121
MCQmedium

A developer is deploying a Lambda function that processes images uploaded to an S3 bucket. The function is triggered by S3 events. After deployment, the function does not execute when new images are uploaded. What is the MOST likely cause?

A.The S3 bucket does not have an event notification configured for the Lambda function.
B.The Lambda function memory is set too low.
C.The Lambda function does not have permission to read from the S3 bucket.
D.The Lambda function is not in the same region as the S3 bucket.
AnswerA

For an AWS Lambda function to be automatically invoked in response to an S3 object event, such as an image upload, the S3 bucket must have a specific event notification configured. This configuration explicitly links the desired S3 event type (e.g., s3:ObjectCreated:*) to the target Lambda function. Without this crucial setup, S3 will not know to send an invocation request to the Lambda service, preventing the function from ever being triggered.

Why this answer

The most likely cause is that the S3 bucket does not have an event notification configured to invoke the Lambda function. S3 event notifications must be explicitly set on the bucket to trigger a Lambda function when objects are created; without this configuration, S3 will not send any invocation request to Lambda, regardless of the function's permissions or settings.

Exam trap

The trap here is that candidates often confuse the trigger configuration (S3 event notification) with the function's permissions (IAM execution role), assuming that if the function has read access to S3, it will automatically be triggered, when in fact the event notification is a separate, mandatory setup step.

How to eliminate wrong answers

Option B is wrong because low memory affects execution performance (e.g., duration, CPU allocation) but does not prevent the function from being triggered; the trigger mechanism is independent of memory settings. Option C is wrong because the Lambda function does not need permission to read from the S3 bucket to be triggered; the S3 event notification invokes the function via a resource-based policy, and the function only needs read permissions if it explicitly calls S3 GetObject in its code. Option D is wrong because S3 event notifications can invoke Lambda functions across regions; cross-region triggers are supported as long as the Lambda function's resource-based policy allows the S3 bucket's account to invoke it.

Practice this question →
122
Multi-Selecthard

A CloudFormation stack update fails and rolls back. Which two practices help diagnose and reduce future deployment risk?

Select 2 answers
A.Review stack events and resource status reasons
B.Delete the stack immediately without checking events
C.Create and inspect change sets before high-risk updates
D.Disable rollback for all production deployments permanently
AnswersA, C

Correct for the stated requirement.

Why this answer

Reviewing stack events and resource status reasons in CloudFormation provides detailed error messages for each resource that failed during the update. This allows you to pinpoint the exact cause of the failure, such as insufficient IAM permissions, a resource limit exceeded, or a dependency conflict. Analyzing these events is essential for diagnosing issues and preventing similar failures in future deployments.

Exam trap

The trap here is that candidates may think disabling rollback is a valid troubleshooting step for production, but the exam emphasizes that rollback is a safety feature that should not be permanently disabled, as it prevents partial updates that could leave infrastructure in an inconsistent state.

Practice this question →
123
MCQmedium

A company is deploying a microservices application on Amazon ECS using the Fargate launch type. The application includes a service that must process messages from an Amazon SQS queue. The developer wants to ensure that the service scales based on the number of messages in the queue. Which scaling solution should the developer implement?

A.Configure DynamoDB auto scaling to adjust read capacity based on queue depth.
B.Use Amazon ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue backlog per task.
C.Configure AWS Lambda with reserved concurrency and trigger it from the SQS queue.
D.Use Application Auto Scaling with a scheduled scaling policy to increase the number of tasks during peak hours.
AnswerB

Amazon ECS Service Auto Scaling, when configured with a target tracking policy, directly scales the number of ECS tasks in a service. By targeting a specific metric like the SQS queue backlog per task, the service can dynamically adjust capacity to maintain a consistent processing rate. This ensures that as the queue depth increases or decreases, the number of tasks scales proportionally to efficiently process messages, preventing bottlenecks and optimizing resource utilization.

Why this answer

Amazon ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue backlog per task (calculated as ApproximateNumberOfMessages divided by the number of running tasks) directly correlates the number of ECS tasks to the queue depth. This ensures the service scales up when messages accumulate and scales down when the backlog clears, using a predefined or custom metric that reflects the workload.

Exam trap

The trap here is that candidates often confuse service auto scaling with scheduled scaling or assume Lambda is the only serverless option, missing that ECS with Fargate can scale based on SQS backlog using a target tracking policy.

How to eliminate wrong answers

Option A is wrong because DynamoDB auto scaling adjusts read/write capacity for a DynamoDB table, not for an ECS service or SQS queue depth, and it cannot scale compute tasks. Option C is wrong because while Lambda can be triggered from SQS, the question specifically asks for scaling the ECS service, not replacing it with Lambda; reserved concurrency controls Lambda execution capacity, not ECS task count. Option D is wrong because a scheduled scaling policy adjusts tasks based on time, not on the actual SQS queue depth, so it cannot dynamically respond to varying message volumes.

Practice this question →
124
MCQhard

A company uses AWS CloudFormation to deploy infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the DB instance class without downtime. Which update policy should they use?

A.UseLatestRestorableTime
B.AutoScalingRollingUpdate
C.UpdateReplacePolicy
D.CreationPolicy
AnswerA

UseLatestRestorableTime is not an update policy. It is a property used to restore from the latest restorable snapshot when creating a read replica or performing a restore operation. It does not affect updates to an existing DB instance class and does not minimize downtime.

Why this answer

None of the listed options is correct. AWS CloudFormation does not have a built-in update policy that avoids downtime when changing the DB instance class of an RDS instance. To modify the instance class with minimal downtime, you can use a custom approach such as creating a read replica, promoting it, and updating DNS, or modifying the DB instance directly (which typically involves brief downtime).

The options presented are either invalid or unrelated: UseLatestRestorableTime is a property for restoring from a snapshot or creating read replicas, not an update policy; AutoScalingRollingUpdate is for Auto Scaling groups; UpdateReplacePolicy controls replacement behavior; CreationPolicy controls creation signals.

Exam trap

The trap is to assume that one of the listed options is a valid CloudFormation update policy for RDS. In fact, none of the provided options is a valid update policy for changing an RDS DB instance class, and UseLatestRestorableTime is not an update policy at all. CloudFormation does not have a built-in update policy that avoids downtime for RDS instance class changes.

