Knowledge + Practice

CCNA Deployment, Provisioning, and Automation Questions

45 questions · Deployment, Provisioning, and Automation · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQeasy

A SysOps administrator maintains an AWS CloudFormation stack that deploys an Amazon EC2 instance. The administrator needs to change the instance type from t2.micro to t3.micro. The administrator wants to review the proposed changes before applying them to ensure no unexpected resource replacement occurs. Which CloudFormation feature should the administrator use?

A.Use the AWS CloudFormation console to directly update the stack with the new instance type and monitor the events.

B.Create a change set from the updated template, review the changes, and then execute the change set.

C.Use the AWS CloudFormation drift detection feature to check for differences between the stack and the template.

D.Modify the CloudFormation template locally and use the AWS CLI to validate it with 'aws cloudformation validate-template'.

AnswerB

A change set is generated from an updated template against the current stack, providing a detailed, resource-by-resource summary of whether CloudFormation will add, modify, or replace resources. Because changing an EC2 instance type typically requires replacement, the change set would explicitly flag a "Replace" action, letting the administrator assess the impact and even cancel before executing. Only after reviewing and confirming the change set is it executed, and the execution applies the exact changes that were previewed.

Why this answer

A change set allows the administrator to review the proposed modifications (including whether any resource replacement will occur) before applying them. By creating a change set from the updated template, the administrator can inspect the list of changes, such as the instance type update, and confirm that no unexpected resource replacement (e.g., a new EC2 instance being created) will happen. Only after reviewing the change set can the administrator safely execute it to apply the changes.

Exam trap

The trap here is that candidates confuse change sets with drift detection or template validation, not realizing that change sets are specifically designed to preview the impact of stack updates before execution.

How to eliminate wrong answers

Option A is wrong because directly updating the stack via the console applies changes immediately without a review step, so the administrator cannot preview whether resource replacement will occur. Option C is wrong because drift detection compares the current stack resources against the expected template configuration to identify manual changes, not to preview proposed updates before applying them. Option D is wrong because 'aws cloudformation validate-template' only checks the syntax of the template, not the impact of changes on existing resources or whether replacement will occur.

Practice this question →

2

MCQeasy

A company uses AWS CodeCommit to store its source code and AWS CodeBuild to compile and test the code. The SysOps administrator is setting up a new build project that needs to access a private Amazon S3 bucket to download build dependencies. The build project runs in a VPC. The administrator has attached an IAM role to the build project with permissions to access the S3 bucket. However, the build fails with an access denied error when trying to download the dependencies. The S3 bucket is in the same region and account. What should the administrator do to resolve the issue?

A.Attach an internet gateway to the VPC to provide internet access.

B.Configure the security group for CodeBuild to allow outbound traffic to the S3 bucket.

C.Create a VPC endpoint for Amazon S3 and associate it with the VPC where CodeBuild runs.

D.Update the IAM role to include 's3:ListBucket' permission.

AnswerC

Creating a VPC endpoint for Amazon S3 (gateway or interface type) and associating it with the VPC where CodeBuild runs gives the build container a private, routable path to S3 without traversing the public internet. Because CodeBuild runs inside the VPC on elastic network interfaces, outbound traffic to S3 will only succeed if the VPC has a route to S3 via a gateway endpoint or a NAT/internet gateway. The gateway endpoint uses prefix lists to route S3 traffic within the AWS network, which resolves the access denied error caused by the lack of network connectivity. This is the intended fix because the root cause is a network routing problem, not missing IAM permissions or security group misconfiguration.

Why this answer

When CodeBuild runs in a VPC, it cannot access S3 endpoints over the internet by default. An S3 VPC endpoint allows CodeBuild to access S3 privately without needing an internet gateway or NAT. The IAM role already has the necessary permissions; the issue is network connectivity.

Practice this question →

3

Multi-Selectmedium

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Select 2 answers

A.Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.

B.Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.

C.Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.

D.Add a CreationPolicy to the RDS database resource to wait for a signal that the database is available.

E.Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.

AnswersB, D

This ensures the Auto Scaling group is created after both resources are created.

Why this answer

To ensure the Auto Scaling group is created only after both the ALB and RDS database are fully available, the administrator should add a DependsOn attribute to the Auto Scaling group that lists both the ALB and RDS resources (Option B). This ensures CloudFormation creates the group after those resources. Additionally, a CreationPolicy on the RDS database resource (Option D) can be used to wait for a signal (e.g., from a cfn-signal script) indicating that the database is fully operational and accepting connections, ensuring it is 'fully available' before the Auto Scaling group creation proceeds.

Option A is incorrect because it only lists the ALB, ignoring RDS. Option C is irrelevant for creation order. Option E addresses instance signaling, not resource creation.

Practice this question →

4

MCQmedium

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline consists of a source stage (AWS CodeCommit) and a deploy stage (AWS CodeDeploy) that deploys to an Auto Scaling group. The SysOps administrator needs to add a stage to run automated unit tests before the deployment proceeds. The tests must be executed in an isolated environment, and if they fail, the pipeline must stop and notify the development team. Which action should the administrator take?

A.Add a manual approval action between the source and deploy stages. The development team will manually run the tests on their local machines and then approve the pipeline to proceed.

B.Insert a test stage after the source stage with an AWS CloudFormation action that deploys a test stack and runs tests using a custom resource Lambda function.

C.Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.

D.Add a Lambda function as an action in the pipeline that runs the unit tests. The Lambda function writes the test results to an S3 bucket, and a subsequent approval action checks the results.

AnswerC

CodeBuild is the ideal service for running automated tests in a controlled environment. It integrates natively with CodePipeline: if the CodeBuild build fails, the pipeline transitions to a failed state, stopping further execution and optionally sending notifications via Amazon SNS.

