Courseiva

CCNA Deployment, Provisioning, and Automation Questions

75 of 277 questions · Page 1/4 · Deployment, Provisioning, and Automation · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A SysOps Administrator attempted to update a CloudFormation stack. The stack update failed and is now in UPDATE_ROLLBACK_IN_PROGRESS state as shown in the exhibit. What should the administrator do to recover the stack to a stable state?

A.Wait for the rollback to complete and then investigate the failure reason.
B.Delete the stack and recreate it.
C.Manually update the Auto Scaling group to correct the issue.
D.Execute a change set to fix the failed resource.
AnswerA

Rollback will bring stack to previous stable state.

Why this answer

Option D is correct. Since the stack is in rollback, waiting for the rollback to complete is the appropriate action. The stack will attempt to roll back to the previous state.

Option A is wrong because deleting the stack is not necessary; the rollback will restore the previous state. Option B is wrong because continuing the update would fail. Option C is wrong because executing a change set would require the stack to be in a stable state.

Practice this question →
2
MCQhard

A SysOps administrator is managing a CloudFormation stack that creates an Amazon RDS DB instance. The stack uses the 'DBInstance' resource with a 'DeletionPolicy' attribute set to 'Delete'. The administrator wants to modify the stack to retain the DB instance when the stack is deleted, but the change fails because the DB instance is in a state that does not allow modification. What is the MOST likely reason?

A.The stack is in a 'CREATE_COMPLETE' state and cannot be updated.
B.The DB instance has deletion protection enabled.
C.The DB instance is in a maintenance window that prevents modifications.
D.The DeletionPolicy attribute cannot be changed after the stack is created.
AnswerD

DeletionPolicy is a property of the resource that cannot be updated.

Why this answer

Option A is correct because the DeletionPolicy attribute is immutable after the resource is created; to change it, you must create a new stack or use a different resource name. Option B is wrong because RDS does not have a backup window restriction for DeletionPolicy changes. Option C is wrong because the DeletionPolicy is applied at deletion, not creation.

Option D is wrong because deletion protection is a separate property.

Practice this question →
3
MCQeasy

A SysOps administrator maintains an AWS CloudFormation stack that deploys an Amazon EC2 instance. The administrator needs to change the instance type from t2.micro to t3.micro. The administrator wants to review the proposed changes before applying them to ensure no unexpected resource replacement occurs. Which CloudFormation feature should the administrator use?

A.Use the AWS CloudFormation console to directly update the stack with the new instance type and monitor the events.
B.Create a change set from the updated template, review the changes, and then execute the change set.
C.Use the AWS CloudFormation drift detection feature to check for differences between the stack and the template.
D.Modify the CloudFormation template locally and use the AWS CLI to validate it with 'aws cloudformation validate-template'.
AnswerB

A change set provides a detailed summary of changes (add, modify, replace) before execution. This allows the administrator to see if the instance will be replaced or updated in place.

Why this answer

Option B is correct because a change set allows the administrator to review the proposed modifications (including whether any resource replacement will occur) before applying them. By creating a change set from the updated template, the administrator can inspect the list of changes, such as the instance type update, and confirm that no unexpected resource replacement (e.g., a new EC2 instance being created) will happen. Only after reviewing the change set can the administrator safely execute it to apply the changes.

Exam trap

The trap here is that candidates confuse change sets with drift detection or template validation, not realizing that change sets are specifically designed to preview the impact of stack updates before execution.

How to eliminate wrong answers

Option A is wrong because directly updating the stack via the console applies changes immediately without a review step, so the administrator cannot preview whether resource replacement will occur. Option C is wrong because drift detection compares the current stack resources against the expected template configuration to identify manual changes, not to preview proposed updates before applying them. Option D is wrong because 'aws cloudformation validate-template' only checks the syntax of the template, not the impact of changes on existing resources or whether replacement will occur.

Practice this question →
4
MCQmedium

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. The Auto Scaling group has 4 instances. What should the SysOps administrator check first?

A.Review the deployment configuration to ensure it allows enough time for deployment.
B.Verify that the AppSpec file includes the correct hooks.
C.Check the Auto Scaling group's health check type and ensure it is set to ELB.
D.Check the IAM role for CodeDeploy to ensure it has sufficient permissions.
AnswerC

If the health check is not ELB, instances might be considered healthy even if they fail the deployment, leading to insufficient healthy instances.

Why this answer

The error indicates that the deployment could not maintain the minimum healthy instances. Checking the Auto Scaling group's health check configuration is the first step because if the health check type is not set to ELB, the instances might be marked healthy even if they are not receiving traffic. Option C is correct.

Option A is wrong because the error message does not point to missing hooks. Option B is wrong because the error is about health, not about permissions. Option D is wrong because the deployment configuration is not the primary issue; the error message specifically mentions healthy instances.

Practice this question →
5
MCQeasy

A company uses AWS CodeCommit to store its source code and AWS CodeBuild to compile and test the code. The SysOps administrator is setting up a new build project that needs to access a private Amazon S3 bucket to download build dependencies. The build project runs in a VPC. The administrator has attached an IAM role to the build project with permissions to access the S3 bucket. However, the build fails with an access denied error when trying to download the dependencies. The S3 bucket is in the same region and account. What should the administrator do to resolve the issue?

A.Attach an internet gateway to the VPC to provide internet access.
B.Configure the security group for CodeBuild to allow outbound traffic to the S3 bucket.
C.Create a VPC endpoint for Amazon S3 and associate it with the VPC where CodeBuild runs.
D.Update the IAM role to include 's3:ListBucket' permission.
AnswerC

Why A is correct

Why this answer

Option A is correct because when CodeBuild runs in a VPC, it does not have internet access by default, and S3 endpoints are required to access S3 buckets without going through a NAT gateway or internet. Option B is incorrect because the IAM role permissions appear correct, but the issue is network connectivity. Option C is incorrect because security groups control traffic at the instance level, not for S3 access.

Option D is incorrect because the VPC does not need internet access if VPC endpoints are used.

Practice this question →
6
Multi-Selecthard

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS Multi-AZ DB instance. The stack creation fails with the error 'The DB instance already exists'. The SysOps Administrator needs to resolve this issue without modifying the template. Which THREE steps should the administrator take? (Choose THREE.)

Select 3 answers
A.Update the CloudFormation stack to change the deletion policy of the DB instance to Retain.
B.Delete the existing DB instance from the AWS account.
C.Use the CloudFormation resource import feature to bring the existing DB instance into the stack.
D.Use a different stack name in the CloudFormation template.
E.Change the DB instance identifier in the CloudFormation template to a unique value.
AnswersA, B, E

Changing deletion policy to Retain prevents accidental deletion during updates.

Why this answer

Option A, Option C, and Option E are correct. Deleting the existing DB instance allows CloudFormation to create a new one. Changing the deletion policy to Retain (Option C) ensures the existing DB instance is not deleted if the stack is updated.

Changing the DB instance identifier (Option E) avoids the name conflict. Option B (importing the resource) is not possible without modifying the template. Option D (using a different stack name) does not resolve the resource conflict.

Practice this question →
7
Multi-Selectmedium

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Select 2 answers
A.Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.
B.Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.
C.Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.
D.Add a CreationPolicy to the RDS database resource to wait for a signal that the database is available.
E.Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.
AnswersB, D

This ensures the Auto Scaling group is created after both resources are created.

Why this answer

DependsOn ensures the order of resource creation. For the Auto Scaling group to wait for both the ALB and RDS, it must list both as dependencies. Additionally, a CreationPolicy on the RDS instance can be used to signal when it is fully available (e.g., after the database is created and ready).

However, the question asks for two actions; the most direct are using DependsOn on the Auto Scaling group for both resources, and also possibly using a CreationPolicy on the RDS to ensure it is truly available, but since the question says 'fully created and available', the best two are: (1) Add a DependsOn attribute to the Auto Scaling group resource listing both the ALB and RDS resources. (2) Add a CreationPolicy to the RDS instance resource to wait for a signal that indicates it is available. Option A is incomplete. Option B is correct because DependsOn with both resources ensures creation order.

Option C is also correct because CreationPolicy on RDS ensures it signals readiness. Note: The question may have a different intended answer; but based on typical exam, DependsOn and CreationPolicy are the standard ways.

Practice this question →
8
MCQmedium

A SysOps administrator needs to deploy a web application across multiple AWS Regions for disaster recovery. The application uses Amazon RDS for MySQL and requires a secondary database in a different Region. What is the MOST cost-effective and automated solution to keep the databases synchronized?

A.Create a cross-Region read replica of the primary RDS instance in the secondary Region
B.Use AWS Database Migration Service (DMS) with ongoing replication
C.Set up a cron job on an EC2 instance to export the database and import it into the secondary Region
D.Enable Multi-AZ on the primary RDS instance and configure a read replica in the secondary Region
AnswerA

RDS cross-Region read replicas provide automated asynchronous replication to another Region, meeting the DR requirement cost-effectively.

Why this answer

Option C is correct because Amazon RDS Cross-Region Read Replicas automatically replicate data from the primary database to a secondary Region, providing a cost-effective solution without needing separate infrastructure. Option A is wrong because it requires manual scripting and is not fully automated. Option B is wrong because it uses RDS Multi-AZ, which is for high availability within a single Region, not cross-Region.

Option D is wrong because it uses a custom replication solution that is not managed by AWS.

Practice this question →
9
MCQhard

A team uses AWS CodeDeploy with a deployment configuration of CodeDeployDefault.OneAtATime to deploy a web application to an Auto Scaling group. Instances are behind an Application Load Balancer. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment.' What is the most likely cause?

A.The health check grace period on the Auto Scaling group is too short.
B.The target group deregistration delay is too long.
C.The CodeDeploy agent is not installed on the instances.
D.The deployment group is configured to skip the ELB health check.
AnswerA

Correct. A short grace period causes instances to be considered unhealthy before the deployment finishes, triggering Auto Scaling to replace them and causing repeated failures.