How to eliminate wrong answers

Option B is wrong because `AutoScalingRollingUpdate` is a policy for Auto Scaling groups, not for RDS DB instances; it updates instances in a rolling fashion but does not apply to database resources. Option C is wrong because `UpdateReplacePolicy` is not a valid CloudFormation policy; the correct attribute is `DeletionPolicy` (which controls what happens when a resource is deleted), and `UpdateReplacePolicy` does not exist. Option D is wrong because `CreationPolicy` is used to control the creation of resources (e.g., waiting for signals from EC2 instances), not for updating existing resources like RDS instances.

Practice this question →
125
MCQhard

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The deployment must ensure that a minimum number of instances are always running and healthy. The developer wants to deploy to 10 instances. Which deployment configuration should the developer use?

A.CodeDeployDefault.OneAtATime
B.CodeDeployDefault.AllAtOnce
C.CodeDeployDefault.HalfAtATime
D.CodeDeployDefault.MinHealthyHostsPercentage: 90
AnswerA

This configuration ensures that only one instance is taken offline for deployment at any given time, maintaining the maximum possible number of healthy instances throughout the process. Specifically, it guarantees that N-1 instances remain healthy and serving traffic while one instance is updated and validated. This sequential approach is ideal for achieving zero-downtime deployments, minimizing service impact, and ensuring high availability for critical applications.

Why this answer

CodeDeployDefault.OneAtATime, is correct because it ensures that only one instance is updated at a time, which guarantees that a minimum number of instances (9 out of 10) remain healthy and running throughout the deployment. This configuration is ideal for maintaining high availability and meeting strict uptime requirements.

Exam trap

The trap here is that candidates often mistake 'CodeDeployDefault.MinHealthyHostsPercentage: 90' for a predefined deployment configuration. In reality, the only predefined configurations are CodeDeployDefault.OneAtATime, CodeDeployDefault.HalfAtATime, and CodeDeployDefault.AllAtOnce. 'MinHealthyHostsPercentage' is a parameter used to define custom configurations, not a standalone predefined name.

How to eliminate wrong answers

Option B (CodeDeployDefault.AllAtOnce) is wrong because it deploys to all 10 instances simultaneously, which can cause a complete outage if the deployment fails or the application has issues. Option C (CodeDeployDefault.HalfAtATime) is wrong because it deploys to 5 instances at a time, which does not guarantee that a minimum number of instances (e.g., 9) are always running; it only ensures half are updated at once, potentially leaving only 5 healthy instances. Option D (CodeDeployDefault.MinHealthyHostsPercentage: 90) is wrong because it is not a valid predefined deployment configuration in AWS CodeDeploy; it is a custom configuration option that can be set via the API or CLI, but it is not a built-in named configuration like the others.

Practice this question →
126
MCQeasy

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway endpoint and an AWS Lambda function. The developer wants to define a stage name for the API Gateway deployment. Which section of the SAM template should the developer use?

A.Globals
B.Conditions
C.Outputs
D.Parameters
AnswerA

The `Globals` section in an AWS SAM template is specifically designed to define common properties that apply to all resources of a particular type within the template. For API Gateway resources, setting `Api.StageName` within the `Globals` section ensures that every API defined in the template will automatically use the specified stage name. This approach centralizes the configuration, making it efficient for a developer to apply a consistent stage name across all APIs in a serverless application.

Why this answer

The `Globals` section in an AWS SAM template allows you to define shared configuration settings that apply to all resources in the template. For API Gateway, you can set properties like `StageName` under `Globals.Api`, which will be inherited by all API Gateway resources defined in the template, ensuring consistent stage naming without repeating the configuration.

Exam trap

The trap here is that candidates often think stage names must be defined directly on the API Gateway resource (e.g., under `Properties` of `AWS::Serverless::Api`), but the `Globals` section is the correct and more efficient way to set shared API Gateway properties like `StageName` across the entire template.

How to eliminate wrong answers

Option B is wrong because the `Conditions` section is used to define conditions that control whether certain resources are created or properties are set, not to define API Gateway stage names. Option C is wrong because the `Outputs` section is used to declare values that are returned after the stack is created (e.g., API endpoint URLs), not to configure deployment properties like stage names. Option D is wrong because the `Parameters` section is used to accept custom input values at deployment time (e.g., environment names), but it does not directly define a stage name for API Gateway; you would still need to reference a parameter in the resource or Globals section to set the stage name.

Practice this question →
127
MCQhard

A company uses AWS OpsWorks for configuration management. They want to deploy a new application version to a stack. Which lifecycle event should they use to run deployment scripts?

A.Configure
B.Undeploy
C.Setup
D.Deploy
AnswerD

The "Deploy" event is the correct and designated lifecycle event in AWS OpsWorks for installing or updating an application on an instance. When this event is triggered, OpsWorks executes recipes designed to fetch application code from a specified repository, install necessary dependencies, configure web servers, and start application services. This ensures the application is correctly placed, configured, and made available to users.

Why this answer

The Deploy lifecycle event in AWS OpsWorks is specifically designed to run deployment scripts when you deploy a new application version to a stack. This event occurs after the application code has been installed, allowing you to execute custom scripts for tasks like database migrations, cache clearing, or service restarts. It is the correct choice because it aligns with the deployment phase of the application lifecycle.

Exam trap

The trap here is that candidates confuse the Deploy event with the Setup or Configure events, mistakenly thinking that code deployment happens during initial instance setup or configuration updates, rather than understanding that Deploy is the dedicated event for application version releases.

How to eliminate wrong answers

Option A is wrong because the Configure lifecycle event runs whenever an instance enters or leaves the online state, not for deploying application code; it is used for updating configuration files or adjusting settings based on the stack's current state. Option B is wrong because Undeploy is not a standard lifecycle event in AWS OpsWorks; the correct event for removing an application is the Shutdown lifecycle event, which runs when an instance is stopped or terminated. Option C is wrong because the Setup lifecycle event runs only once when an instance is first booted, to install packages and configure the instance, not for deploying new application versions.

Practice this question →
128
Multi-Selectmedium

A company uses AWS CodePipeline to deploy a web application. The pipeline has a Source stage (CodeCommit), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The developer wants to add a manual approval step before the Deploy stage. Which TWO configurations are required?