Why this answer

AWS CodeBuild is natively integrated with CodePipeline to run automated tests defined in a buildspec file. When the build action fails, CodePipeline automatically stops the pipeline execution and can send notifications via Amazon SNS, meeting the requirement for an isolated test environment and automatic failure notification without manual intervention.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing CloudFormation or Lambda, overlooking that CodeBuild is the native, simplest, and most cost-effective service for running automated tests within a CodePipeline.

How to eliminate wrong answers

Option A is wrong because it relies on manual approval and local test execution, which violates the requirement for automated tests in an isolated environment and does not provide automatic pipeline stop on test failure. Option B is wrong because using a CloudFormation action to deploy a test stack and run tests via a custom Lambda function adds unnecessary complexity, cost, and latency; it also does not natively integrate with CodePipeline's failure handling as cleanly as CodeBuild. Option D is wrong because a Lambda function action in CodePipeline cannot directly run unit tests in an isolated environment; it would require custom orchestration, and the subsequent approval action would not automatically stop the pipeline on failure—it would only pause for manual review.

Practice this question →

5

MCQmedium

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

A.The Elastic Beanstalk environment was created before the custom AMI was registered.

B.The custom AMI does not have a web server installed and configured to serve the application.

C.The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.

D.The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.

AnswerB

The health check performed by Elastic Beanstalk is an HTTP request to the environment's health check path (typically / on port 80). If the custom AMI lacks a web server or the web server isn't configured to serve the application, the ELB health check receives a connection refused or non-2xx response, causing the instance to be marked unhealthy. Simply having a running EC2 instance is insufficient; the AMI must include the same web server and configuration as the standard Elastic Beanstalk platform AMI to serve traffic.

Why this answer

Elastic Beanstalk expects the web server (e.g., Apache, Nginx) to be installed and configured to serve the application. If the custom AMI does not have a web server installed, the health check endpoint will not respond. Option A is incorrect because the environment URL is created regardless of the AMI.

Option C is incorrect because Elastic Beanstalk does not require a specific AMI ID; it uses the one provided. Option D is incorrect because the health check is based on HTTP response, not instance status checks.

Practice this question →

6

MCQeasy

A SysOps administrator needs to deploy a new version of a web application to Amazon EC2 instances using AWS Elastic Beanstalk. The administrator wants to deploy the new version with zero downtime and validate the new version before routing production traffic to it. Which deployment policy should be used?

A.All at once

B.Rolling

C.Immutable

D.Traffic splitting

AnswerC

The immutable deployment policy launches a completely new set of instances with the new application version. Once healthy, the environment's CNAME is switched to the new instances, providing zero downtime and the ability to validate the new version before traffic is routed.

Why this answer

Immutable deployment is correct because it launches a completely new set of EC2 instances in a separate Auto Scaling group, deploys the new application version to them, and passes health checks before swapping the environment's CNAME record to point to the new instances. This ensures zero downtime and allows validation of the new version before any production traffic is routed to it, as the old instances remain untouched until the swap is complete.

Exam trap

The trap here is that candidates confuse 'Traffic splitting' with 'canary testing' and assume it allows pre-validation, but in Elastic Beanstalk, traffic splitting immediately routes a percentage of live traffic to the new version, whereas immutable deployment keeps all traffic on the old version until the new version is fully validated and swapped.

How to eliminate wrong answers

Option A is wrong because All at once deploys the new version to all instances simultaneously, causing downtime during the deployment and no ability to validate before traffic is routed. Option B is wrong because Rolling deploys the new version in batches across existing instances, which can cause a brief period of reduced capacity and does not allow full validation of the new version before all traffic is switched; it also does not guarantee zero downtime if health checks fail mid-batch. Option D is wrong because Traffic splitting (canary deployment) routes a percentage of traffic to the new version immediately, which does not allow validation before any production traffic is sent; it is designed for gradual traffic shifting, not pre-validation with zero initial traffic.

Practice this question →

7

MCQeasy

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

A.AWS CloudFormation

B.AWS Elastic Beanstalk

C.AWS CodeDeploy

D.AWS Systems Manager

AnswerA

AWS CloudFormation is the native infrastructure-as-code service that lets you define the Lambda function, IAM role, and every related resource in a declarative JSON or YAML template. CloudFormation automatically handles resource dependencies, creation order, and rollback on failure, making it ideal for automating repeatable, consistent environments. It is the correct tool because you need to provision the resources themselves, not just deploy code to existing infrastructure.

Why this answer

AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Exam trap

The trap here is that candidates often confuse AWS CodeDeploy (which can deploy Lambda code) with the ability to create the Lambda function and its IAM role, but CodeDeploy does not provision the underlying infrastructure resources—it only handles the deployment of the code to an existing function.

How to eliminate wrong answers

Option B (AWS Elastic Beanstalk) is wrong because it is a PaaS service designed for deploying and scaling web applications, not for creating individual Lambda functions and IAM roles via infrastructure as code. Option C (AWS CodeDeploy) is wrong because it automates code deployments to EC2, Lambda, or on-premises instances, but it does not provision the underlying IAM roles or Lambda function resources; it only deploys the code. Option D (AWS Systems Manager) is wrong because it provides operational management and automation for AWS resources (e.g., patching, runbooks), but it is not designed for declarative infrastructure provisioning of Lambda functions and IAM roles.

Practice this question →

8

MCQmedium

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The SysOps administrator checks the deployment logs and finds that the application installation script exits with a non-zero exit code. What is the MOST likely cause?

A.The Auto Scaling group does not have enough instances to meet the minimum capacity.

B.The security group for the instances blocks outbound traffic to CodeDeploy endpoints.

C.The AppSpec file contains a lifecycle hook that fails.

D.The CodeDeploy agent is outdated on the instances.

AnswerC

A failing lifecycle hook leads to non-zero exit code and deployment failure.