Why this answer

The deployment fails because the health check grace period on the Auto Scaling group is too short. When CodeDeploy deploys one instance at a time (CodeDeployDefault.OneAtATime), the instance is taken out of service, updated, and then returned to the load balancer. If the grace period expires before the instance passes its health checks, the Auto Scaling group marks it as unhealthy and terminates it, causing the deployment to fail with 'too many individual instances failed.'

Exam trap

The trap here is that candidates often confuse the health check grace period with the deregistration delay or assume the issue is with the CodeDeploy agent, but the specific error 'too many individual instances failed' points to Auto Scaling terminating instances due to health check failures, not a deployment script or agent problem.

How to eliminate wrong answers

Option B is wrong because a long target group deregistration delay would cause traffic to continue flowing to instances being replaced, but it would not cause instances to be terminated by the Auto Scaling group; it delays the removal of instances from the target group but does not trigger deployment failure. Option C is wrong because if the CodeDeploy agent were not installed, the deployment would fail immediately with an agent connectivity error, not with 'too many individual instances failed' after partial success. Option D is wrong because skipping the ELB health check would prevent the load balancer from routing traffic to the instances, but it would not cause the Auto Scaling group to terminate instances; the deployment would likely succeed but with no traffic, not fail with this specific error.

Practice this question →
10
MCQmedium

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline consists of a source stage (AWS CodeCommit) and a deploy stage (AWS CodeDeploy) that deploys to an Auto Scaling group. The SysOps administrator needs to add a stage to run automated unit tests before the deployment proceeds. The tests must be executed in an isolated environment, and if they fail, the pipeline must stop and notify the development team. Which action should the administrator take?

A.Add a manual approval action between the source and deploy stages. The development team will manually run the tests on their local machines and then approve the pipeline to proceed.
B.Insert a test stage after the source stage with an AWS CloudFormation action that deploys a test stack and runs tests using a custom resource Lambda function.
C.Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.
D.Add a Lambda function as an action in the pipeline that runs the unit tests. The Lambda function writes the test results to an S3 bucket, and a subsequent approval action checks the results.
AnswerC

CodeBuild is the ideal service for running automated tests in a controlled environment. It integrates natively with CodePipeline: if the CodeBuild build fails, the pipeline transitions to a failed state, stopping further execution and optionally sending notifications via Amazon SNS.

Why this answer

Option C is correct because AWS CodeBuild is natively integrated with CodePipeline to run automated tests defined in a buildspec file. When the build action fails, CodePipeline automatically stops the pipeline execution and can send notifications via Amazon SNS, meeting the requirement for an isolated test environment and automatic failure notification without manual intervention.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing CloudFormation or Lambda, overlooking that CodeBuild is the native, simplest, and most cost-effective service for running automated tests within a CodePipeline.

How to eliminate wrong answers

Option A is wrong because it relies on manual approval and local test execution, which violates the requirement for automated tests in an isolated environment and does not provide automatic pipeline stop on test failure. Option B is wrong because using a CloudFormation action to deploy a test stack and run tests via a custom Lambda function adds unnecessary complexity, cost, and latency; it also does not natively integrate with CodePipeline's failure handling as cleanly as CodeBuild. Option D is wrong because a Lambda function action in CodePipeline cannot directly run unit tests in an isolated environment; it would require custom orchestration, and the subsequent approval action would not automatically stop the pipeline on failure—it would only pause for manual review.

Practice this question →
11
MCQeasy

A company uses AWS Elastic Beanstalk to deploy a web application. The environment needs to be updated with a new application version. The SysOps administrator wants to minimize downtime during the deployment. Which deployment policy should be used?

A.Rolling based on health
B.Rolling with an additional batch
C.Immutable
D.All at once
AnswerB

Adds extra instances before terminating old ones, minimizing downtime.

Why this answer

Option D is correct because a rolling update with an additional batch creates new instances before terminating old ones, minimizing downtime. Option A is incorrect because all-at-once causes downtime. Option B is incorrect because immutable deployments create a full new set of instances, which can be costly but also minimizes downtime, but rolling with additional batch is more cost-effective.

Option C is incorrect because rolling update based on health does not add extra instances, so there is a brief period with reduced capacity.

Practice this question →
12
Multi-Selecthard

An organization uses AWS CloudFormation to manage its infrastructure. The SysOps administrator is implementing a change management process that requires all stack updates to be reviewed and approved before execution. The administrator wants to use CloudFormation change sets to preview changes. Which THREE steps are necessary to implement this process? (Choose THREE.)

Select 3 answers
A.Use the 'Detect Drift' feature to compare the stack with the new template.
B.Update the stack directly using the updated template.
C.Review the change set in the CloudFormation console.
D.Execute the change set after approval.
E.Create a change set from the updated template.
AnswersC, D, E

Why C is correct

Why this answer

Options A, C, and E are correct. To use change sets, you create a change set (A), which you can then review (C). After approval, you execute the change set (E).

Option B is incorrect because you do not update the stack directly; you use change sets. Option D is incorrect because you should create a change set from the new template, not compare stacks directly.

Practice this question →
13
MCQeasy

A CloudFormation template launches an EC2 instance with the user data script shown. The instance launches successfully but the web server does not serve PHP pages. What is the MOST likely reason?

A.The script does not install PHP.
B.The script does not have execute permissions.
C.The CloudFormation template is missing a DependsOn clause for the instance.
D.The user data script is not base64 encoded correctly.
AnswerA

PHP is not installed; only Apache is installed.

Why this answer

Option D is correct because the script installs Apache (httpd) but does not install PHP. The script writes a PHP file but PHP is not installed. Option A is wrong because the script is base64 encoded correctly.

Option B is wrong because the script runs as root, so permissions are fine. Option C is wrong because the script exists; the instance launches.

Practice this question →
14
MCQhard

An organization has a requirement to automatically scale its web application based on a custom metric that measures the number of active user sessions stored in Amazon ElastiCache. The metric is published to CloudWatch every minute. The Auto Scaling group currently uses a simple scaling policy based on CPU utilization. What is the most effective way to implement scaling based on this custom metric?

A.Create a target tracking scaling policy that uses the custom metric as a target.
B.Create a step scaling policy that adjusts capacity based on the magnitude of the metric breach.
C.Create a scheduled scaling policy that increases capacity during peak hours.
D.Create a simple scaling policy that adds instances when the custom metric exceeds a threshold and removes when below.
AnswerA

Target tracking scaling policies can use custom metrics and automatically adjust capacity to maintain a target value.

Why this answer

Option D is correct. A target tracking scaling policy can be configured to use a custom CloudWatch metric, which simplifies management and maintains a target value. Option A (simple scaling policy) would require manual thresholds and is less responsive.

Option B (step scaling) is possible but more complex. Option C (scheduled scaling) is not appropriate for dynamic changes.

Practice this question →
15
MCQmedium

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

A.The Elastic Beanstalk environment was created before the custom AMI was registered.
B.The custom AMI does not have a web server installed and configured to serve the application.
C.The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.
D.The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.
AnswerB

Why B is correct

Why this answer

Option B is correct because Elastic Beanstalk expects the web server (e.g., Apache, Nginx) to be installed and configured to serve the application. If the custom AMI does not have a web server installed, the health check endpoint will not respond. Option A is incorrect because the health check is based on HTTP response, not instance status checks.

Option C is incorrect because Elastic Beanstalk does not require a specific AMI ID; it uses the one provided. Option D is incorrect because the environment URL is created regardless of the AMI.

Practice this question →
16
MCQeasy

A SysOps administrator needs to deploy a new version of a web application to Amazon EC2 instances using AWS Elastic Beanstalk. The administrator wants to deploy the new version with zero downtime and validate the new version before routing production traffic to it. Which deployment policy should be used?

A.All at once
B.Rolling
C.Immutable
D.Traffic splitting
AnswerC

The immutable deployment policy launches a completely new set of instances with the new application version. Once healthy, the environment's CNAME is switched to the new instances, providing zero downtime and the ability to validate the new version before traffic is routed.

Why this answer

Immutable deployment is correct because it launches a completely new set of EC2 instances in a separate Auto Scaling group, deploys the new application version to them, and passes health checks before swapping the environment's CNAME record to point to the new instances. This ensures zero downtime and allows validation of the new version before any production traffic is routed to it, as the old instances remain untouched until the swap is complete.

Exam trap

The trap here is that candidates confuse 'Traffic splitting' with 'canary testing' and assume it allows pre-validation, but in Elastic Beanstalk, traffic splitting immediately routes a percentage of live traffic to the new version, whereas immutable deployment keeps all traffic on the old version until the new version is fully validated and swapped.

How to eliminate wrong answers

Option A is wrong because All at once deploys the new version to all instances simultaneously, causing downtime during the deployment and no ability to validate before traffic is routed. Option B is wrong because Rolling deploys the new version in batches across existing instances, which can cause a brief period of reduced capacity and does not allow full validation of the new version before all traffic is switched; it also does not guarantee zero downtime if health checks fail mid-batch. Option D is wrong because Traffic splitting (canary deployment) routes a percentage of traffic to the new version immediately, which does not allow validation before any production traffic is sent; it is designed for gradual traffic shifting, not pre-validation with zero initial traffic.

Practice this question →
17
MCQeasy

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

A.AWS CloudFormation
B.AWS Elastic Beanstalk
C.AWS CodeDeploy
D.AWS Systems Manager
AnswerA

CloudFormation enables you to define and provision AWS infrastructure using templates. It can manage Lambda functions, IAM roles, and many other resources in a repeatable and automated way.

Why this answer

AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Exam trap

The trap here is that candidates often confuse AWS CodeDeploy (which can deploy Lambda code) with the ability to create the Lambda function and its IAM role, but CodeDeploy does not provision the underlying infrastructure resources—it only handles the deployment of the code to an existing function.

How to eliminate wrong answers

Option B (AWS Elastic Beanstalk) is wrong because it is a PaaS service designed for deploying and scaling web applications, not for creating individual Lambda functions and IAM roles via infrastructure as code. Option C (AWS CodeDeploy) is wrong because it automates code deployments to EC2, Lambda, or on-premises instances, but it does not provision the underlying IAM roles or Lambda function resources; it only deploys the code. Option D (AWS Systems Manager) is wrong because it provides operational management and automation for AWS resources (e.g., patching, runbooks), but it is not designed for declarative infrastructure provisioning of Lambda functions and IAM roles.