Select 2 answers
A.An Amazon SES identity to send emails.
B.An AWS Lambda function to send approval emails.
C.An Amazon CloudWatch alarm to trigger the approval.
D.An IAM role that allows CodePipeline to publish to the SNS topic.
E.An Amazon SNS topic to notify the approver.
AnswersD, E

An IAM role is essential for CodePipeline to interact with other AWS services, including Amazon SNS. The CodePipeline service role must be granted explicit `sns:Publish` permissions to the target SNS topic. Without this specific permission, CodePipeline would lack the necessary authorization to send notification messages to the SNS topic, preventing approvers from being alerted about pending actions.

Why this answer

CodePipeline requires an IAM role with permissions to publish to an SNS topic in order to send notifications for manual approval actions. This role is assumed by CodePipeline to invoke the SNS Publish API, which delivers the approval request message to the configured topic. Without this role, the pipeline cannot notify the approver, and the approval step will fail.

Option E is correct because an SNS topic is the mechanism used to send the approval notification to the approver. The SNS topic is configured in the approval stage of the pipeline, and it publishes a message that is sent to the subscribed approvers (e.g., via email). Both the SNS topic and the IAM role allowing CodePipeline to publish to it are required for the manual approval action to function.

Exam trap

The trap here is that candidates often think an email-sending service like SES or a custom Lambda function is required, but the exam expects you to know that CodePipeline natively integrates with SNS for approval notifications and only needs the correct IAM permissions.

Practice this question →
129
Multi-Selecthard

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment group has a deployment configuration of CodeDeployDefault.AllAtOnce. During a deployment, some instances fail the deployment. Which THREE actions should the developer take to improve the deployment health?

Select 3 answers
A.Increase the minimum number of healthy instances in the Auto Scaling group.
B.Change the deployment configuration to CodeDeployDefault.OneAtATime.
C.Configure a lifecycle hook to run validation tests before the instance is marked as healthy.
D.Use a larger instance type to handle the deployment load.
E.Add an Elastic Load Balancer health check to the deployment group.
AnswersB, C, E

CodeDeployDefault.OneAtATime is a deployment configuration that deploys the application revision to a single instance at a time, pausing between instances to verify that the deployment succeeded. This minimizes the number of instances taken out of service concurrently, so if the new revision fails health checks, only a small fraction of traffic is affected. It also provides an automatic rollback or stop opportunity before the entire fleet is updated.

Why this answer

The correct options are B, C, and E.

Option A is incorrect: Increasing the minimum number of healthy instances in the Auto Scaling group does not affect CodeDeploy's deployment health checks; it only controls ASG scaling behavior.

Option B is correct: Changing the deployment configuration to CodeDeployDefault.OneAtATime reduces risk by deploying to one instance at a time, allowing you to detect and halt failures before affecting more instances.

Option C is correct: Configuring a lifecycle hook to run validation tests ensures that an instance is only marked healthy after passing critical checks, preventing unhealthy instances from receiving traffic.

Option D is incorrect: Using a larger instance type does not address the underlying cause of deployment failures (e.g., script errors, misconfigurations) and is not a direct mechanism to improve deployment health.

Option E is correct: Adding an Elastic Load Balancer health check to the deployment group allows CodeDeploy to verify that instances are healthy before completing the deployment, enabling automatic rollback if checks fail.

Practice this question →
130
MCQmedium

A developer is deploying a new version of a Lambda function using AWS CodeDeploy with a linear canary deployment. The function is part of a serverless application. After the deployment starts, the developer notices that the new version is receiving only 10% of traffic initially, but after 10 minutes, the traffic increases to 100%. What should the developer do to ensure a more gradual traffic shift?

A.Use Lambda function aliases with weighted traffic shifting.
B.Use multiple Lambda function versions and update the alias gradually.
C.Configure AWS CloudFormation to update the Lambda alias.
D.Modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes instead of canary.
AnswerD

AWS CodeDeploy, when integrated with Lambda, provides robust capabilities for automating gradual deployments. A linear deployment configuration, such as "Linear10PercentEvery5Minutes," precisely matches the requirement for shifting traffic in fixed increments over a defined time period. This strategy allows for careful monitoring during the rollout and automatic rollback if issues are detected, ensuring a controlled and safe deployment process.

Why this answer

The developer is using a canary deployment configuration that shifts 10% of traffic immediately and then waits 10 minutes before shifting to 100%. To achieve a more gradual traffic shift, the developer should modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes, which will increment traffic by 10% every 5 minutes, taking 50 minutes to reach 100%.

Exam trap

The trap here is that candidates may confuse the built-in CodeDeploy deployment configurations (canary vs. linear) with manual alias weight adjustments, thinking that modifying the alias directly is the correct approach instead of changing the deployment configuration.

How to eliminate wrong answers

Option A is wrong because Lambda function aliases with weighted traffic shifting are used for manual or custom traffic routing, not for controlling the pace of a CodeDeploy deployment. Option B is wrong because using multiple Lambda function versions and updating the alias gradually is a manual process that does not leverage CodeDeploy's built-in deployment configurations for automated traffic shifting. Option C is wrong because configuring AWS CloudFormation to update the Lambda alias does not change the CodeDeploy deployment configuration; CloudFormation can manage the alias but cannot alter the traffic shift pattern defined in the CodeDeploy deployment group.

Practice this question →
131
MCQmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The developer has updated the application code and wants to deploy the new version with a rolling deployment strategy to minimize downtime. Which configuration should the developer use?

A.Set the deployment policy to 'Rolling'
B.Set the deployment policy to 'Immutable'
C.Set the deployment policy to 'All at once'
D.Set the deployment policy to 'Blue/green'
AnswerA

Setting the deployment policy to 'Rolling' is the correct approach for a rolling deployment strategy in AWS Elastic Beanstalk. This method updates instances in batches, ensuring that a portion of the application's capacity remains available to serve traffic throughout the deployment process. Elastic Beanstalk performs health checks on each batch before proceeding, minimizing downtime and allowing for a gradual, controlled update of the application version across the environment.

Why this answer

The 'Rolling' deployment policy in AWS Elastic Beanstalk updates instances in batches, moving the new application version into a subset of instances while keeping the rest serving traffic, which minimizes downtime by ensuring capacity is never fully reduced. This is the correct choice for a rolling update that balances speed and availability without requiring a full parallel environment.