Why this answer

A non-zero exit code from an AppSpec lifecycle hook (e.g., ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService) during the deployment process causes the overall deployment to fail. The error message indicates that individual instances failed deployment, and the installation script exiting with a non-zero exit code is a direct sign of a lifecycle hook failure. Option A is incorrect because insufficient instances in the Auto Scaling group would trigger a different error related to minimum capacity, not a script exit code.

Option B is incorrect because the security group blocking outbound traffic would prevent the CodeDeploy agent from communicating with the service, resulting in a connection error, not a script exit code issue. Option D is incorrect because an outdated CodeDeploy agent would typically produce agent-specific errors or version mismatch warnings, not a non-zero exit code from the installation script.

Practice this question →

9

Multi-Selecteasy

A SysOps administrator is implementing an automated backup solution for Amazon RDS databases. The solution must support point-in-time recovery and cross-region disaster recovery. Which TWO AWS services or features should be used?

Select 2 answers

A.Manual DB snapshots.

B.Cross-region read replicas.

C.Automated backups with a retention period.

D.Amazon S3 lifecycle policies.

E.Automated cross-region snapshot copy.

AnswersC, E

Automated backups with a retention period enable RDS to automatically perform daily backups and capture transaction logs every five minutes, allowing point-in-time recovery to any second within the configured retention window (default 7 days, maximum 35 days). This option is technically valid for automated backups, but it is confined to a single Region; it does not provide cross-Region durability or disaster recovery, so it fails the specific requirement for a backup copy stored in a different geographical location.

Why this answer

Automated backups (Option C) enable point-in-time recovery within a specified retention period, meeting the backup requirement. Automated cross-region snapshot copy (Option E) provides cross-region disaster recovery by automatically copying snapshots to another AWS region. Manual DB snapshots (Option A) are not automated, so they do not satisfy the automation requirement.

Cross-region read replicas (Option B) are designed for read scaling and do not serve as a backup solution. Amazon S3 lifecycle policies (Option D) are used for managing object storage, not for RDS backup automation.

Practice this question →

10

MCQmedium

A company manages multiple AWS accounts under AWS Organizations. The SysOps administrator needs to deploy a baseline set of AWS Config rules and an Amazon SNS topic to each account in the organization. The deployment must be centrally managed from the management account and automatically applied to any new member account added in the future. Which solution should the administrator use?

A.Create an AWS CloudFormation StackSet with the template containing the AWS Config rules and SNS topic. Configure the StackSet to deploy to the organization and enable automatic deployment to new accounts.

B.Use AWS Service Catalog to create a product that bundles the AWS Config rules and SNS topic. Grant each account access to launch the product.

C.Configure AWS Config conformance packs in the management account and use AWS Resource Access Manager to share them with member accounts.

D.Create an AWS Organizations Service Control Policy (SCP) that enforces the creation of AWS Config rules and SNS topics in every account.

AnswerA

CloudFormation StackSets can centrally deploy stacks to accounts in AWS Organizations. With automatic deployment enabled, new accounts added to the organization will automatically receive the stack.

Why this answer

AWS CloudFormation StackSets can be deployed to an entire AWS Organizations organization or organizational units (OUs), and they support automatic deployment to new accounts added to the organization. By creating a StackSet with a template that defines the AWS Config rules and SNS topic, and enabling automatic deployment, the administrator ensures that every current and future member account receives the baseline configuration without manual intervention.

Exam trap

The trap here is that candidates often confuse Service Control Policies (SCPs) with resource enforcement, not realizing that SCPs only control permissions and cannot create or configure resources like AWS Config rules or SNS topics.

How to eliminate wrong answers

Option B is wrong because AWS Service Catalog requires each account to manually launch the product, which does not provide automatic deployment to new accounts and is not centrally enforced. Option C is wrong because AWS Config conformance packs can be deployed to multiple accounts via StackSets, but AWS Resource Access Manager (RAM) is used to share resources like subnets or license configurations, not to deploy conformance packs; conformance packs themselves are deployed using StackSets or directly per account. Option D is wrong because Service Control Policies (SCPs) are used to restrict permissions and cannot enforce the creation of specific resources like AWS Config rules or SNS topics; they only control what actions are allowed or denied.

Practice this question →

11

MCQmedium

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

A.Configure the Application Load Balancer with sticky sessions (session affinity).

B.Disable the feature that stores session state locally.

C.Use Amazon ElastiCache for Redis to store session data externally.

D.Modify the application to store session data in an Amazon RDS database.

AnswerC

Amazon ElastiCache for Redis provides a fast, in-memory data store that can hold session data externally. This makes the application stateless, allowing any instance in the Auto Scaling group to handle requests without losing session data. Requires minimal code changes.

Why this answer

Using Amazon ElastiCache for Redis to store session data externally allows the application to be stateless, enabling seamless scaling across multiple EC2 instances in an Auto Scaling group. This approach requires minimal code changes (typically just configuring the application to use a Redis endpoint instead of local storage) and ensures session data is not lost if an instance fails. Option A (sticky sessions) is a workaround but does not eliminate the dependency on local storage; sessions are still lost if an instance fails.

Option B (disabling local session storage) does not solve the problem because the application still needs persistent session storage. Option D (using RDS) is possible but is not the best choice for session data because relational databases are typically slower for session caching and require more significant code and schema changes compared to Redis, which is an in-memory data store optimized for session management.

Practice this question →

12

MCQmedium

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

A.Create a new commit with an empty message to trigger the pipeline.

B.Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.

C.Wait for the pipeline to automatically retry after the failure.

D.Re-upload the same artifact to the source S3 bucket to trigger the pipeline.

AnswerB

Using the 'Release change' button in the CodePipeline console manually reruns the pipeline from the source stage, using the latest source revision. This is the correct action because it triggers a new execution without requiring a new commit.