Practice this question →
18
Multi-Selecteasy

An administrator is using AWS CloudFormation to create a stack that includes an Auto Scaling group and a launch template. The launch template specifies an AMI ID. Which TWO changes to the launch template will trigger an update to the Auto Scaling group? (Choose TWO.)

Select 2 answers
A.Modifying the security group IDs.
B.Changing the key pair name.
C.Changing the instance type.
D.Changing the AMI ID.
E.Adding a new tag to the launch template.
AnswersC, D

Instance type change requires new instances.

Why this answer

Changing the AMI ID or the instance type will trigger an update because they affect the instances launched. Options A and B are correct. Option C is wrong because tag changes do not trigger a replacement.

Option D is wrong because the security group is part of the launch template but changes to it do not trigger an update of the Auto Scaling group; they update the instances. Option E is wrong because the key pair does not trigger an update.

Practice this question →
19
Multi-Selecthard

A SysOps administrator is designing a deployment pipeline using AWS CodePipeline. The pipeline must deploy a serverless application using AWS SAM. The administrator wants to run integration tests after the deployment. Which THREE services should be used together? (Choose THREE.)

Select 3 answers
A.AWS CodeCommit
B.AWS CodePipeline
C.AWS CodeBuild
D.AWS CodeDeploy
E.AWS SAM
AnswersB, C, E

Orchestrates the deployment pipeline.

Why this answer

Option A is correct because CodePipeline orchestrates the pipeline. Option B is correct because AWS SAM is used to deploy serverless applications. Option C is correct because CodeBuild can run integration tests as part of the pipeline.

Option D is wrong because CodeDeploy is for EC2/Lambda, but SAM is more appropriate for serverless. Option E is wrong because CodeCommit is a source repository, not for testing.

Practice this question →
20
MCQhard

A SysOps administrator updates a CloudFormation stack to change the EC2 instance type from t2.micro to t3.medium. The update fails with the error shown. What is the MOST likely cause?

A.The account does not have service limits to launch a t3.medium instance.
B.The AMI used does not support the t3.medium instance type.
C.The CloudFormation template has a parameter constraint that rejects t3.medium.
D.The t3.medium instance type is not available in the specified Availability Zone.
AnswerD

The error clearly states the instance type is not supported in the AZ.

Why this answer

Option A is correct because the error message explicitly states that the instance type is not supported in the Availability Zone. Option B is wrong because the error does not mention insufficient capacity. Option C is wrong because the error does not mention AMI.

Option D is wrong because the error does not mention parameter validation.

Practice this question →
21
MCQhard

A SysOps administrator needs to deploy a new version of a web application using AWS Elastic Beanstalk. The deployment must achieve zero downtime and allow the administrator to validate the new version by running tests before routing production traffic to it. Which deployment policy should the administrator choose?

A.Rolling
B.Rolling with additional batch
C.Immutable
D.All at once
AnswerC

Immutable deployment creates a completely new Auto Scaling group, allowing validation before the CNAME swap, achieving zero downtime.

Why this answer

The Immutable deployment policy (Option C) is correct because it launches a completely new set of instances in a new Auto Scaling group, deploys the new application version to them, and then swaps the environment's CNAME record from the old instances to the new ones only after all health checks pass. This ensures zero downtime and allows the administrator to run validation tests against the new instances before any production traffic is routed to them, as the old environment remains fully operational during the process.

Exam trap

The trap here is that candidates often confuse 'Rolling with additional batch' with a zero-downtime solution, but it does not provide an isolated validation environment before traffic is routed, whereas Immutable deployment explicitly does.

How to eliminate wrong answers

Option A (Rolling) is wrong because it updates instances in batches by taking them out of service one batch at a time, which reduces capacity during the deployment and does not provide a separate environment for pre-production validation; traffic continues to be served from partially updated instances. Option B (Rolling with additional batch) is wrong because while it launches an extra batch of instances to maintain full capacity during the rolling update, it still does not create an isolated environment for testing the new version before any production traffic is routed to it; the new instances are immediately added to the load balancer. Option D (All at once) is wrong because it deploys the new version to all instances simultaneously, causing downtime as all instances are replaced at the same time, and there is no opportunity to validate the new version before traffic is routed to it.

Practice this question →
22
MCQmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running a single instance. The SysOps administrator needs to update the application to a new version with zero downtime. What should the administrator do?

A.Perform a rolling update with a batch size of 1.
B.Perform a Blue/Green deployment by swapping environment URLs.
C.Perform an immutable update in the Elastic Beanstalk environment.
D.Update the application version and swap the RDS database.
AnswerC

An immutable update replaces the instance with zero downtime.

Why this answer

Option A is correct because an immutable update launches a new instance with the new version and then swaps the old instance, ensuring zero downtime. Option B is wrong because rolling updates on a single instance still cause a brief downtime. Option C is wrong because Blue/Green deployment requires two environments.

Option D is wrong because the RDS instance is separate; swapping it does not update the application.

Practice this question →
23
Multi-Selectmedium

A company is deploying a microservices application on Amazon ECS with Fargate. The SysOps administrator needs to implement a deployment strategy that minimizes downtime and allows for automated rollbacks if the new version fails health checks. Which TWO options should the administrator choose? (Choose TWO.)

Select 2 answers
A.Use a rolling update with the ECS service scheduler.
B.Configure the ECS service to automatically roll back on deployment failure.
C.Use an immutable deployment by replacing the entire Auto Scaling group.
D.Use a blue/green deployment with AWS CodeDeploy.
E.Use a canary deployment with AWS CodeDeploy.
AnswersB, D

Why D is correct

Why this answer

Options B and D are correct. Blue/green deployments (B) reduce downtime by shifting traffic gradually. Automated rollbacks (D) are supported by CodeDeploy when health checks fail.

Option A is incorrect because canary deployments are a variation of blue/green but not a separate deployment type in ECS. Option C is incorrect because rolling updates can cause downtime and are not the best for minimizing downtime. Option E is incorrect because immutable deployments are not natively supported in ECS with Fargate.

Practice this question →
24
MCQmedium

A company is using AWS CloudFormation to manage infrastructure. They have a stack that creates an EC2 instance and an Elastic IP. The instance is in a VPC with an internet gateway. The stack creation succeeds, but the instance does not have internet connectivity. What is the most likely cause?

A.The subnet's route table does not have a route to the internet gateway.
B.The instance does not have a public IP address.
C.The instance is in a private subnet.
D.The security group does not allow outbound traffic.
AnswerA

Without a route to the IGW, traffic cannot reach the internet.

Why this answer

Option A is correct because the instance must have a public IP to communicate with the internet; an Elastic IP attached to the instance provides that. Option B is wrong because the route table might not have a route to the internet gateway. Option C is wrong because the security group allows outbound traffic by default.

Option D is wrong because the instance might be in a private subnet, but the question says VPC with IGW.

Practice this question →
25
MCQmedium

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template references the secret using a dynamic reference. However, the stack creation fails with an error that the secret cannot be retrieved. What is the most likely cause?

A.The secret is in a different AWS Region.
B.The stack name does not match the secret name.
C.The template uses the wrong dynamic reference syntax.
D.The CloudFormation service role lacks permissions to read the secret.
AnswerD

The role used by CloudFormation must have secretsmanager:GetSecretValue permission.

Why this answer

To use dynamic references, the CloudFormation service role must have permission to read the secret. The stack name and parameters are not related to secret retrieval. The secret must be in the same region.

The template syntax might be incorrect, but the most common issue is missing permissions.

Practice this question →
26
MCQeasy

An administrator deploys a CloudFormation template that includes the snippet shown in the exhibit. Later, the administrator deletes the stack. What happens to the S3 bucket?

A.The bucket is deleted only if it contains no objects
B.The bucket is emptied and then deleted
C.The bucket is deleted along with the stack
D.The bucket is retained but no longer managed by CloudFormation
AnswerD

The bucket remains in the account but is not part of the stack.

Why this answer

Option B is correct because DeletionPolicy: Retain preserves the bucket even after stack deletion. Option A is wrong because the bucket is retained. Option C is wrong because the bucket is not deleted.

Option D is wrong because the bucket is retained, not emptied.

Practice this question →
27
MCQmedium

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The SysOps administrator checks the deployment logs and finds that the application installation script exits with a non-zero exit code. What is the MOST likely cause?

A.The Auto Scaling group does not have enough instances to meet the minimum capacity.
B.The security group for the instances blocks outbound traffic to CodeDeploy endpoints.
C.The AppSpec file contains a lifecycle hook that fails.
D.The CodeDeploy agent is outdated on the instances.
AnswerC

A failing lifecycle hook leads to non-zero exit code and deployment failure.

Why this answer

Option D is correct because a non-zero exit code from the AppSpec lifecycle hook (e.g., ApplicationStop, BeforeInstall) causes the deployment to fail. Option A is wrong because insufficient capacity would trigger a different error. Option B is wrong because an outdated agent would show a different error.

Option C is wrong because security groups do not affect script execution exit codes.

Practice this question →
28
MCQmedium

A SysOps administrator is using AWS CodePipeline to automate the build and deploy process for a Java application. The build stage uses AWS CodeBuild, and the deploy stage uses AWS CodeDeploy to deploy to an Auto Scaling group. The deployment fails intermittently with a 'Timeout' error. What should the administrator check first?

A.The health check grace period on the load balancer.
B.The IAM instance profile for the EC2 instances.
C.The buildspec.yml file for syntax errors.
D.The S3 bucket permissions for CodePipeline artifacts.
AnswerA

If the grace period is too short, new instances may be marked unhealthy and cause deployment timeout.

Why this answer

Option A is correct. The most common cause of timeout in CodeDeploy is the health check grace period on the load balancer being too short. Increasing the grace period allows the new instances to pass health checks.

Option B (buildspec) is for CodeBuild, not deployment. Option C (S3 bucket) would cause a different error. Option D (instance profile) would cause permission errors.