Exam trap

The trap here is that candidates often confuse 'Rolling' with 'Blue/green' because both aim to reduce downtime, but Blue/green requires a separate environment and is not a rolling deployment within the same environment, while 'Immutable' is mistakenly chosen for its safety despite not being a rolling strategy.

How to eliminate wrong answers

Option B is wrong because 'Immutable' deployment launches a completely new Auto Scaling group with the new version, then swaps it with the old group, which minimizes risk but incurs higher cost and longer deployment time, not specifically minimizing downtime through a rolling approach. Option C is wrong because 'All at once' deploys the new version to all instances simultaneously, causing full downtime during the deployment as all instances are replaced at the same time. Option D is wrong because 'Blue/green' deploys a separate environment (green) alongside the existing one (blue), then swaps the CNAME, which avoids downtime but requires additional infrastructure and is not a rolling deployment strategy.

Practice this question →
132
MCQhard

A CodeDeploy deployment to Lambda should shift 10 percent of traffic for 10 minutes before full rollout and automatically roll back on alarms. Which configuration should be used?

A.Canary deployment preference with CloudWatch alarms
B.All-at-once deployment without alarms
C.Manual alias update after deployment
D.S3 static website deployment
AnswerA

A Canary deployment preference with CloudWatch alarms is the correct approach for shifting 10 percent of traffic to a new Lambda version. This strategy allows CodeDeploy to gradually shift a specified percentage of traffic (e.g., 10%) to the new function version, while the remaining traffic continues to serve the old version. Integrating CloudWatch alarms provides automated monitoring during this shift, triggering an automatic rollback to the stable version if predefined error thresholds or latency metrics are breached, ensuring a safe and controlled rollout.

Why this answer

A is correct because CodeDeploy's canary deployment preference shifts 10% of traffic to the new Lambda version for 10 minutes, then automatically shifts the remaining 90% after the specified interval. CloudWatch alarms are configured to trigger an automatic rollback if the alarm state is breached during the canary period, meeting the requirement for a gradual shift with automated rollback on failure.

Exam trap

The trap here is that candidates may confuse 'canary' with 'linear' deployments, or assume that any gradual shift (like 'linear10PercentEvery10Minutes') is equivalent, but the requirement specifies a single 10% shift for 10 minutes before full rollout, which matches the canary preference, not a linear incremental shift.

How to eliminate wrong answers

Option B is wrong because 'All-at-once' deploys all traffic instantly without a gradual 10% shift or a 10-minute waiting period, and it lacks any alarm-based rollback mechanism. Option C is wrong because manually updating an alias after deployment bypasses CodeDeploy's automated traffic shifting and rollback capabilities, requiring manual intervention for both the shift and any rollback. Option D is wrong because an S3 static website deployment is unrelated to Lambda traffic shifting; it is used for hosting static content, not for managing Lambda alias traffic or CodeDeploy deployments.

Practice this question →
133
Multi-Selecthard

A developer is deploying a containerized application on Amazon ECS with Fargate. The application requires access to an Amazon RDS database. The developer needs to securely pass database credentials to the container. Which THREE methods can the developer use?

Select 3 answers
A.Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.
B.Store the credentials in AWS Secrets Manager and reference the secret in the task definition.
C.Use IAM roles for tasks and retrieve credentials from AWS Secrets Manager at runtime.
D.Hardcode the credentials in the container image.
E.Define environment variables in the task definition with the credentials.
AnswersA, B, C

Parameter Store can securely store and inject secrets.

Why this answer

AWS Systems Manager Parameter Store allows you to securely store database credentials as parameters and reference them directly in the ECS task definition using the 'secrets' field. This enables Fargate to inject the credentials as environment variables at container startup without exposing them in plaintext.

Exam trap

The trap here is that candidates often confuse 'referencing a secret in the task definition' (which is secure and done at launch time) with 'defining environment variables directly in the task definition' (which is insecure), and they may also overlook that IAM roles for tasks can be used to retrieve secrets at runtime, not just at launch.

Practice this question →
134
MCQeasy

A developer needs to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should the developer use?

A.Amazon S3
B.Amazon Elastic Block Store (EBS)
C.Amazon RDS
D.Amazon Elastic File System (EFS)
AnswerD

Amazon Elastic File System (EFS) is a fully managed, scalable, and highly available network file system designed for use with AWS cloud services and on-premises resources. EFS provides a POSIX-compliant file system interface, allowing multiple EC2 instances, containers, or serverless functions to concurrently access and share the same data. This makes it an ideal solution for containerized applications that require persistent, shared storage across a fleet of instances.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances across different Availability Zones. This makes it the ideal choice for shared persistent storage when containers running on separate EC2 instances need to access the same data simultaneously.

Exam trap

The trap here is that candidates often confuse EBS with EFS, assuming EBS can be shared across instances, but EBS volumes are single-instance attachments by default, while EFS is purpose-built for concurrent multi-instance access.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system that can be mounted as a POSIX-compliant shared volume across EC2 instances. Option B is wrong because Amazon EBS volumes are block-level storage devices that can only be attached to a single EC2 instance at a time (unless using multi-attach EBS, which has strict limitations and is not designed for general-purpose shared file storage across many containers). Option C is wrong because Amazon RDS is a managed relational database service, not a file storage solution, and cannot be used as a shared file system for containerized applications.

Practice this question →
135
MCQmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is currently running a previous version. The developer uploads a new application version and deploys it to the environment. After the deployment, the environment health status turns 'Severe' and the new version is not accessible. The developer needs to quickly revert to the previous working version. What should the developer do?

A.Create a new environment with the previous version and swap CNAMEs.
B.Use the Elastic Beanstalk console to deploy the previous application version.
C.Roll back the environment configuration to a previous saved configuration.
D.Terminate the environment and launch a new one with the previous version.
AnswerB

Elastic Beanstalk maintains a history of all deployed application versions. When a new deployment introduces issues, the console or CLI allows direct selection and deployment of any previously uploaded and deployed application version. This process triggers an in-place update of the existing environment's instances, replacing the problematic code with the last known good version, thereby providing a quick and efficient rollback mechanism without requiring environment recreation.

Why this answer

Elastic Beanstalk allows you to deploy a previous application version directly from the console or CLI without creating a new environment. This action replaces the current application version in the existing environment, restoring the previously working code and resolving the health status. It is the fastest and most straightforward way to revert while preserving the environment's configuration and resources.