Why this answer

The correct action is to use the 'Release change' button in the CodePipeline console. This manually reruns the pipeline from the source stage, using the latest source revision. Option A is incorrect because creating a new commit with an empty message would trigger the pipeline only if the source repository is configured to detect changes, but it is unnecessary.

Option C is incorrect because CodePipeline does not automatically retry after a failure; it stops at the failed stage. Option D is incorrect because re-uploading the same artifact may not trigger the pipeline if the S3 event is configured to detect only new objects, and it is not the standard procedure to rerun the pipeline.

Practice this question →

13

MCQhard

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?

A.Modify the Auto Scaling group's health check type to ELB

B.Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count

C.Modify the Auto Scaling group's health check grace period to a lower value

D.Modify the CodeDeploy deployment to ignore the lifecycle hook failure

AnswerA

When the health check type is set to ELB, the Auto Scaling group uses the Application Load Balancer's health checks. If the test hook fails, the instance will be marked unhealthy by the ALB, and the Auto Scaling group will terminate and replace it, ensuring only healthy instances remain.

Why this answer

Setting the Auto Scaling group's health check type to ELB (Elastic Load Balancer) ensures that the Auto Scaling group uses the ELB's health check status to determine instance health. When the test lifecycle hook fails, the new instances are not marked as healthy by the ELB, causing the Auto Scaling group to automatically terminate and replace them. This aligns with the requirement to automatically replace failed instances, as the default EC2 health check only considers instance status (e.g., running vs. stopped) and does not reflect application-level health.

Exam trap

The trap here is that candidates often assume the default EC2 health check is sufficient for detecting application-level failures, but it only monitors instance status (e.g., running/stopped), not the success of lifecycle hooks or application health, so the ELB health check type is required to trigger automatic replacement.

How to eliminate wrong answers

Option B is wrong because increasing the minimum healthy instance count in the CodeDeploy deployment configuration (e.g., using CodeDeployDefault.AllAtOnce or a custom configuration) does not cause failed instances to be terminated and replaced; it only adjusts the number of instances that must remain healthy during the deployment, which could actually reduce the deployment's tolerance for failures. Option C is wrong because reducing the health check grace period would cause the Auto Scaling group to check instance health sooner, but it does not change the health check type; with the default EC2 health check, the test hook failure is not detected, so a shorter grace period has no effect on terminating failed instances. Option D is wrong because ignoring the lifecycle hook failure would allow the deployment to proceed despite the test failure, but it would not trigger automatic termination and replacement of the failed instances; the instances would remain in service, potentially causing application issues.

Practice this question →

14

Multi-Selecteasy

A SysOps administrator is creating an Auto Scaling group using a launch template. The administrator wants to ensure that instances are automatically registered with an Application Load Balancer (ALB) target group. Which TWO steps are required? (Choose TWO.)

Select 2 answers

A.Configure the instance security group to allow traffic from the ALB.

B.Specify the target group ARN in the Auto Scaling group configuration.

C.Configure health checks on the Auto Scaling group to use ELB.

D.Create a security group for the ALB and attach it to the Auto Scaling group.

E.Include the target group ARN in the launch template.

AnswersA, B

To allow the Application Load Balancer to forward traffic and perform health checks, the instance security group must contain an inbound rule that permits traffic from the ALB's security group or CIDR range on the application's port. If this rule is missing, the ALB's health checks will time out and instances will be marked unhealthy, preventing the ALB from serving requests. Even after the target group ARN is attached, this security group rule is necessary for end-to-end connectivity.

Why this answer

To automatically register instances with an ALB target group, you must configure the instance security group to allow traffic from the ALB (Option A) and specify the target group ARN in the Auto Scaling group configuration (Option B). Option C is incorrect because health checks are configured on the target group, not on the Auto Scaling group. Option D is incorrect because you attach the target group to the Auto Scaling group, not a security group.

Option E is incorrect because the target group ARN is specified in the Auto Scaling group, not in the launch template.

Practice this question →

15

MCQhard

A containerized API runs on Amazon ECS with an Application Load Balancer. The team wants to deploy new container versions with zero downtime, automatically route traffic to the new version only after health checks pass, and automatically roll back if error rates spike within 10 minutes of the shift. Which deployment strategy and configuration implements all three requirements?

A.Use CodeDeploy with the ECS blue/green deployment type, configure a Canary or Linear traffic shifting strategy, and attach a CloudWatch alarm for error rate as a deployment alarm

B.Update the ECS service with a rolling update deployment configuration and set the minimum healthy percent to 100

C.Create a second ECS service with the new task definition and use Route 53 weighted routing to shift traffic at the DNS level

D.Enable ECS circuit breaker on the service to roll back failed deployments automatically

AnswerA

The ECS blue/green deployment starts the green task set, registers it with a second target group, and uses ALB weighted routing to shift traffic progressively. The deployment alarm monitors a 5xx error rate metric. If the alarm enters ALARM state at any point during traffic shifting or the bake period, CodeDeploy automatically shifts traffic back to the original blue target group. The team defines the 10-minute bake window via the deployment configuration's terminationWaitTimeInMinutes.

Why this answer

CodeDeploy's ECS blue/green deployment type supports canary or linear traffic shifting, which automatically routes traffic to the new version only after health checks pass. By attaching a CloudWatch alarm for error rate as a deployment alarm, CodeDeploy can automatically trigger a rollback if error rates spike within the specified monitoring period (e.g., 10 minutes), meeting all three requirements: zero downtime, health-check-gated traffic shifting, and automatic rollback on error rate spikes.

Exam trap

The trap here is that candidates often confuse the ECS circuit breaker (which only handles task-level failures during deployment) with the need for post-deployment error rate monitoring and traffic shifting, leading them to select Option D without realizing it lacks the canary/linear traffic shifting and CloudWatch alarm integration required for automatic rollback based on error spikes.