Practice this question →
29
Multi-Selectmedium

A SysOps administrator is automating the deployment of a web application using AWS CloudFormation. The application requires an Application Load Balancer (ALB) and an Auto Scaling group. The administrator wants to ensure that the Auto Scaling group registers instances with the ALB automatically. Which of the following are required? (Choose TWO.)

Select 2 answers
A.A launch template or launch configuration that defines the AMI and instance type.
B.A health check grace period set in the Auto Scaling group.
C.A security group that allows traffic from the ALB.
D.A target group ARN specified in the Auto Scaling group's configuration.
E.An Application Load Balancer created in the same stack.
AnswersA, D

The launch template/configuration is required for the Auto Scaling group to launch instances.

Why this answer

To automatically register instances with an ALB, the Auto Scaling group must have a target group ARN specified, and the launch template or configuration must use an AMI that supports the ALB's health checks. Option B and D are correct. Option A is wrong because a load balancer is created separately, but the Auto Scaling group needs the target group.

Option C is wrong because the health check grace period is optional. Option E is wrong because the security group is not directly related to automatic registration.

Practice this question →
30
MCQmedium

An organization needs to enforce that all Amazon EC2 instances launched in a specific AWS account are created from a baseline Amazon Machine Image (AMI) that includes required security patches. The AMI ID is ami-0abcdef1234567890. What is the MOST efficient way to enforce this requirement?

A.Use an AWS Config rule to mark non-compliant instances and automatically terminate them.
B.Use an AWS Lambda function that is triggered by EC2 launch events to terminate non-compliant instances.
C.Use AWS CloudTrail to monitor and alert on any instance launched with a different AMI.
D.Use an IAM policy that denies the ec2:RunInstances action unless the AMI ID matches the approved one.
AnswerD

This prevents any non-compliant launch attempt.

Why this answer

Option C is correct because using an IAM policy with a condition that denies launching instances unless the specified AMI ID is used is the most efficient way to enforce the requirement. Option A is incorrect because CloudTrail logs after the fact and does not prevent launches. Option B is incorrect because Config rules can detect non-compliance but do not block the action.

Option D is incorrect because Lambda would need to be triggered and could delay the launch.

Practice this question →
31
MCQhard

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with automated backups enabled. The stack is deleted and then recreated. The administrator wants to restore data from the backup of the original DB instance. How can this be achieved?

A.Restore from the latest automated backup stored in S3.
B.Restore from the automated backup snapshot that is retained after deletion.
C.Use the RDS recycle bin to recover the deleted DB instance.
D.Data cannot be restored because automated backups are deleted when the DB instance is deleted.
AnswerD

Without a final snapshot, the automated backups are lost.

Why this answer

Option D is correct because automated backups are deleted when the DB instance is deleted; however, final snapshots can be taken before deletion. Since the stack was deleted without a final snapshot, the data is lost. Option A is wrong because snapshots from automated backups are deleted with the instance.

Option B is wrong because RDS does not have a recycle bin. Option C is wrong because automated backups are deleted.

Practice this question →
32
Multi-Selecteasy

A SysOps administrator is implementing an automated backup solution for Amazon RDS databases. The solution must support point-in-time recovery and cross-region disaster recovery. Which TWO AWS services or features should be used?

Select 2 answers
A.Manual DB snapshots.
B.Cross-region read replicas.
C.Automated backups with a retention period.
D.Amazon S3 lifecycle policies.
E.Automated cross-region snapshot copy.
AnswersC, E

Automated backups enable point-in-time recovery within retention.

Why this answer

The correct answers are A and E. A is correct because automated backups enable point-in-time recovery. E is correct because cross-region snapshot copy allows DR in another region.

B is incorrect because manual snapshots do not automate. C is incorrect because Read Replicas are for read scaling, not backups. D is incorrect because S3 is not used for RDS backups natively.

Practice this question →
33
Multi-Selecteasy

A SysOps administrator is deploying a CloudFormation stack that includes an Amazon EC2 instance. The instance needs to have the latest patch level at launch. Which TWO methods can accomplish this? (Choose TWO.)

Select 2 answers
A.Create a custom AMI with the latest patches.
B.Include a user data script that runs the patch command.
C.Use AWS CodeDeploy to run a patch script.
D.Use a CloudFormation creation policy to run a Systems Manager command for patching.
E.Configure an AWS Config rule to enforce patching.
AnswersA, D

A custom AMI ensures the instance is already patched at launch.

Why this answer

Options B and D are correct. Using a Systems Manager patch baseline with the AWS-RunPatchBaseline document in a CloudFormation creation policy allows patching at launch. Alternatively, using a custom AMI that already includes the latest patches ensures the instance is patched from the start.

Option A (user data script) might not run before the instance becomes available. Option C (AWS Config rules) is for compliance, not patching during deployment. Option E (CodeDeploy) is for application deployment, not OS patching.

Practice this question →
34
MCQeasy

A SysOps administrator needs to deploy a set of AWS Lambda functions and an Amazon API Gateway API using infrastructure as code. The administrator wants to manage the deployment across multiple environments (dev, test, prod) with consistent resource configurations. Which AWS service should the administrator use?

A.AWS CloudFormation
B.AWS CodeDeploy
C.AWS Elastic Beanstalk
D.AWS OpsWorks
AnswerA

AWS CloudFormation is the correct choice because it provides infrastructure as code capabilities, enabling you to define resources in a template and deploy them consistently across environments.

Why this answer

AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define and provision AWS resources, including Lambda functions and API Gateway APIs, using templates. It supports managing deployments across multiple environments (dev, test, prod) by using parameters, mappings, and stacks, ensuring consistent resource configurations through repeatable, version-controlled templates.

Exam trap

The trap here is that candidates often confuse AWS CodeDeploy (which deploys application code) with CloudFormation (which provisions infrastructure), leading them to choose CodeDeploy because they think of 'deploying' Lambda functions, but the question specifically requires managing infrastructure as code across environments, which is CloudFormation's role.

How to eliminate wrong answers

Option B (AWS CodeDeploy) is wrong because it is a deployment service for automating code deployments to compute services like EC2, Lambda, or ECS, but it does not manage the provisioning of infrastructure resources like API Gateway or Lambda functions themselves; it focuses on deploying application code, not defining the underlying infrastructure. Option C (AWS Elastic Beanstalk) is wrong because it is a Platform as a Service (PaaS) that abstracts infrastructure management for web applications, but it does not provide the granular, template-based control over individual resources like Lambda and API Gateway that IaC requires; it is designed for application deployment, not for defining and versioning infrastructure components. Option D (AWS OpsWorks) is wrong because it is a configuration management service that uses Chef or Puppet to manage EC2 instances and on-premises servers, but it is not designed for defining serverless resources like Lambda functions or API Gateway APIs; it focuses on server-based configurations, not declarative IaC for serverless services.

Practice this question →
35
MCQmedium

A company manages multiple AWS accounts under AWS Organizations. The SysOps administrator needs to deploy a baseline set of AWS Config rules and an Amazon SNS topic to each account in the organization. The deployment must be centrally managed from the management account and automatically applied to any new member account added in the future. Which solution should the administrator use?

A.Create an AWS CloudFormation StackSet with the template containing the AWS Config rules and SNS topic. Configure the StackSet to deploy to the organization and enable automatic deployment to new accounts.
B.Use AWS Service Catalog to create a product that bundles the AWS Config rules and SNS topic. Grant each account access to launch the product.
C.Configure AWS Config conformance packs in the management account and use AWS Resource Access Manager to share them with member accounts.
D.Create an AWS Organizations Service Control Policy (SCP) that enforces the creation of AWS Config rules and SNS topics in every account.
AnswerA

CloudFormation StackSets can centrally deploy stacks to accounts in AWS Organizations. With automatic deployment enabled, new accounts added to the organization will automatically receive the stack.

Why this answer

AWS CloudFormation StackSets can be deployed to an entire AWS Organizations organization or organizational units (OUs), and they support automatic deployment to new accounts added to the organization. By creating a StackSet with a template that defines the AWS Config rules and SNS topic, and enabling automatic deployment, the administrator ensures that every current and future member account receives the baseline configuration without manual intervention.

Exam trap

The trap here is that candidates often confuse Service Control Policies (SCPs) with resource enforcement, not realizing that SCPs only control permissions and cannot create or configure resources like AWS Config rules or SNS topics.

How to eliminate wrong answers

Option B is wrong because AWS Service Catalog requires each account to manually launch the product, which does not provide automatic deployment to new accounts and is not centrally enforced. Option C is wrong because AWS Config conformance packs can be deployed to multiple accounts via StackSets, but AWS Resource Access Manager (RAM) is used to share resources like subnets or license configurations, not to deploy conformance packs; conformance packs themselves are deployed using StackSets or directly per account. Option D is wrong because Service Control Policies (SCPs) are used to restrict permissions and cannot enforce the creation of specific resources like AWS Config rules or SNS topics; they only control what actions are allowed or denied.

Practice this question →
36
MCQhard

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an Amazon RDS DB instance with a custom DB parameter group. The error message states: 'The following resource(s) failed to create: [DBParameterGroup].' The administrator checks the CloudFormation template and sees that the DBParameterGroup resource has a property 'Parameters' with a list of parameters. What is the MOST likely reason for the failure?

A.The parameter group name contains invalid characters.
B.The parameter group is configured with parameters that are not compatible with the DB engine version.
C.The DB subnet group specified for the DB instance does not exist.
D.The VPC does not have an RDS VPC endpoint enabled.
AnswerB

If the custom parameter group sets parameters that are not supported by the engine version, creation fails.

Why this answer

Custom DB parameter groups must be associated with an engine version that matches the DB instance. A mismatch can cause creation failure. Option D is correct.

Option A is wrong because the DB subnet group is not involved. Option B is wrong because RDS does not require a VPC endpoint. Option C is wrong because the parameter group name can be any valid name.