Exam trap

The trap here is that candidates confuse 'deploying a previous application version' (which directly fixes the code) with 'rolling back environment configuration' (which only affects settings), leading them to incorrectly choose Option C.

How to eliminate wrong answers

Option A is wrong because creating a new environment and swapping CNAMEs is an unnecessary, time-consuming process that introduces a new environment with its own resources and potential configuration drift, whereas a simple version rollback achieves the same result instantly. Option C is wrong because rolling back the environment configuration reverts settings like instance type or scaling rules, not the application version; the application code remains the broken version. Option D is wrong because terminating the environment and launching a new one with the previous version destroys all existing resources (e.g., RDS database if attached, logs, monitoring data) and requires reconfiguration, which is far more disruptive than a direct version deployment.

Practice this question →
136
MCQmedium

A development team is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with a 'HealthCheck' error. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). What is the MOST likely cause of this error?

A.The ALB target group health check is misconfigured or the application is not responding to health check requests.
B.The EC2 instances do not have the correct IAM instance profile attached.
C.The deployment configuration is set to 'AllAtOnce' which does not support health checks.
D.The deployment group is not configured with the ALB target group.
AnswerA

CodeDeploy integrates directly with an Application Load Balancer (ALB) to manage traffic during deployments and validate instance health. During a deployment, CodeDeploy monitors the health of instances in the target group using the ALB's configured health checks. If these health checks fail, either due to an incorrect configuration (e.g., wrong port, path, or expected response) or because the deployed application itself is not starting correctly or responding to the health check requests, CodeDeploy will detect this and halt the deployment, often initiating a rollback. This critical mechanism ensures that only healthy instances receive production traffic, preventing service disruptions.

Why this answer

The 'HealthCheck' error in AWS CodeDeploy indicates that the deployment failed because the target group health checks are not passing. This typically occurs when the ALB health check path or configuration does not match the application's expected response, or the application is not running correctly on the instances, causing the ALB to mark them as unhealthy. CodeDeploy monitors the ALB target group health status during deployment and will fail if instances do not become healthy within the configured timeout.

Exam trap

The trap here is that candidates often confuse a 'HealthCheck' error with a permissions or configuration issue, but the error specifically points to the ALB health check failing, not to IAM roles or deployment group setup.

How to eliminate wrong answers

Option B is wrong because an incorrect IAM instance profile would cause the CodeDeploy agent to fail to communicate with the service or to download the revision, resulting in a different error (e.g., 'InstanceAgent' or 'AccessDenied'), not a 'HealthCheck' error. Option C is wrong because the 'AllAtOnce' deployment configuration does support health checks; it simply deploys to all instances simultaneously, but CodeDeploy still validates health status against the ALB target group. Option D is wrong because if the deployment group were not configured with the ALB target group, CodeDeploy would not perform health checks at all, and the error would be about missing target group configuration, not a health check failure.

Practice this question →
137
MCQeasy

A developer is deploying a new version of a Lambda function using the AWS CLI. Which command should the developer use to update the function code?

A.aws lambda update-function-code
B.aws lambda update-function-configuration
C.aws lambda invoke
D.aws lambda create-function
AnswerA

aws lambda update-function-code is the correct command because it uploads a new deployment package (ZIP file or container image) to the Lambda service, replacing the code currently associated with the function. This command updates the function's code while preserving its configuration, and it operates on the $LATEST version unless you specify a different qualifying qualifier, making it the proper way to deploy a new code version.

Why this answer

The `update-function-code` command updates the code of a Lambda function. Option B (`update-function-configuration`) updates configuration settings only, not the code. Option C (`invoke`) is for invoking the function, and option D (`create-function`) is for creating a new function, not updating an existing one.

Practice this question →
138
MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires a relational database. The developer wants to ensure that the database is not accidentally deleted when the Elastic Beanstalk environment is terminated. Which approach should the developer take?

A.Create the database as part of the Elastic Beanstalk environment by adding an RDS database configuration in the .ebextensions.
B.Create the RDS instance outside of Elastic Beanstalk and configure the application to connect to it using environment variables.
C.Use an Amazon DynamoDB table instead of a relational database.
D.Configure a retention policy on the RDS instance within the Elastic Beanstalk environment.
AnswerB

The database is independent of the environment lifecycle, so it will not be deleted when the environment is terminated.

Why this answer

Creating the RDS instance outside of Elastic Beanstalk decouples the database lifecycle from the environment lifecycle. When the Elastic Beanstalk environment is terminated, the external RDS instance remains intact and is not deleted. The application can connect to it using environment variables configured in the Elastic Beanstalk environment, ensuring persistence of data.

Exam trap

The trap here is that candidates may assume that adding a retention policy (Option D) is possible within Elastic Beanstalk, but Elastic Beanstalk does not expose a retention policy for RDS instances created as part of the environment; the database is always deleted with the environment unless it is created externally.

How to eliminate wrong answers

Option A is wrong because adding an RDS database configuration in .ebextensions creates the database as part of the Elastic Beanstalk environment, which means it will be deleted when the environment is terminated. Option C is wrong because DynamoDB is a NoSQL database, not a relational database, and the question explicitly requires a relational database. Option D is wrong because Elastic Beanstalk does not support configuring a retention policy on an RDS instance created within the environment; the database is tied to the environment's lifecycle and will be deleted upon termination.

Practice this question →
139
Multi-Selectmedium

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Select 2 answers
A.View the stack events in the CloudFormation console.
B.Check the stack outputs.
C.Delete the stack and recreate it with the same parameters.
D.Review the stack template for logical errors.
E.Check AWS CloudTrail logs for the stack creation attempt.
AnswersA, D

Viewing stack events in the CloudFormation console is the direct diagnostic path. During stack creation, every resource activity is logged as an event with a status (CREATE_IN_PROGRESS, CREATE_FAILED, etc.) and a 'status reason' field. That status reason for the first failed resource contains the precise underlying error returned by the AWS service (for example, an EC2 error or an IAM permission problem), making it the authoritative source for troubleshooting a failed stack.

Why this answer

Options A and D are correct. A: Viewing stack events (Events tab) shows error messages for each resource, which can indicate which resource failed and why. D: Reviewing the stack template for logical errors can help identify issues like missing dependencies or incorrect parameter values.