How to eliminate wrong answers

Option B is wrong because a rolling update with minimum healthy percent set to 100 does not provide automatic rollback based on error rate spikes; it only ensures availability during the update but lacks the traffic-shifting and alarm-based rollback capabilities. Option C is wrong because using Route 53 weighted routing at the DNS level does not provide health-check-gated traffic shifting at the application layer, and DNS caching can cause delayed or uneven traffic distribution, failing to ensure zero downtime and immediate rollback on error spikes. Option D is wrong because the ECS circuit breaker only rolls back a service if tasks fail to start or become unhealthy during deployment, but it does not monitor post-deployment error rates or support canary/linear traffic shifting.

Practice this question →

16

Multi-Selecteasy

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Select 2 answers

A.Auto Scaling group

B.NAT Gateway

C.Amazon S3 bucket

D.Amazon Route 53 hosted zone

E.Application Load Balancer

AnswersA, E

An Auto Scaling group is capacity management that spans multiple Availability Zones, launching and terminating instances to maintain a desired count and to replace unhealthy ones automatically. By distributing instances across AZs, it ensures that the application tier remains available even if an entire AZ becomes unavailable, providing fault tolerance and elasticity.

Why this answer

Options A and E are correct. An Auto Scaling group maintains a desired number of instances across multiple Availability Zones, ensuring resilience and high availability. An Application Load Balancer (ALB) distributes incoming traffic across those instances, further supporting high availability and fault tolerance.

Option B (NAT Gateway) is used for outbound internet access from private subnets, not for high availability of the application. Option C (S3 bucket) is a storage service and does not directly impact compute high availability. Option D (Route 53 hosted zone) provides DNS routing but is not a primary resource for ensuring high availability within the application tiers; Route 53 can be used for DNS-level failover, but the question asks for resources directly in the CloudFormation template to ensure high availability across AZs, and the ALB and Auto Scaling group are the core components.

Practice this question →

17

Drag & Dropmedium

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Restoration starts by selecting the snapshot, then configuring instance details, security, and parameters, then initiating the restore.

Practice this question →

18

Multi-Selectmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running in a VPC with public and private subnets. The SysOps administrator needs to update the environment to use a new platform version. Which TWO steps should be taken to ensure a smooth update with minimal downtime? (Select TWO.)

Select 2 answers

A.Update the security groups to allow traffic from the new environment.

B.Take a snapshot of the attached Amazon RDS database before starting the update.

C.Perform a blue/green deployment by cloning the environment and swapping the CNAME.

D.Enable immutable updates in the environment configuration.

E.Manually drain connections from the current environment before swapping.

AnswersC, D

Performing a blue/green deployment by cloning the environment, updating the clone to the new platform, and then swapping the CNAME is indeed a valid way to minimize downtime and lets you test the new version without affecting production. It gives you a full staging environment and an instant cutover via DNS, but it requires manual orchestration to keep the clone current and to execute the CNAME swap. While it achieves minimal downtime, it demands more operational effort than simply enabling immutable updates, which handles the entire process automatically.

Why this answer

Options C and D are correct. Option C: Performing a blue/green deployment by cloning the environment and swapping the CNAME minimizes downtime because the new environment is fully tested before traffic is switched to it. Option D: Enabling immutable updates in the environment configuration ensures that Elastic Beanstalk deploys the new platform version to a separate set of instances and then swaps traffic, reducing downtime and rollback risk.

Option A is incorrect because updating security groups is not a required step for platform updates; security groups are typically managed separately. Option B is incorrect because taking an RDS snapshot is a backup best practice, but it does not by itself minimize downtime during a platform update. Option E is incorrect because connection draining is handled automatically by Elastic Beanstalk during the CNAME swap or immutable deployment; manual draining is unnecessary.

Practice this question →

19

MCQmedium

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a deployment stage that uses AWS CloudFormation to deploy infrastructure. The company wants to add a manual approval step before the CloudFormation deployment. How should this be configured?

A.Add a CloudFormation change set action before the deployment.

B.Configure an Amazon SNS topic to send a notification and require a confirmation.

C.Add a manual approval action in the pipeline before the CloudFormation deployment stage.

D.Use an AWS Lambda function to send an email and wait for a response.

AnswerC

In CodePipeline, a manual approval action is a stage action with category Approval that pauses the pipeline execution at that point. Once the action is reached, the pipeline enters a Wait state and notifies designated approvers via SNS; deployment to CloudFormation proceeds only after an authorized IAM user or role approves the change. This is the native mechanism designed to block progression until human sign-off, making it the correct way to require confirmation before deployment.

Why this answer

AWS CodePipeline has a built-in approval action that pauses the pipeline at a specified stage until a manual approval is granted. This allows a human to review and approve before the CloudFormation deployment proceeds. Option A is wrong because a CloudFormation change set action creates a change set for review but does not pause the pipeline; the pipeline continues unless manually stopped separately.

Option B is wrong because Amazon SNS alone sends notifications but does not pause the pipeline; you would need an approval action to block execution. Option D is wrong because an AWS Lambda function cannot block the pipeline; it can notify but the pipeline will continue unless an approval action is used.

Practice this question →

20

MCQmedium

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and a security group. The administrator wants to ensure that when the stack is updated, the security group is not accidentally replaced if its properties change. The administrator wants to receive a failure if an update would require replacement of the security group. Which CloudFormation feature should the administrator use?

A.Add a 'DeletionPolicy' attribute set to 'Retain' on the security group resource.

B.Add a 'CreationPolicy' attribute to the security group resource.

C.Define a stack policy that denies replacement of the security group resource.

D.Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' on the security group.

AnswerC

A stack policy can specify the allowed update actions per resource. By denying the 'Replace' action for the security group, CloudFormation will fail updates that would require recreating the security group, protecting it from accidental replacement.

Why this answer

A stack policy can explicitly deny update actions that would replace a resource, such as the security group. By defining a stack policy with a Deny statement for the 'Replace' effect on the security group's logical resource ID, CloudFormation will fail the update if any property change triggers a replacement, preventing accidental deletion and recreation.