Practice this question →
37
MCQmedium

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

A.Configure the Application Load Balancer with sticky sessions (session affinity).
B.Disable the feature that stores session state locally.
C.Use Amazon ElastiCache for Redis to store session data externally.
D.Modify the application to store session data in an Amazon RDS database.
AnswerC

Why B is correct

Why this answer

Option B is correct because ElastiCache for Redis provides a centralized session store that can be accessed by any instance, allowing the application to be stateless without code changes if the application is configured to use Redis. Option A is incorrect because Sticky Sessions (session affinity) is a workaround but does not eliminate the dependency on local storage; if an instance fails, sessions are lost. Option C is incorrect because modifying the application to use a database for session storage requires code changes.

Option D is incorrect because disabling the feature does not solve the problem.

Practice this question →
38
MCQmedium

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

A.Create a new commit with an empty message to trigger the pipeline.
B.Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.
C.Wait for the pipeline to automatically retry after the failure.
D.Re-upload the same artifact to the source S3 bucket to trigger the pipeline.
AnswerB

Why D is correct

Why this answer

Option D is correct because CodePipeline allows you to manually release a change, which re-runs the pipeline from the last successful execution or from the source stage. Option A is incorrect because modifying the S3 object directly might not trigger the pipeline automatically (depending on configuration), but it's not the standard way to retry. Option B is incorrect because commit messages do not affect pipeline execution.

Option C is incorrect because the pipeline will not automatically retry; the developer must manually retry.

Practice this question →
39
Multi-Selecteasy

A SysOps administrator is creating a CloudFormation template to provision an Amazon S3 bucket with versioning enabled and server access logging. Which TWO properties must be configured in the AWS::S3::Bucket resource?

Select 2 answers
A.Tags
B.VersioningConfiguration
C.LoggingConfiguration
D.LifecycleConfiguration
E.AccessControl
AnswersB, C

Required to enable versioning.

Why this answer

VersioningConfiguration enables versioning, and LoggingConfiguration enables server access logging. AccessControl, Tags, and LifecycleConfiguration are optional and not required for the described purpose.

Practice this question →
40
MCQeasy

A company wants to automate the creation of AWS resources based on tags. When a user tags an S3 bucket with 'Deploy: True', a Lambda function should trigger to create a corresponding CloudFront distribution. Which AWS service should be used to invoke the Lambda function when the tag is applied?

A.AWS CloudTrail
B.Amazon CloudWatch Events
C.Amazon S3 Events
D.AWS Config
AnswerD

AWS Config can use managed or custom rules to evaluate resource tags and trigger remediation actions via Lambda.

Why this answer

Option B is correct. AWS Config rules can be configured to trigger on resource changes, including tag changes. CloudTrail (A) logs API calls but does not directly trigger Lambda.

CloudWatch Events (C) can match API calls, but Config is more straightforward for tag compliance. S3 Events (D) only trigger on object-level events, not bucket tagging.

Practice this question →
41
MCQhard

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?

A.Modify the Auto Scaling group's health check type to ELB
B.Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count
C.Modify the Auto Scaling group's health check grace period to a lower value
D.Modify the CodeDeploy deployment to ignore the lifecycle hook failure
AnswerA

When the health check type is set to ELB, the Auto Scaling group uses the Application Load Balancer's health checks. If the test hook fails, the instance will be marked unhealthy by the ALB, and the Auto Scaling group will terminate and replace it, ensuring only healthy instances remain.

Why this answer

Option A is correct because setting the Auto Scaling group's health check type to ELB (Elastic Load Balancer) ensures that the Auto Scaling group uses the ELB's health check status to determine instance health. When the test lifecycle hook fails, the new instances are not marked as healthy by the ELB, causing the Auto Scaling group to automatically terminate and replace them. This aligns with the requirement to automatically replace failed instances, as the default EC2 health check only considers instance status (e.g., running vs. stopped) and does not reflect application-level health.

Exam trap

The trap here is that candidates often assume the default EC2 health check is sufficient for detecting application-level failures, but it only monitors instance status (e.g., running/stopped), not the success of lifecycle hooks or application health, so the ELB health check type is required to trigger automatic replacement.

How to eliminate wrong answers

Option B is wrong because increasing the minimum healthy instance count in the CodeDeploy deployment configuration (e.g., using CodeDeployDefault.AllAtOnce or a custom configuration) does not cause failed instances to be terminated and replaced; it only adjusts the number of instances that must remain healthy during the deployment, which could actually reduce the deployment's tolerance for failures. Option C is wrong because reducing the health check grace period would cause the Auto Scaling group to check instance health sooner, but it does not change the health check type; with the default EC2 health check, the test hook failure is not detected, so a shorter grace period has no effect on terminating failed instances. Option D is wrong because ignoring the lifecycle hook failure would allow the deployment to proceed despite the test failure, but it would not trigger automatic termination and replacement of the failed instances; the instances would remain in service, potentially causing application issues.

Practice this question →
42
MCQhard

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application is deployed using AWS Elastic Beanstalk with a rolling update deployment policy. Recently, the development team pushed a new application version that introduced a memory leak. Within minutes, the instances started failing health checks, and Elastic Beanstalk initiated a replacement of the instances. However, during the replacement, the application experienced downtime because the new instances were not passing health checks, and the old instances were already terminated. The SysOps Administrator must modify the deployment to prevent downtime during future failed deployments. Which solution should the administrator implement?

A.Increase the Auto Scaling group's minimum and maximum size to handle more instances.
B.Implement a Blue/Green deployment using a separate Elastic Beanstalk environment and swap CNAMEs after testing.
C.Replace the ALB with a Classic Load Balancer to reduce complexity.
D.Change the deployment policy to All at once to speed up the deployment.
AnswerB

Blue/Green deployment avoids downtime by keeping old environment active.

Why this answer

Option B is correct. Using a Blue/Green deployment with an immutable environment ensures that the new environment is fully tested before traffic is switched. If the new environment fails health checks, the old environment remains serving traffic, preventing downtime.

Option A is wrong because All at once deployment would cause downtime even without failure. Option C is wrong because a classic load balancer does not provide the same health check granularity. Option D is wrong because Auto Scaling alone does not control deployment strategy.

Practice this question →
43
MCQhard

A company has a CloudFormation stack that creates an Amazon EC2 instance with a user data script that installs software from the internet. The stack creation is failing with a timeout. The SysOps administrator suspects that the user data script is taking too long or failing. How can the administrator configure the stack to wait for the user data script to complete successfully before marking the instance as CREATE_COMPLETE?

A.Add a CreationPolicy with a resource signal to the EC2 instance resource and have the user data script send a success signal using cfn-signal.
B.Add a DependsOn attribute to the EC2 instance resource to wait for another resource.
C.Add an UpdatePolicy with a resource signal to the EC2 instance resource.
D.Add a WaitCondition resource and a WaitHandle, and have the user data script send a signal to the WaitHandle.
AnswerA

CreationPolicy with signal ensures CloudFormation waits for the user data script to complete and signal success.

Why this answer

Use a CreationPolicy with a resource signal on the EC2 instance. The user data script must send a success signal (e.g., via cfn-signal) to CloudFormation. Option B is wrong because WaitCondition is used for external signals but requires a separate wait handle.

Option C is wrong because UpdatePolicy is for updates, not creation. Option D is wrong because DependsOn only waits for resource creation, not for user data completion.

Practice this question →
44
MCQmedium

A SysOps administrator is creating a CloudFormation stack that requires an IAM role to be passed to EC2 instances. The administrator is using the IAM policy shown in the exhibit. The stack creation fails with an error indicating insufficient permissions to pass the role. What is the most likely cause?

A.The cloudformation:* action does not include permission to create stacks.
B.The policy does not include the cloudformation:CreateStack action.
C.The ec2:RunInstances permission is missing from the policy.
D.The iam:PassRole permission is restricted to a specific role ARN that does not match the role the administrator is trying to pass.
AnswerD

The policy only allows passing the role 'Admin', but the stack may need a different role.

Why this answer

Option B is correct because the iam:PassRole action is allowed only for the role 'Admin', but the stack may be using a different role. Option A is incorrect because the cloudformation:* action allows all CloudFormation operations. Option C is incorrect because the policy allows cloudformation:* which includes creating stacks.

Option D is incorrect because the policy allows ec2:RunInstances and ec2:Create*.

Practice this question →
45
Multi-Selecthard

A CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED. Which two actions are appropriate next steps? (Choose 2.)

Select 2 answers
A.Review stack events to identify the resource that blocked rollback.
B.Use continue-update-rollback after resolving the underlying issue or specifying resources to skip when appropriate.
C.Delete the CloudFormation service role from IAM.
D.Rename the stack to force rollback completion.
AnswersA, B

Stack events show the specific resource and failure reason.

Why this answer

Option A is correct because when a CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED, the stack events provide detailed error messages for each resource that failed during rollback. Reviewing these events is essential to identify the specific resource that blocked the rollback, such as a resource that could not be deleted or updated due to permissions, dependencies, or configuration issues. This diagnosis is the first step before attempting a continue-update-rollback operation.

Exam trap

The trap here is that candidates may think deleting the service role or renaming the stack are valid recovery actions, but AWS CloudFormation requires explicit rollback continuation or manual intervention via the continue-update-rollback API, not workarounds that break IAM or naming conventions.

Practice this question →
46
MCQhard

A company runs a critical application on a fleet of EC2 instances in an Auto Scaling group. The application is deployed using a blue/green deployment strategy with AWS CodeDeploy. The green environment fails immediately after deployment, and the deployment is automatically rolled back. However, the rollback also fails because the original blue environment's Auto Scaling group has been scaled down. What should the SysOps administrator do to prevent this issue in future deployments?

A.Configure the deployment to automatically delete the green environment after rollback.
B.Increase the minimum size of the Auto Scaling group.
C.Change the deployment type to in-place.
D.Set the original environment termination delay to a longer duration in the CodeDeploy deployment group.
AnswerD

This ensures the blue environment is retained for rollback.

Why this answer

Option D is correct because the blue/green deployment in CodeDeploy allows you to specify how long to keep the original (blue) environment after a successful deployment. Setting this to a sufficient duration ensures the blue environment is available for rollback. Option A is incorrect because it changes the deployment type, not the root cause.

Option B is incorrect because increasing the minimum size does not guarantee the blue environment retains instances. Option C is incorrect because it deletes the green environment, which may be needed for rollback.