Option B is wrong because stack outputs are only available after successful creation; during a failure, outputs are not generated. Option C is wrong because deleting and recreating the stack with the same parameters will likely result in the same failure and also removes the stack's logs and events, losing troubleshooting information. Option E is wrong because CloudTrail logs API calls made to AWS, but CloudFormation-specific errors during resource creation are not detailed in CloudTrail; stack events provide more relevant information.

Practice this question →
140
MCQmedium

A developer is using AWS CodeBuild to build a Java application. The buildspec.yml file currently runs unit tests. The developer wants to generate a code coverage report and publish it to the CodeBuild console for analysis. Which CodeBuild feature should be used?

A.Test reports
B.Build artifacts
C.Amazon CloudWatch Logs
D.Amazon S3 access logs
AnswerA

AWS CodeBuild's "Test reports" feature is specifically designed to ingest and display structured test results and code coverage metrics directly within the CodeBuild console. By configuring the `reports` section in the `buildspec.yml` to point to test output files (e.g., JUnit XML, JaCoCo XML), CodeBuild processes these files to generate visual reports, including pass/fail rates, test duration, and code coverage percentages, providing immediate feedback on application quality.

Why this answer

AWS CodeBuild's test reports feature allows developers to create reports from test result files, including code coverage reports, and publish them to the CodeBuild console for analysis. This feature supports various report formats such as JaCoCo, Cobertura, and SimpleCov, enabling the developer to visualize coverage metrics directly in the console without external tools.

Exam trap

The trap here is that candidates confuse build artifacts (which store compiled binaries) with test reports (which store structured test and coverage data), or assume CloudWatch Logs can visualize coverage metrics when it only provides raw log text.

How to eliminate wrong answers

Option B is wrong because build artifacts are used to store output files (e.g., JARs, WARs) in Amazon S3 or CodeBuild, not for generating or publishing test or coverage reports. Option C is wrong because Amazon CloudWatch Logs captures build logs and output from CodeBuild runs, but it does not parse or display structured code coverage reports. Option D is wrong because Amazon S3 access logs track requests made to an S3 bucket, not CodeBuild test results or coverage data.

Practice this question →
141
MCQhard

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

A.The Lambda function's IAM role does not have permission to access the library.
B.The Lambda function's handler configuration is incorrect.
C.The native library is compiled for a different operating system than Lambda (Amazon Linux).
D.The Lambda function's timeout is too short.
AnswerC

AWS Lambda execution environments are based on Amazon Linux, requiring any native libraries (e.g., C/C++ compiled into .so files) to be compiled specifically for this operating system and its architecture (x86_64 or arm64). If a library is compiled on a different OS, such as macOS or Windows, or even a different Linux distribution, its binary format and system dependencies will be incompatible. This incompatibility leads to an ImportError when the Lambda runtime attempts to load the shared object, as it cannot resolve the necessary symbols or link against the correct system libraries.

Why this answer

AWS Lambda runs on Amazon Linux, which uses a different kernel and C runtime than typical local development environments (e.g., macOS or Windows). Native libraries compiled for a local OS will not be compatible with Lambda's execution environment, causing the 'Unable to import module' error. The developer must compile the native library on Amazon Linux or use a Lambda-compatible container to ensure binary compatibility.

Exam trap

The trap here is that candidates often confuse IAM permissions with filesystem access, or assume the error is a code-level issue (handler or timeout) rather than recognizing the OS-level binary incompatibility unique to Lambda's Amazon Linux environment.

How to eliminate wrong answers

Option A is wrong because IAM roles control permissions to AWS services and resources, not the ability to import or execute local native libraries within the Lambda runtime. Option B is wrong because the handler configuration (e.g., 'index.handler') is unrelated to native library import failures; a misconfigured handler would produce a 'Handler not found' error, not an import error. Option D is wrong because a timeout error occurs during function execution, not during the initialization/import phase; the 'Unable to import module' error happens before the handler runs.

Practice this question →
142
MCQeasy

A development team uses AWS Elastic Beanstalk to deploy a web application. They want to perform a blue/green deployment to minimize downtime. What should they do to implement this?

A.Create an Auto Scaling group and manually replace instances.
B.Update the existing environment with the new version and set the deployment policy to 'Rolling'.
C.Use AWS CodeDeploy to perform a blue/green deployment on the EC2 instances.
D.Create a new environment, deploy the new version, and then swap the environment URLs.
AnswerD

This is the standard blue/green deployment in Elastic Beanstalk.

Why this answer

Blue/green deployment in Elastic Beanstalk is achieved by creating a separate environment (the green environment) with the new application version, then swapping the CNAME records (URLs) of the two environments. This instantly routes traffic from the old (blue) environment to the new (green) environment with zero downtime, and allows quick rollback by swapping back.

Exam trap

The trap here is that candidates confuse the built-in Elastic Beanstalk blue/green deployment (environment swap) with the deployment policies (e.g., Rolling, Immutable) that operate within a single environment, or they incorrectly assume CodeDeploy is the only way to perform blue/green deployments.

How to eliminate wrong answers

Option A is wrong because manually replacing instances in an Auto Scaling group is not a blue/green deployment; it is a manual, error-prone process that does not provide instant traffic switching or easy rollback. Option B is wrong because updating the existing environment with a 'Rolling' deployment policy updates instances in batches within the same environment, which does not create a separate, isolated environment for the new version and still risks partial downtime. Option C is wrong because AWS CodeDeploy is a separate service that can perform blue/green deployments on EC2 instances, but the question specifically asks about using AWS Elastic Beanstalk, which has its own built-in blue/green deployment mechanism via environment URL swaps.

Practice this question →
143
MCQeasy

A developer is deploying a web application on AWS Elastic Beanstalk. The application needs to run on multiple instances behind a load balancer. Which deployment policy will cause the LEAST downtime?

A.All at once
B.Rolling
C.Rolling with additional batch
D.Immutable
AnswerC

Zero downtime.

Why this answer

Rolling with additional batch (C) is the correct deployment policy for minimizing downtime because it first launches a full new batch of instances in addition to the existing ones, then shifts traffic to the new instances before terminating the old ones. This ensures that the full capacity remains available throughout the deployment, unlike other policies that temporarily reduce capacity or require a full replacement.