Exam trap

The trap here is that candidates confuse 'DeletionPolicy' (which only applies on stack deletion) with preventing replacement during updates, or mistakenly think 'UpdatePolicy' or 'CreationPolicy' can control resource replacement behavior.

How to eliminate wrong answers

Option A is wrong because the 'DeletionPolicy' attribute set to 'Retain' only preserves the security group when the stack is deleted, not during an update; it does not prevent replacement during an update. Option B is wrong because 'CreationPolicy' is used to wait for signals or resource creation success, not to control update behavior or prevent replacement. Option D is wrong because 'UpdatePolicy' with 'AutoScalingReplacingUpdate' is specific to Auto Scaling groups to control rolling updates, not applicable to security groups.

Practice this question →

21

MCQeasy

A SysOps administrator wants to deploy a new version of an application to an existing Auto Scaling group of Amazon EC2 instances. The deployment must minimize disruption by launching new instances, performing health checks, and shifting traffic to the new instances before terminating the old ones. Which AWS CodeDeploy deployment configuration should the administrator choose?

A.Blue/green

B.Rolling

C.AllAtOnce

D.Canary

AnswerA

Blue/green in CodeDeploy for EC2 Auto Scaling groups provisions a separate, temporary 'green' replacement fleet alongside the original 'blue' fleet. After the green instances pass the configured health checks and tests, the load balancer or target group shifts production traffic from blue to green, enabling an immediate, nearly zero-downtime release. Because the blue fleet remains untouched until deployment completion, rollback is trivial: just flip traffic back and terminate green. This is the only option that both eliminates downtime and provides a built-in instant rollback path.

Why this answer

The blue/green deployment configuration in AWS CodeDeploy is designed to minimize disruption by provisioning a new set of instances (green environment), performing health checks against them, and then shifting traffic from the old instances (blue environment) to the new ones before terminating the old instances. This matches the requirement of launching new instances, health-checking, and shifting traffic before termination, which is not possible with in-place deployment types like rolling or all-at-once.

Exam trap

The trap here is that candidates often confuse 'rolling' with 'blue/green' because both involve gradual updates, but rolling updates modify the existing Auto Scaling group in-place without creating a separate environment or shifting traffic before termination.

How to eliminate wrong answers

Option B (Rolling) is wrong because it performs an in-place update by gradually replacing instances within the existing Auto Scaling group without creating a separate environment, so traffic is not shifted before termination and health checks occur on the same instances. Option C (AllAtOnce) is wrong because it deploys to all instances simultaneously in-place, causing full downtime or disruption during the update. Option D (Canary) is wrong because it is a traffic-shifting pattern used in AWS CodeDeploy for Lambda or ECS deployments, not for EC2 Auto Scaling groups, and it does not launch new instances in a separate environment.

Practice this question →

22

MCQeasy

A SysOps administrator needs to deploy an application to a set of EC2 instances in an Auto Scaling group. The deployment must be performed in batches, with each batch health-checked before proceeding. Which AWS CodeDeploy deployment configuration should be used?

A.CodeDeployDefault.OneAtATime

B.CodeDeployDefault.AllAtOnce

C.CodeDeployDefault.HalfAtATime

D.CodeDeployDefault.Custom

AnswerA

OneAtATime deploys to one instance at a time, with health checks between each.

Why this answer

CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application revision to one EC2 instance at a time, waiting for the instance to pass health checks before proceeding to the next. This ensures that the deployment is performed in batches of one, with each batch health-checked before moving on, which aligns with the requirement for batch-based, health-checked deployments.

Exam trap

The trap here is that candidates often confuse 'HalfAtATime' with a batch-based approach, but it does not health-check each individual instance before proceeding to the next batch; it only checks the overall health of the fleet after each batch, which can mask failures in specific instances.

How to eliminate wrong answers

Option B (CodeDeployDefault.AllAtOnce) is wrong because it deploys to all instances simultaneously, which does not perform health checks between batches and violates the requirement for batch-based deployment. Option C (CodeDeployDefault.HalfAtATime) is wrong because it deploys to half the instances at a time, but it does not health-check each individual batch before proceeding; it only checks overall success after the batch completes, which may not meet the strict per-batch health-check requirement. Option D (CodeDeployDefault.Custom) is wrong because it is not a predefined configuration; it requires manual creation of a custom deployment configuration, which is unnecessary when a predefined configuration meets the requirement.

Practice this question →

23

MCQhard

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?

A.Use Patch Manager to apply the script as a patch baseline.

B.Create an Automation document and execute it.

C.Use Run Command with a target based on the tag.

D.Create a State Manager association with the script.

AnswerC

Run Command's SendCommand API accepts a target that can be a tag key-value pair, like tag:Environment=Production, and every SSM agent that matches will execute the AWS-RunShellScript or AWS-RunPowerShellScript document immediately in a one-time, unmanaged fashion. This satisfies the requirement of running a script once across the fleet, with output optionally streamed to S3 or CloudWatch Logs for auditing. Because no association, schedule, or patch baseline is involved, it is the simplest and most direct SSM primitive for this task.

Why this answer

Run Command enables you to run commands on EC2 instances immediately and only once, using tags to target specific instances. Option A is incorrect because Patch Manager is designed for applying patches, not running arbitrary scripts. Option B is incorrect because Automation documents are for multi-step workflow orchestration, not simple one-time script execution.

Option D is incorrect because State Manager is for recurring configurations or ensuring a desired state over time, not immediate one-time execution.

Practice this question →

24

MCQmedium

A company uses AWS CodePipeline to deploy a web application. The pipeline includes a stage that runs a database migration script. The SysOps administrator wants to ensure that if the migration script fails, the entire pipeline stops and the previous version of the application remains deployed. Which pipeline stage configuration should be used to achieve this behavior?