Practice this question →
47
MCQeasy

A development team uses AWS CloudFormation to deploy infrastructure. They want to update a stack but first need to review how the changes will impact existing resources before applying them. Which CloudFormation feature should they use?

A.Change sets
B.Stack policies
C.Condition functions
D.Custom resources
AnswerA

Correct. Change sets provide a preview of the changes that will be made to the stack, enabling review before execution.

Why this answer

Change sets allow you to preview how proposed changes to a CloudFormation stack will affect your running resources before you apply them. They generate a summary of the changes (additions, modifications, deletions) based on the new template and parameters, enabling you to assess impact such as resource replacement or updates without executing the changes. This directly addresses the team's requirement to review changes before applying them.

Exam trap

The trap here is that candidates confuse stack policies (which guard resources during updates) with change sets (which preview changes), or assume condition functions or custom resources can simulate change impact, but only change sets provide a declarative diff before execution.

How to eliminate wrong answers

Option B is wrong because stack policies are used to prevent accidental updates or deletions of specific stack resources during a stack update, not to preview changes. Option C is wrong because condition functions (e.g., Fn::If) control whether certain resources are created or properties are set based on conditions in the template, but they do not provide a preview of change impact. Option D is wrong because custom resources allow you to handle provisioning logic for resources not natively supported by CloudFormation, but they do not offer a mechanism to review changes before an update.

Practice this question →
48
MCQhard

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource. The error message states: 'The runtime parameter of nodejs8.10 is no longer supported.' The administrator needs to resolve this with minimal changes. What should the administrator do?

A.Modify the Lambda function code to use Python 3.8.
B.Manually update the runtime in the AWS Lambda console after the stack creation fails.
C.Update the CloudFormation template to use a supported Node.js runtime, such as nodejs14.x.
D.Wait for AWS to re-enable the nodejs8.10 runtime.
AnswerC

This directly addresses the deprecation error.

Why this answer

Option B is correct because the error indicates the runtime is deprecated; updating the runtime to a supported version (e.g., nodejs14.x) resolves the issue. Option A is wrong because the Lambda function code is likely compatible with a newer runtime. Option C is wrong because the runtime is specified in the CloudFormation template, not in the Lambda console.

Option D is wrong because waiting will not fix the deprecated runtime.

Practice this question →
49
MCQeasy

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error 'CREATE_FAILED - Resource handler returned message: 'Invalid instance type specified'. The template uses a parameter for InstanceType. What is the most likely cause of this failure?

A.The VPC specified in the template does not have internet access.
B.The Auto Scaling group's desired capacity exceeds the instance limit.
C.The InstanceType parameter is set to a value that is not allowed in the parameter's AllowedValues list.
D.The template uses a DependsOn clause that creates a circular dependency.
AnswerC

CloudFormation validates parameters against AllowedValues and rejects invalid types.

Why this answer

The error indicates the instance type is invalid. Checking the allowed values in the parameter definition is the correct first step. Option A is wrong because Auto Scaling groups don't directly cause this error.

Option B is wrong because the error is about instance type, not VPC. Option D is wrong because the error is not about template syntax or permissions.

Practice this question →
50
MCQhard

A company has a mission-critical application running on EC2 instances in an Auto Scaling group. The application stores state locally on the instance. The company wants to update the application to a new version with minimal downtime. The update requires a change to the instance configuration. What deployment strategy should be used?

A.Rolling update
B.Canary deployment
C.Immutable update
D.Blue/green deployment
AnswerD

Blue/green creates a new environment, allowing state to be migrated or offloaded, then switches traffic.

Why this answer

A blue/green deployment creates a new environment (green) with the new version and then switches traffic. This minimizes downtime and allows state to be handled by offloading to an external service. Rolling updates would cause downtime and state loss if instances are replaced.

Immutable updates replace instances, causing state loss. Canary deployments are for testing, not full production updates.

Practice this question →
51
MCQmedium

A company uses AWS CloudFormation to deploy infrastructure. The SysOps administrator has a template that creates an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to reuse the same template for development, test, and production environments, where the only differences are the EC2 instance type and the RDS DB instance class. Which CloudFormation feature should be used to define these environment-specific values?

A.Nested stacks
B.Parameters
C.Mappings
D.Conditions
AnswerB

Parameters accept input values at stack creation, making the template reusable with different instance types and DB classes per environment.

Why this answer

Parameters are the correct CloudFormation feature because they allow you to pass environment-specific values (such as EC2 instance type and RDS DB instance class) into the template at stack creation or update time. This enables reuse of the same template across development, test, and production environments without modifying the template itself, simply by providing different parameter values for each environment.

Exam trap

The trap here is that candidates often confuse Mappings (which are static and cannot be changed per stack instance) with Parameters (which are dynamic and input at runtime), leading them to incorrectly choose Mappings for environment-specific values that must vary per deployment.

How to eliminate wrong answers

Option A is wrong because nested stacks are used to compose infrastructure from multiple templates or to isolate reusable components, not to inject environment-specific variable values into a single template. Option C is wrong because mappings provide static lookup tables (e.g., mapping environment names to instance types) but cannot be overridden at runtime; they are hardcoded in the template and not suitable for values that must change per deployment. Option D is wrong because conditions control whether a resource or property is created or omitted based on a condition (e.g., deploy a resource only in production), but they do not define or pass variable values like instance type or DB class.

Practice this question →
52
MCQmedium

A SysOps administrator ran the above AWS CLI command to update an existing CloudFormation stack. The command failed with the error shown. What is the most likely cause?

A.The template file has a syntax error.
B.The stack is in a failed state from a previous operation and must be deleted or rollback continued.
C.The parameter values provided are invalid.
D.The IAM role specified lacks permissions.
AnswerB

Stacks in ROLLBACK_COMPLETE cannot be updated until the rollback is resolved.

Why this answer

Option C is correct. The error indicates the stack is in ROLLBACK_COMPLETE state, which means a previous stack creation or update failed and rolled back. To update a stack in ROLLBACK_COMPLETE, you must first delete it or execute a continue update rollback.

Option A (template syntax) is not indicated; the error is about stack state. Option B (permissions) would give a different error. Option D (parameter values) would also give a different error.

Practice this question →
53
Multi-Selecthard

A company uses AWS OpsWorks for configuration management. The administrator needs to deploy a new application version to a stack of EC2 instances. The instances are part of a layer that has a custom recipe. Which THREE steps are required to update the application? (Choose THREE.)

Select 3 answers
A.Run the 'Execute Recipes' stack command to run the new recipe.
B.Run the 'Update Custom Cookbooks' stack command.
C.Run the 'Deploy' stack command to deploy the new application.
D.Update the app in the OpsWorks console to point to the new application version.
E.Update the custom cookbook with the new recipe for the application deployment.
AnswersA, B, E

This runs the specified recipe on the instances.

Why this answer

Options B, D, and E are correct. Updating the custom cookbook with the new recipe, running the 'Update Custom Cookbooks' stack command to fetch the latest cookbook, and then running the recipe via 'Execute Recipes' stack command are the required steps. Option A (update app) is for OpsWorks for Chef Automate, not for custom recipes.

Option C (deploy command) is for built-in deployment, not custom recipes.

Practice this question →
54
MCQmedium

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The error message indicates that an IAM role creation failed because the role already exists. The administrator wants to ensure the stack creation can proceed without manual intervention. What should the administrator do?

A.Modify the template to use a unique name for the IAM role.
B.Use the 'Retain' deletion policy on the IAM role resource.
C.Manually delete the existing IAM role and retry the stack creation.
D.Use a stack policy to prevent the creation of the IAM role.
AnswerA

Using a unique name (e.g., with stack name appended) avoids naming conflicts.

Why this answer

The correct answer is D because setting a unique name (e.g., using !Sub or !Join with stack name) avoids conflicts. Option A is incorrect because the stack will still fail. Option B is incorrect because the administrator wants automated recovery.

Option C is incorrect because the role already exists in the account, not just in the stack.

Practice this question →
55
MCQhard

An organization is using AWS OpsWorks for Chef Automate to manage configuration of EC2 instances. The administrator notices that a new cookbook version is not being applied to existing instances in a layer. The cookbook is stored in a private Amazon S3 bucket and the instances have an instance profile that allows read access. What is the MOST likely reason for this issue?

A.The cookbook version is not being automatically downloaded because the instances are not rebooted.
B.The S3 bucket policy does not grant the necessary permissions to the instance profile.
C.The 'Update Cookbooks' stack command needs to be run manually to apply the new cookbook version to existing instances.
D.The Chef client on the instances is not configured to run automatically.
AnswerC

Why C is correct

Why this answer

Option C is correct because in OpsWorks, cookbooks are automatically updated only during the Setup or Configure lifecycle events. To force an update on existing instances, the administrator must run the 'Update Cookbooks' stack command or trigger a Configure lifecycle event. Option A is incorrect because the S3 permissions appear correct.

Option B is incorrect because the cookbook version is not automatically downloaded when a new version is published; an update must be triggered. Option D is incorrect because the Chef client runs automatically, but it does not fetch new cookbooks unless told to do so.

Practice this question →
56
MCQhard

A SysOps administrator is deploying a CloudFormation stack that includes an AWS::ECS::Service resource. The service uses a task definition that references a container image stored in Amazon ECR. The stack creation fails with the error: 'Unable to assume the service-linked role.' What is the MOST likely cause?

A.The task execution role does not have permissions to pull the container image from ECR.
B.The CloudFormation service role does not have permission to create ECS resources.
C.The ECR repository policy does not grant access to the ECS service.
D.The ECS service-linked role does not exist in the account.
AnswerD

CloudFormation fails if the required service-linked role is missing.

Why this answer

Option B is correct because ECS requires a service-linked role (AWSServiceRoleForECS) to manage resources, and if it does not exist, CloudFormation will fail. Option A is wrong because the task execution role is separate from the service-linked role. Option C is wrong because ECR permissions are for pulling images, not for the service role.

Option D is wrong because CloudFormation uses its own role, not the service-linked role.