Exam trap

The trap is that candidates often assume immutable deployments cause the least downtime. Immutable deployments provide zero downtime by launching a new set of instances and swapping the CNAME atomically, but they require creating a full new environment and use more resources. Rolling with additional batch also provides zero downtime by adding extra capacity before removing old instances, ensuring full capacity is maintained throughout the deployment.

The key distinction is that rolling with additional batch avoids downtime without requiring a full new environment, while all-at-once and rolling deployments can temporarily reduce capacity or cause interruption.

How to eliminate wrong answers

Option A (All at once) is wrong because it replaces all instances simultaneously, causing complete downtime during the deployment window. Option B (Rolling) is wrong because it updates instances in batches, temporarily reducing capacity by the batch size during each update cycle, which can cause partial downtime if traffic exceeds remaining capacity. Option D (Immutable) is wrong because although it creates a new Auto Scaling group and swaps traffic, the old instances are terminated only after the new ones are healthy, but the initial launch of the new group takes time and the swap can cause a brief traffic interruption if not managed with DNS or health checks.

Practice this question →
144
MCQhard

A developer is deploying a microservices application on Amazon ECS with the Fargate launch type. The application uses an Application Load Balancer (ALB) to route traffic. The developer wants to perform a blue/green deployment with automated traffic shifting using AWS CodeDeploy. What is the minimum number of target groups required for this deployment?

A.One
B.Two
C.Three
D.Four
AnswerB

For a successful blue/green deployment with AWS CodeDeploy and ECS, two distinct target groups are essential. One target group is initially associated with the "blue" (current production) task set, while the second target group is associated with the "green" (new version) task set. AWS CodeDeploy orchestrates the traffic shift by updating the listener rules on the Application Load Balancer (ALB) to gradually or instantly direct traffic from the blue target group to the green target group. This setup facilitates seamless cutovers and provides a straightforward rollback mechanism.

Why this answer

In a blue/green deployment with AWS CodeDeploy and an Application Load Balancer (ALB) on Amazon ECS (Fargate), two target groups are required: one for the 'blue' (current) environment and one for the 'green' (new) environment. CodeDeploy shifts traffic from the blue target group to the green target group by updating the ALB listener rules, allowing zero-downtime deployments and automated rollback if needed.

Exam trap

The trap here is that candidates often confuse blue/green deployments with canary deployments or assume that a single target group with multiple ports can serve both environments, but AWS CodeDeploy for ECS explicitly requires two distinct target groups to manage traffic shifting and rollback.

How to eliminate wrong answers

Option A is wrong because a single target group cannot differentiate between the blue and green environments; traffic shifting requires two separate target groups to route traffic to the old and new task sets independently. Option C is wrong because three target groups are unnecessary; the blue/green deployment model only needs one target group for each environment (two total), and no additional target group is required for the ALB listener. Option D is wrong because four target groups are excessive; the deployment does not require any extra target groups beyond the two used for blue and green.

Practice this question →
145
MCQmedium

A developer uses AWS CodeBuild to run unit tests. The build succeeds but the tests fail. The developer wants to fail the build if tests fail. What should the developer do?

A.Ensure the test command exits with a non-zero status on failure.
B.Run tests in the post_build phase.
C.Set the command to always exit 0.
D.Enable build badges.
AnswerA

AWS CodeBuild determines the success or failure of a build step based on the exit code of the executed command. A non-zero exit status, by convention in Unix-like systems, signals an error or failure. Therefore, configuring the test runner to return a non-zero exit code when tests fail will correctly propagate the test failure to CodeBuild, causing the entire build to fail and alert developers to issues. This mechanism is fundamental for automated CI/CD pipelines to accurately reflect the health of the codebase.

Why this answer

In CodeBuild, the build phase succeeds or fails based on the exit code of the commands in the buildspec. By default, if a test command exits with a non-zero status, CodeBuild marks the build as FAILED. Therefore, ensuring the test command exits with a non-zero status on failure is the correct approach to fail the build when tests fail.

Exam trap

The trap here is that candidates may think moving tests to a different phase (post_build) or enabling badges will fix the issue, but the core mechanism is the exit code of the command, not the phase or visual indicators.

How to eliminate wrong answers

Option B is wrong because running tests in the post_build phase does not change the exit code behavior; the post_build phase also respects exit codes, but the issue is about the test command's exit status, not the phase. Option C is wrong because setting the command to always exit 0 would suppress the failure indication, causing the build to succeed even when tests fail, which is the opposite of the desired outcome. Option D is wrong because enabling build badges only adds a visual status badge to the repository; it does not affect build success or failure behavior.

Practice this question →
146
MCQeasy

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to read configuration data from an Amazon S3 bucket. How should the developer securely provide the S3 bucket name to the container at runtime?

A.Define an environment variable in the ECS task definition with the bucket name.
B.Hardcode the bucket name in the application code.
C.Use AWS Systems Manager Parameter Store and retrieve the bucket name at startup.
D.Store the bucket name in the container image's environment file.
AnswerA

Defining the bucket name as an environment variable within the ECS task definition is the recommended practice for injecting configuration. This approach decouples the application code from environment-specific details, allowing the same container image to be used across development, staging, and production environments. The containerized application can then easily access this value at runtime through standard environment variable retrieval mechanisms, promoting flexibility and maintainability without requiring code changes or image rebuilds.

Why this answer

Defining an environment variable in the ECS task definition is the simplest and most secure way to inject the S3 bucket name into the container at runtime. Environment variables are passed to the container when it starts, and they can be stored in the task definition itself or referenced from AWS Secrets Manager or Systems Manager Parameter Store for sensitive values. This approach avoids hardcoding and keeps the configuration decoupled from the application code.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing AWS Systems Manager Parameter Store for all configuration data, even when the value is not sensitive and a simpler environment variable suffices, leading to unnecessary complexity and potential startup delays.

How to eliminate wrong answers

Option B is wrong because hardcoding the bucket name in the application code violates the principle of configuration externalization, making the application inflexible and requiring code changes for different environments. Option C is wrong because while Systems Manager Parameter Store can securely store the bucket name, it requires additional SDK calls and IAM permissions at startup, adding unnecessary complexity for a non-sensitive value like a bucket name; environment variables are more straightforward. Option D is wrong because storing the bucket name in the container image's environment file embeds configuration into the image, which breaks immutability and forces rebuilding the image for any configuration change, contrary to best practices for containerized applications.

