Courseiva
DeploymenteasyMultiple SelectObjective-mapped

DVA-C02 Deployment Practice Question

Which TWO strategies can be used to reduce the risk of a failed deployment when using AWS CodeDeploy? (Select TWO.)

⚠ Common exam trap

Many exam-takers confuse manual approval (a pre-deployment gate) with a rollback mechanism, or they mistakenly think disabling health checks reduces false positives, when in fact health checks are critical for detecting failures during deployment.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Configure automatic rollback based on CloudWatch alarms.

AWS CodeDeploy can automatically trigger a rollback when a CloudWatch alarm is breached, such as when error rates or latency exceed a threshold. This reduces the risk of a failed deployment by reverting to the last known good state without manual intervention. Option B is correct because a canary deployment shifts a small percentage of traffic to the new version first, allowing you to monitor for issues before routing all traffic, minimizing blast radius.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Configure automatic rollback based on CloudWatch alarms.

    Why this is correct

    When a deployment causes performance degradation or errors, CloudWatch alarms can detect these issues by monitoring key metrics such as error rates, latency, or CPU utilization. Configuring automatic rollback to trigger upon these alarm states ensures that the application quickly reverts to a stable previous version, minimizing the blast radius and user impact of a faulty deployment. This proactive measure significantly reduces the duration of service disruption and enhances reliability.

  • Use a canary deployment to shift traffic gradually.

    Why this is correct

    A canary deployment strategy involves releasing the new version to a small, controlled subset of users or instances first, while the majority of traffic still goes to the stable old version. This allows for real-time monitoring of key performance indicators and user behavior on the new version without impacting the entire user base. If issues are detected, traffic can be immediately rolled back from the canary, preventing a widespread outage and enabling a safe, controlled release.

  • Disable health checks to prevent false positives.

    Why it's wrong here

    Disabling health checks, such as those utilized by Elastic Load Balancers or Auto Scaling Groups, removes a critical mechanism for identifying and isolating unhealthy instances or application components. While it might prevent 'false positives' in some specific edge cases, it fundamentally prevents the detection of genuine failures, leading to users being routed to non-functional instances. This significantly increases the risk of service degradation and outages, as problematic instances remain in service.

  • Require a manual approval step before deployment.

    Why it's wrong here

    While a manual approval step can enforce policy compliance or ensure human oversight before a deployment, it does not inherently reduce the technical risk of the deployment failing due to underlying code bugs, configuration errors, or environmental incompatibilities. In fact, it can introduce delays, slow down the deployment process, and potentially lead to human error during the approval or execution phase, rather than preventing the core technical issues that cause failures.

  • Deploy to all instances at once to ensure consistency.

    Why it's wrong here

    Deploying to all instances simultaneously, often referred to as an 'all-at-once' or 'in-place' deployment, maximizes the blast radius if the new version contains a critical bug or configuration error. While it might seem to ensure immediate consistency across the fleet, any failure will instantly impact every single user, leading to a complete service outage rather than a partial degradation. This strategy offers no opportunity for gradual testing, monitoring, or graceful rollback.

Quick reference

AAA Protocol Comparison

ProtocolPort(s)EncryptionTransportPrimary Use
RADIUS1812 / 1813Password onlyUDPNetwork access control
TACACS+49Full packetTCPDevice administration
Diameter3868Full sessionTCP / SCTPCarrier / mobile networks
802.1XEAP-basedLayer 2Port-based access control

TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.

About these practice questions

One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.