Practice this question →
57
MCQmedium

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target instances are not passing the health checks. The administrator reviews the CodeDeploy deployment logs and finds that the application installation succeeded but the built-in health check failed. What should the administrator do to resolve this issue?

A.Modify the AppSpec file to set the 'healthCheckGracePeriod' to a higher value.
B.Modify the AppSpec file to include a script in the 'AfterInstall' lifecycle event that restarts the web server.
C.Modify the AppSpec file to run a script in the 'ApplicationStop' lifecycle event.
D.Modify the AppSpec file to include a script in the 'Validate Service' lifecycle event that performs a custom health check.
AnswerD

The Validate Service event is specifically for custom health checks after deployment.

Why this answer

The Validate Service lifecycle hook is used to run health checks after installation. Option B is correct. Option A is wrong because the ApplicationStop hook runs before installation.

Option C is wrong because AfterInstall runs before validation. Option D is wrong because the AppSpec file is not used to skip health checks.

Practice this question →
58
MCQmedium

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance. The database is in a VPC with public and private subnets. The DB instance is in a private subnet. When the stack is created, the DB instance is not accessible from an EC2 instance in the same VPC. What is the most likely cause?

A.The DB subnet group does not include the correct subnets.
B.The security group for the DB instance does not allow inbound traffic from the EC2 instance.
C.The VPC does not have an internet gateway attached.
D.The DB instance does not have a public IP address.
AnswerB

Security groups control inbound traffic; the DB instance's security group must allow traffic from the EC2 security group.

Why this answer

Option D is correct because the DB instance's security group must allow inbound traffic from the EC2 instance's security group. Option A is wrong because the DB instance is in a private subnet, so it doesn't have a public IP. Option B is wrong because the DB subnet group is configured correctly.

Option C is wrong because the VPC has a route to the internet, but that's not needed for internal communication.

Practice this question →
59
MCQeasy

A company wants to automatically start and stop an EC2 instance on a schedule to reduce costs. The instance runs a critical application that must be available from 8 AM to 6 PM weekdays. Which AWS service should be used to implement this scheduling?

A.AWS Instance Scheduler
B.AWS OpsWorks
C.AWS Systems Manager Automation
D.AWS CloudFormation
AnswerA

Instance Scheduler is a solution that automates start and stop schedules for EC2 and RDS instances based on tags.

Why this answer

Option C is correct because AWS Instance Scheduler is a solution that allows you to configure start and stop schedules for EC2 and RDS instances. Option A is wrong because Systems Manager Automation is for automating maintenance tasks, not scheduling instance start/stop. Option B is wrong because OpsWorks is for configuration management.

Option D is wrong because CloudFormation is for infrastructure as code, not scheduling.

Practice this question →
60
Multi-Selecteasy

A SysOps administrator is creating an Auto Scaling group using a launch template. The administrator wants to ensure that instances are automatically registered with an Application Load Balancer (ALB) target group. Which TWO steps are required? (Choose TWO.)

Select 2 answers
A.Configure the instance security group to allow traffic from the ALB.
B.Specify the target group ARN in the Auto Scaling group configuration.
C.Configure health checks on the Auto Scaling group to use ELB.
D.Create a security group for the ALB and attach it to the Auto Scaling group.
E.Include the target group ARN in the launch template.
AnswersA, B

Instances must accept traffic from the ALB to be healthy.

Why this answer

Option B is correct because the target group ARN must be specified in the Auto Scaling group to enable automatic registration. Option D is correct because the security group must allow traffic from the ALB to the instance. Option A is wrong because health checks are configured on the target group, not the Auto Scaling group.

Option C is wrong because the launch template does not attach to target groups. Option E is wrong because the ALB does not need a security group for health checks.

Practice this question →
61
MCQeasy

A DevOps engineer needs to automate the creation of an Amazon RDS for MySQL DB instance in a VPC. The solution must use infrastructure as code. Which AWS service should be used to provision the database?

A.AWS OpsWorks
B.AWS Elastic Beanstalk
C.AWS CloudFormation
D.EC2 Auto Scaling
AnswerC

CloudFormation allows defining RDS as a resource in a template.

Why this answer

Option B is correct because AWS CloudFormation can define and provision AWS infrastructure, including RDS instances, as code. Option A is incorrect because AWS OpsWorks uses Chef/Puppet but is not the primary choice for simple RDS provisioning. Option C is incorrect because AWS Elastic Beanstalk is a PaaS service that manages application deployment, not infrastructure provisioning directly.

Option D is incorrect because EC2 Auto Scaling manages EC2 instances, not RDS.

Practice this question →
62
MCQeasy

A company needs to deploy a set of microservices using Docker containers on AWS. The deployment should be automated and support scaling based on demand. Which AWS service should be used to orchestrate the containers?

A.AWS Lambda
B.AWS Elastic Beanstalk
C.Amazon ECS
D.AWS CodeDeploy
AnswerC

Amazon ECS is a container orchestration service that integrates with other AWS services.

Why this answer

Option D is correct. Amazon ECS is a fully managed container orchestration service that integrates with Auto Scaling and CloudWatch. Option A (Lambda) is for serverless functions, not containers.

Option B (Elastic Beanstalk) can deploy containers but is less flexible for microservices. Option C (CodeDeploy) is for application deployments, not orchestration.

Practice this question →
63
MCQeasy

A SysOps administrator is creating an AWS CloudFormation template to deploy a web server. The template must define an Amazon EC2 instance, a security group, and an Elastic IP. In which section of the template should these resources be declared?

A.Parameters
B.Resources
C.Outputs
D.Mappings
AnswerB

The Resources section is the correct location to declare the AWS resources that will be created by the stack.

Why this answer

In an AWS CloudFormation template, the Resources section is the mandatory block where all AWS resources (such as EC2 instances, security groups, and Elastic IPs) are declared and configured. The template's logic for creating, updating, and deleting these infrastructure components is defined exclusively within this section, making B the correct choice.

Exam trap

The trap here is that candidates confuse the purpose of the Parameters section (input values) with the Resources section (resource definitions), often thinking that resources like EC2 instances are 'parameters' because they require configuration values like instance type or AMI ID.

How to eliminate wrong answers

Option A is wrong because the Parameters section is used to accept runtime input values (e.g., instance type, AMI ID) from the user, not to define the resources themselves. Option C is wrong because the Outputs section is used to export information about created resources (e.g., instance public IP) for use by other stacks or users, not to declare the resources. Option D is wrong because the Mappings section is used to create static lookup tables (e.g., mapping AWS regions to AMI IDs) for conditional values, not to define resources.

Practice this question →
64
MCQhard

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with Multi-AZ enabled. During a stack update, the database engine version is changed. The update fails with a rollback. What is the most likely cause?

A.The engine version upgrade is not supported for Multi-AZ deployments.
B.The DB instance class is not available for the new engine version.
C.The storage type is not compatible with the new engine version.
D.The DB subnet group does not have enough IP addresses.
AnswerA

Some engine version upgrades are not supported directly; they may require a manual process.

Why this answer

Option C is correct because modifying the DB engine version on a Multi-AZ instance requires a reboot of both the primary and standby, and if the upgrade is not supported, it fails. Option A is wrong because the storage type is not changed. Option B is wrong because the DB instance class is not changed.

Option D is wrong because the subnet group is not changed.

Practice this question →
65
MCQeasy

A company uses AWS CloudFormation to deploy a web application. The template currently hard-codes the EC2 instance type (e.g., t3.medium). The SysOps administrator wants to make the instance type configurable so that different environments (dev, test, prod) can use different instance types without modifying the template each time. Which CloudFormation feature enables this?

A.Parameters
B.Mappings
C.Conditions
D.Outputs
AnswerA

Parameters allow users to input values when creating or updating a stack, making the template reusable for different environments.

Why this answer

Option A is correct because CloudFormation Parameters allow you to pass custom values into a template at stack creation or update time. By defining a parameter for the instance type (e.g., with allowed values like t3.micro, t3.medium, t3.large), you can reuse the same template across dev, test, and prod environments without editing the template file itself.

Exam trap

The trap here is that candidates often confuse Mappings (which are static and environment-agnostic) with Parameters (which are dynamic and user-supplied), leading them to incorrectly choose Mappings as the way to make values configurable.

How to eliminate wrong answers

Option B is wrong because Mappings are static lookup tables (e.g., mapping environment names to instance types) that are hard-coded in the template and cannot be overridden at deployment time; they do not accept runtime input. Option C is wrong because Conditions control whether certain resources are created based on logical expressions (e.g., create a larger instance only in prod), but they do not make the instance type configurable as a deploy-time variable. Option D is wrong because Outputs are used to return information about deployed resources (e.g., instance ID or public IP) after stack creation; they do not accept input values.

Practice this question →
66
MCQmedium

A SysOps administrator is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to ensure that updates to the stack do not accidentally replace the RDS instance if the RDS configuration is changed in a way that would require replacement. Which CloudFormation attribute should be added to the RDS resource?

A.UpdateReplacePolicy with Retain
B.DeletionPolicy with Retain
C.StackPolicy
D.CreationPolicy
AnswerA

UpdateReplacePolicy with Retain ensures that the existing RDS instance is preserved when the update would otherwise replace it.

Why this answer

Option A is correct because the `UpdateReplacePolicy` attribute with `Retain` tells CloudFormation to preserve the existing RDS DB instance if a stack update would otherwise require its replacement. This prevents accidental deletion and recreation of the RDS instance when its configuration changes in a way that forces a new physical resource, such as modifying the DB engine version or storage type. The `UpdateReplacePolicy` is specifically designed for update scenarios, unlike `DeletionPolicy` which only applies during stack deletion.

Exam trap

The trap here is that candidates confuse `DeletionPolicy` (which only applies to stack deletion) with `UpdateReplacePolicy` (which applies during stack updates), leading them to choose Option B instead of A.

How to eliminate wrong answers

Option B is wrong because `DeletionPolicy` with `Retain` only protects the RDS instance from being deleted when the entire stack is deleted, not during an update that would replace the resource. Option C is wrong because `StackPolicy` controls permissions for stack-level updates (e.g., who can modify resources), not the lifecycle behavior of individual resources during replacement. Option D is wrong because `CreationPolicy` is used to wait for signals or resource creation completion (e.g., with `cfn-signal`), and has no effect on update or replacement behavior.