Practice this question →
147
MCQmedium

A developer is using AWS CodeDeploy to deploy an application to a fleet of EC2 instances in an Auto Scaling group. The application must remain available during the deployment. The developer wants to update one instance at a time, ensuring that only one instance is taken offline at any moment. Which deployment configuration should the developer choose?

A.CodeDeployDefault.OneAtATime
B.CodeDeployDefault.HalfAtATime
C.CodeDeployDefault.AllAtOnce
D.CodeDeployDefault.LambdaCanary10Percent5Minutes
AnswerA

The CodeDeployDefault.OneAtATime configuration deploys application revisions to exactly one EC2 instance at a time within the target fleet. This strategy ensures maximum application availability during deployments, as only a single instance is ever out of service or being updated at any given moment. While slower, it significantly minimizes the risk of widespread service disruption and is ideal for critical applications requiring continuous uptime.

Why this answer

CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application to only one instance at a time, ensuring that the remaining instances continue to serve traffic. This matches the requirement to take only one instance offline at any moment, preserving high availability throughout the deployment.

Exam trap

The trap here is that candidates may confuse 'one at a time' with 'half at a time' or 'all at once' due to misreading the requirement for minimal disruption, or they may incorrectly apply a Lambda-specific configuration to an EC2 deployment.

How to eliminate wrong answers

Option B is wrong because CodeDeployDefault.HalfAtATime deploys to half of the instances simultaneously, which would take multiple instances offline at once, violating the requirement to update only one instance at a time. Option C is wrong because CodeDeployDefault.AllAtOnce deploys to all instances concurrently, taking the entire fleet offline simultaneously and causing downtime. Option D is wrong because CodeDeployDefault.LambdaCanary10Percent5Minutes is a deployment configuration for AWS Lambda functions, not for EC2 instances in an Auto Scaling group, and it uses a canary traffic-shifting pattern irrelevant to EC2-based deployments.

Practice this question →
148
MCQhard

A team is using AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Deploy stage uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The pipeline runs successfully, but the application still serves the old version. What is the most likely cause?

A.The CodeDeploy deployment group is associated with a different Auto Scaling group than the one serving traffic.
B.The load balancer's target group is not pointing to the correct instances.
C.The build artifact in the Source stage is corrupted.
D.The CodeBuild stage failed silently and did not produce a new artifact.
AnswerA

This scenario directly explains why the old version is served. If the CodeDeploy deployment group targets an Auto Scaling group that is *not* currently registered with the load balancer or is an old, inactive group, the deployment will succeed on those instances. However, the load balancer will continue routing traffic to the *active* Auto Scaling group, which still hosts the previous application version, making the new deployment invisible to users.

Why this answer

The most likely cause is that the CodeDeploy deployment group is associated with a different Auto Scaling group than the one actually serving traffic. Even though the pipeline runs successfully, CodeDeploy deploys the new application revision only to instances in the Auto Scaling group linked to its deployment group. If the deployment group targets a different Auto Scaling group (e.g., a staging group) while the live traffic is served by another group (e.g., production), the old version remains on the production instances.

Exam trap

The trap here is that candidates assume a successful pipeline run guarantees the new version is live, overlooking that CodeDeploy's deployment group configuration determines which Auto Scaling group receives the update.

How to eliminate wrong answers

Option B is wrong because if the load balancer's target group were not pointing to the correct instances, the application would likely be unreachable or return errors, not serve an old version. Option C is wrong because a corrupted build artifact in the Source stage would typically cause the pipeline to fail at the Build or Deploy stage, not complete successfully. Option D is wrong because if the CodeBuild stage failed silently, the pipeline would not proceed to the Deploy stage, and the deployment would not run at all.

Practice this question →
149
MCQhard

A company is using AWS CloudFormation to manage infrastructure. The developer wants to update a stack but needs to prevent specific resources from being replaced. What CloudFormation feature should the developer use?

A.Use a custom resource to manage the update logic.
B.Apply a stack policy that denies updates to the specific resources.
C.Create a change set to review the changes before execution.
D.Use a deletion policy attribute on the resources to protect them.
AnswerB

A stack policy is a JSON document that defines permissions for update actions on resources within a CloudFormation stack. By applying a stack policy with an explicit "Deny" statement for the "Update" action on specific logical resource IDs or resource types, you can effectively prevent CloudFormation from performing any modifications to those protected resources, ensuring their immutability.

Why this answer

A stack policy is a JSON-based policy that defines which resources in a CloudFormation stack can be updated, replaced, or deleted. By applying a stack policy that denies updates to specific resources, the developer can prevent those resources from being replaced during a stack update, even if the template change would normally trigger a replacement.

Exam trap

The trap here is confusing a deletion policy (which only protects against stack deletion) with a stack policy (which controls update-time replacement), leading candidates to incorrectly choose Option D.

How to eliminate wrong answers

Option A is wrong because custom resources are used to implement custom provisioning logic (e.g., calling an external API) during stack operations, not to prevent resource replacement. Option C is wrong because a change set only allows you to preview the changes that will be made; it does not prevent specific resources from being replaced. Option D is wrong because a deletion policy (e.g., Retain, Snapshot) only controls what happens when a resource is deleted from the stack; it does not prevent the resource from being replaced during an update.

Practice this question →
150
Multi-Selecthard

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Select 3 answers
A.An Amazon ECS cluster
B.An Application Load Balancer
C.An AWS CodeDeploy deployment group
D.An AWS CodeDeploy application
E.A target tracking scaling policy
AnswersB, C, D

The ALB is used to shift traffic between blue and green task sets.

Why this answer

An Application Load Balancer (ALB) is required for blue/green deployments on Amazon ECS with AWS CodeDeploy because it routes traffic between the 'blue' (current) and 'green' (new) task sets. CodeDeploy uses the ALB's target groups to shift traffic incrementally during the deployment, enabling zero-downtime updates. Without an ALB, there is no mechanism to direct production traffic to the new task set while keeping the old one available for rollback.

Exam trap

The trap here is that candidates often assume the ECS cluster itself is a required component for the deployment, but CodeDeploy treats the cluster as existing infrastructure and does not require it as a parameter in the deployment group; the cluster is implicitly referenced via the ECS service, not as a separate required component.

Practice this question →
← PreviousPage 2 of 3 · 169 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Deployment questions.

Start 20-question session