A.Use a parallel action group for the migration step so other steps continue.

B.Configure the migration step as a sequential action and set the OnFailure to ABORT.

C.Configure the migration step as a sequential action and set the OnFailure to ROLLBACK.

D.Use a manual approval step after the migration to verify success.

AnswerB

Configuring the migration step as a sequential action with OnFailure set to ABORT causes CodePipeline to immediately stop the pipeline execution when that action fails, without running any subsequent actions or stages. The existing deployment remains untouched because no further deployment stages are triggered after the failure. This matches the requirement precisely: the pipeline halts and the prior version stays in place.

Why this answer

Setting the migration step as a sequential action with OnFailure set to ABORT ensures that if the migration script fails, the pipeline immediately stops and does not proceed to any subsequent stages. This prevents the deployment of a new application version that depends on a failed database migration, thereby keeping the previous version deployed.

Exam trap

The trap here is that candidates confuse the OnFailure ROLLBACK option with a full infrastructure rollback (like AWS CloudFormation stack rollback), not realizing that CodePipeline's ROLLBACK only affects the pipeline execution state and does not automatically revert the deployed application or database changes.

How to eliminate wrong answers

Option A is wrong because using a parallel action group would allow other steps to continue even if the migration fails, which contradicts the requirement to stop the entire pipeline and preserve the previous deployment. Option C is wrong because setting OnFailure to ROLLBACK would attempt to revert the pipeline to a previous state, but CodePipeline does not natively support automatic rollback of deployed application versions; ROLLBACK only retries the failed action or transitions to a failed state without restoring the prior application version. Option D is wrong because a manual approval step after the migration only adds a gate to verify success but does not automatically stop the pipeline or prevent deployment if the migration fails; it relies on human intervention and does not enforce the required behavior.

Practice this question →

25

MCQmedium

A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?

A.Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket

B.Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script

C.Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script

D.Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in

AnswerA

Run Command invocations use the SSM Agent's existing outbound HTTPS connection (port 443) — no inbound rule changes are needed. The command output for each instance is stored separately in S3, allowing the team to review per-instance results. Commands can target instances by tag (e.g., Environment=production) to avoid listing all 150 instance IDs manually.

Why this answer

SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.

Exam trap

The trap here is that candidates may assume EC2 Instance Connect or a bastion host are acceptable workarounds, but both still rely on SSH (port 22), which is explicitly prohibited by the security policy, whereas SSM Run Command operates over HTTPS and fully complies.

How to eliminate wrong answers

Option B is wrong because it requires opening SSH port 22 on the instances or the bastion host, which directly violates the security policy prohibiting SSH access. Option C is wrong because EC2 Instance Connect still relies on SSH (port 22) to establish a temporary session, which is also prohibited by the policy. Option D is wrong because terminating and re-launching instances from a new AMI is an overly destructive and inefficient approach that does not capture runtime configuration inventory data from the existing instances.

Practice this question →

26

MCQhard

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The admin has a template that creates an EC2 instance with a custom software stack. The software stack must be installed and configured using PowerShell scripts. The admin wants to minimize operational overhead by automating the creation of an AMI that includes the software stack, and the AMI should be rebuilt on a weekly basis to include the latest security patches. Which combination of AWS services should be used?

A.Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.

B.Use AWS Systems Manager Automation to run a PowerShell script on an existing EC2 instance, then manually create an AMI each week.

C.Use AWS CodePipeline with CodeBuild to run the PowerShell scripts and create an AMI using the AWS CLI, triggered by a weekly CloudWatch Events schedule.

D.Use Amazon EC2 Auto Scaling with a lifecycle hook to run the PowerShell script on instance launch, and schedule a weekly instance refresh.

AnswerA

EC2 Image Builder is the purpose-built AWS service for producing golden AMIs. A component encapsulates the PowerShell script logic, a recipe bundles that component with a base image and OS settings, and a pipeline can be scheduled to run weekly to automatically build, validate, and register the AMI. It also supports post-build testing and cross-account/region distribution, giving a fully managed, auditable image lifecycle with minimal operational overhead.

Why this answer

EC2 Image Builder is purpose-built for automating the creation, patching, and testing of custom AMIs. By defining a component that encapsulates the PowerShell scripts, creating a recipe that references that component, and scheduling a pipeline to run weekly, the administrator achieves fully automated, repeatable AMI builds with minimal operational overhead. This directly meets the requirement for weekly rebuilds with the latest security patches.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing a multi-service orchestration (like CodePipeline + CodeBuild) when a single, purpose-built service (EC2 Image Builder) is designed exactly for this use case, leading to unnecessary complexity and operational overhead.

How to eliminate wrong answers

Option B is wrong because it requires manual intervention each week to create the AMI, which contradicts the goal of minimizing operational overhead and does not provide automation. Option C is wrong because while CodePipeline and CodeBuild can automate AMI creation, they are not the simplest or most purpose-built solution for this task; EC2 Image Builder is specifically designed for image lifecycle management, reducing complexity and maintenance. Option D is wrong because EC2 Auto Scaling with lifecycle hooks and instance refresh is designed for managing running instances and fleet updates, not for building and maintaining a golden AMI; it does not provide a mechanism to create a new AMI on a weekly schedule.

Practice this question →

27

MCQeasy

A company runs 200 EC2 Linux instances across three accounts. The security team requires that critical OS patches are applied automatically every Sunday at 2 AM UTC. Currently patches are applied manually and inconsistently. What is the recommended AWS-native solution?