Practice this question →
67
MCQhard

A containerized API runs on Amazon ECS with an Application Load Balancer. The team wants to deploy new container versions with zero downtime, automatically route traffic to the new version only after health checks pass, and automatically roll back if error rates spike within 10 minutes of the shift. Which deployment strategy and configuration implements all three requirements?

A.Use CodeDeploy with the ECS blue/green deployment type, configure a Canary or Linear traffic shifting strategy, and attach a CloudWatch alarm for error rate as a deployment alarm
B.Update the ECS service with a rolling update deployment configuration and set the minimum healthy percent to 100
C.Create a second ECS service with the new task definition and use Route 53 weighted routing to shift traffic at the DNS level
D.Enable ECS circuit breaker on the service to roll back failed deployments automatically
AnswerA

The ECS blue/green deployment starts the green task set, registers it with a second target group, and uses ALB weighted routing to shift traffic progressively. The deployment alarm monitors a 5xx error rate metric. If the alarm enters ALARM state at any point during traffic shifting or the bake period, CodeDeploy automatically shifts traffic back to the original blue target group. The team defines the 10-minute bake window via the deployment configuration's terminationWaitTimeInMinutes.

Why this answer

Option A is correct because CodeDeploy's ECS blue/green deployment type supports canary or linear traffic shifting, which automatically routes traffic to the new version only after health checks pass. By attaching a CloudWatch alarm for error rate as a deployment alarm, CodeDeploy can automatically trigger a rollback if error rates spike within the specified monitoring period (e.g., 10 minutes), meeting all three requirements: zero downtime, health-check-gated traffic shifting, and automatic rollback on error rate spikes.

Exam trap

The trap here is that candidates often confuse the ECS circuit breaker (which only handles task-level failures during deployment) with the need for post-deployment error rate monitoring and traffic shifting, leading them to select Option D without realizing it lacks the canary/linear traffic shifting and CloudWatch alarm integration required for automatic rollback based on error spikes.

How to eliminate wrong answers

Option B is wrong because a rolling update with minimum healthy percent set to 100 does not provide automatic rollback based on error rate spikes; it only ensures availability during the update but lacks the traffic-shifting and alarm-based rollback capabilities. Option C is wrong because using Route 53 weighted routing at the DNS level does not provide health-check-gated traffic shifting at the application layer, and DNS caching can cause delayed or uneven traffic distribution, failing to ensure zero downtime and immediate rollback on error spikes. Option D is wrong because the ECS circuit breaker only rolls back a service if tasks fail to start or become unhealthy during deployment, but it does not monitor post-deployment error rates or support canary/linear traffic shifting.

Practice this question →
68
Matchingmedium

Match each AWS support plan to its key feature.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Account and billing support only

Business hours email access

24/7 phone, chat, and email; <1 hour response

Concierge support team; <30 min response

Technical Account Manager; <15 min response

Why these pairings

These are the AWS support plan tiers.

Practice this question →
69
MCQeasy

A SysOps administrator needs to automate the deployment of a three-tier web application. The application consists of an Application Load Balancer, a fleet of EC2 instances running a web server, and an Amazon RDS MySQL database. The administrator must ensure that the database credentials are securely stored and automatically rotated. The administrator also needs to version the infrastructure configuration. Which combination of AWS services should the administrator use?

A.AWS CloudFormation for infrastructure and AWS Systems Manager Parameter Store for secrets.
B.AWS OpsWorks for infrastructure and AWS Secrets Manager for secrets.
C.AWS CodeCommit for infrastructure versioning and AWS KMS for secrets.
D.AWS CloudFormation for infrastructure and AWS Secrets Manager for secrets.
AnswerD

CloudFormation versions infrastructure; Secrets Manager rotates credentials.

Why this answer

Option C is correct because AWS CloudFormation provides infrastructure as code for versioning, and AWS Secrets Manager securely stores and rotates database credentials. Option A is wrong because AWS Systems Manager Parameter Store can store secrets but does not natively rotate RDS credentials. Option B is wrong because AWS OpsWorks is a configuration management service, not primarily for IaC.

Option D is wrong because AWS CodeCommit is a source control service, not for secret management.

Practice this question →
70
MCQmedium

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The Security Team requires that all instances have a specific security patch installed. A SysOps administrator needs to verify compliance across all instances. What is the MOST efficient way to accomplish this?

A.Use AWS Config rules to check for the patch.
B.Use AWS Systems Manager State Manager to enforce the patch.
C.Use AWS Systems Manager Inventory to collect software inventory.
D.Use AWS Systems Manager Patch Manager to scan and generate a compliance report.
AnswerD

Patch Manager can scan instances and report patch compliance status.

Why this answer

AWS Systems Manager Patch Manager can scan instances for missing patches and report compliance. State Manager and Inventory collect data but do not specifically report patch compliance. OpsCenter is for operational issues.

Config rules can check compliance but require custom rules.

Practice this question →
71
MCQhard

A SysOps administrator is troubleshooting a CodeDeploy deployment that uploads artifacts to an S3 bucket. The deployment fails with an 'AccessDenied' error. The IAM policy for the CodeDeploy service role includes the statement shown in the exhibit. What is the most likely cause of the failure?

A.The upload does not set the ACL to 'bucket-owner-full-control'.
B.The resource ARN does not include the bucket itself.
C.The policy does not allow encryption headers.
D.The policy does not allow the s3:PutObject action.
AnswerA

The condition requires this ACL; if not set, the request is denied.

Why this answer

The policy requires that the object's ACL be set to 'bucket-owner-full-control'. If the upload does not specify this ACL, the request fails. Option C is correct.

Option A is wrong because the action is allowed. Option B is wrong because the resource includes the bucket. Option D is wrong because the condition is about ACL, not encryption.

Practice this question →
72
Multi-Selecthard

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an EC2 instance, an RDS database, and an Application Load Balancer. The SysOps administrator wants to ensure that the database is not replaced during an update if the administrator accidentally changes a property that requires replacement. Which THREE actions should the administrator take?

Select 3 answers
A.Use a custom resource backed by a Lambda function to manage the database.
B.Set a DeletionPolicy attribute of 'Retain' on the RDS resource.
C.Place the RDS instance in a separate nested stack.
D.Enable termination protection on the CloudFormation stack.
E.Apply a stack policy that denies update to the RDS instance.
AnswersA, B, E

Custom resources give you control over update behavior.

Why this answer

The correct answers are A, C, and E. A is correct because a stack policy can prevent updates to critical resources. C is correct because DeletionPolicy: Retain preserves the database if the resource is deleted.

E is correct because using a custom resource to manage the database allows more control. B is incorrect because enabling termination protection on the stack prevents stack deletion, not resource replacement. D is incorrect because the database should not be in a nested stack just for protection; it might be anyway.

Practice this question →
73
Multi-Selecteasy

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Select 2 answers
A.Auto Scaling group
B.NAT Gateway
C.Amazon S3 bucket
D.Amazon Route 53 hosted zone
E.Application Load Balancer
AnswersA, E

Auto Scaling group ensures instances are distributed across AZs.

Why this answer

Option A and Option D are correct. An Auto Scaling group is used to maintain a desired number of instances across AZs, and an Application Load Balancer distributes traffic across those instances. Option B (NAT Gateway) is for outbound internet access, not high availability.

Option C (S3 bucket) is for storage, not compute. Option E (Route 53 hosted zone) is for DNS, not directly for high availability of the application tiers.

Practice this question →
74
MCQmedium

A SysOps administrator needs to deploy the same AWS CloudFormation template across multiple AWS accounts and Regions in a single operation. The administrator wants to manage the deployment from a single management account. Which AWS service should the administrator use?

A.AWS CodeDeploy
B.AWS Elastic Beanstalk
C.AWS CloudFormation StackSets
D.AWS Service Catalog
AnswerC

Correct. CloudFormation StackSets allow you to deploy CloudFormation stacks across multiple accounts and Regions from a central account, with automated rollbacks.

Why this answer

AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy the same template across multiple accounts and Regions from a single management account. StackSets uses a self-managed or service-managed permission model to create, update, and delete stacks across target accounts in a single operation, making it the correct choice for this multi-account, multi-Region deployment requirement.

Exam trap

The trap here is that candidates often confuse AWS Service Catalog (which can provision CloudFormation stacks but only within a single account or via StackSets integration) with the native multi-account deployment capability of CloudFormation StackSets, leading them to select Service Catalog as the answer.

How to eliminate wrong answers

Option A is wrong because AWS CodeDeploy is a service for automating code deployments to EC2 instances, on-premises instances, or Lambda functions, not for deploying CloudFormation templates across multiple accounts and Regions. Option B is wrong because AWS Elastic Beanstalk is a PaaS service for deploying and scaling web applications, not for managing multi-account, multi-Region infrastructure deployments via CloudFormation templates. Option D is wrong because AWS Service Catalog allows you to create and manage a catalog of approved IT services (including CloudFormation products), but it does not natively deploy a single template across multiple accounts and Regions in one operation; it requires additional orchestration or StackSets integration for that capability.

Practice this question →
75
MCQeasy

A SysOps administrator is tasked with automating the deployment of an application across multiple AWS accounts. Which AWS service should be used to orchestrate the deployment across accounts?

A.AWS CodeDeploy
B.AWS CloudFormation StackSets
C.AWS Service Catalog
D.AWS Systems Manager
AnswerB

CloudFormation StackSets enables you to deploy stacks across multiple accounts and regions with a single operation.

Why this answer

Option B is correct because AWS CloudFormation StackSets allows you to deploy CloudFormation stacks across multiple accounts and regions in a single operation. Option A (CodeDeploy) is for deploying applications to EC2 or on-premises, not across accounts. Option C (Service Catalog) is for creating and managing a catalog of approved IT services, not for multi-account orchestration.

Option D (Systems Manager) is for management and patching, not orchestrated cross-account deployments.

Practice this question →
Page 1 of 4 · 277 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Deployment, Provisioning, and Automation questions.

Start 20-question session