A.Configure a Patch Manager patch baseline and maintenance window scheduled for Sunday 02:00 UTC; associate the Run Patch Baseline task with all EC2 instance targets

B.Create a cron job on each instance that runs 'yum update -y' every Sunday at 2 AM

C.Use AWS Config managed rules to detect unpatched instances and send SNS notifications for manual remediation

D.Build a CodePipeline that runs weekly, creates new AMIs with the latest patches, and replaces all instances via an Auto Scaling instance refresh

AnswerA

The patch baseline filters patch approvals by severity (e.g., CRITICAL, IMPORTANT). The maintenance window triggers the AWS-RunPatchBaseline SSM document on schedule. All 200 instances receive the same baseline and schedule, replacing manual inconsistency with automated consistency. Patch compliance is recorded in the Patch Manager compliance dashboard.

Why this answer

AWS Systems Manager Patch Manager, combined with a Maintenance Window, provides a fully AWS-native, automated solution for patching EC2 instances on a schedule. The Patch Manager service uses a patch baseline to define which patches are approved (e.g., critical OS patches), and the Maintenance Window triggers the 'AWS-RunPatchBaseline' SSM document at the specified time (Sunday 02:00 UTC) against all targeted instances. This eliminates manual effort and ensures consistent, auditable patching across multiple accounts and instances.

Exam trap

The trap here is that candidates may choose Option D (AMI refresh) because it seems more 'complete' for patching, but they overlook that Patch Manager with Maintenance Windows is the simplest, most direct AWS-native solution for scheduled patching, and the question explicitly asks for the 'recommended' solution, not the most elaborate one.

How to eliminate wrong answers

Option B is wrong because it requires manual creation and maintenance of cron jobs on each instance, which is not a centralized, AWS-native solution and does not scale across 200 instances and three accounts; it also lacks auditing and compliance tracking. Option C is wrong because AWS Config rules can only detect unpatched instances and send notifications, but they do not automatically apply patches, leaving remediation to manual action, which fails the requirement for automatic application. Option D is wrong because while CodePipeline and AMI refresh can achieve patching, it is an overly complex, non-native approach that requires building and maintaining a pipeline, creating new AMIs, and performing instance refreshes, which is not the recommended AWS-native solution for simple scheduled patching.

Practice this question →

28

MCQhard

An organization is using AWS CodeDeploy with a blue/green deployment configuration for an EC2/On-Premises compute platform. During a deployment, the new instances pass all health checks, but the old instances are not terminated after the deployment completes. What is the most likely cause?

A.The Auto Scaling group has a cooldown period that prevents termination.

B.The new instances failed the initial health check.

C.The deployment configuration specifies 'Reroute traffic to new instances and keep old instances running' with no termination.

D.The deployment was rolled back automatically.

AnswerC

Blue/green deployments can be configured to not terminate old instances automatically.

Why this answer

In AWS CodeDeploy blue/green deployments for the EC2/On-Premises compute platform, the deployment configuration determines the lifecycle of the original (old) instances. Option C is correct because the deployment configuration explicitly specifies 'Reroute traffic to new instances and keep old instances running' with no termination, which instructs CodeDeploy to leave the old instances running after traffic is rerouted. This behavior is controlled by the deployment group's configuration, not by Auto Scaling or health check failures.

Exam trap

The trap here is that candidates assume old instances are always terminated after a successful blue/green deployment, overlooking the deployment configuration option that explicitly allows keeping old instances running with no termination.

How to eliminate wrong answers

Option A is wrong because Auto Scaling cooldown periods prevent scaling activities, not CodeDeploy's termination of old instances in a blue/green deployment; CodeDeploy manages instance termination independently via its own lifecycle hooks. Option B is wrong because the question states that new instances pass all health checks, so a failed initial health check is not applicable. Option D is wrong because a rollback would revert the deployment to the old instances, not leave the old instances running alongside the new ones; the scenario describes old instances not being terminated, not a rollback.

Practice this question →

29

Multi-Selectmedium

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances do not have the CodeDeploy agent installed. Which THREE actions are required to resolve this issue?

Select 3 answers

A.Install the CodeDeploy agent on the instances using user data in the launch configuration.

B.Create a new AMI that includes the CodeDeploy agent.

C.Use AWS Systems Manager Run Command to install the agent on existing instances.

D.Change the deployment configuration to 'OneAtATime'.

E.Update the Auto Scaling group's launch configuration to use a different instance type.

AnswersA, B, C

User data can install the agent at launch.

Why this answer

Specifying the CodeDeploy agent installation script in the user data of a launch configuration ensures that any new instance launched by the Auto Scaling group automatically installs and starts the agent. This is a common practice to bootstrap instances with the required software before they register with CodeDeploy.

Exam trap

The trap here is that candidates may confuse deployment configuration settings (like 'OneAtATime') with the fundamental requirement of having the agent installed, or think that changing the instance type will somehow resolve the agent dependency.

Practice this question →

30

MCQmedium

A SysOps administrator is updating an AWS CloudFormation stack that contains an Amazon RDS DB instance. The administrator wants to prevent accidental replacement of the database during the update. Which CloudFormation feature should be used?

A.Change sets

B.Stack policies

C.Resource signals

D.Nested stacks

AnswerB

Stack policies are JSON-based IAM-style policies attached to a CloudFormation stack that act as an explicit guard against certain update actions. By configuring a stack policy that denies the Update:Replace action for the RDS DB instance resource (using "Effect": "Deny" and "Action": ["Update:Replace"]), CloudFormation will refuse to replace the database during any stack update. This is exactly the protection the administrator needs to ensure the database is not inadvertently replaced.

Why this answer

Stack policies are the correct feature because they allow you to define explicit deny statements that prevent CloudFormation from updating or replacing specific resources, such as an RDS DB instance, during a stack update. By setting a stack policy that denies replacement actions on the database resource, the administrator ensures that even if the template changes would normally trigger a replacement, the update will fail rather than accidentally recreate the database.

Exam trap

The trap here is that candidates often confuse change sets (which only preview changes) with stack policies (which enforce guardrails), leading them to incorrectly select change sets as the mechanism to prevent accidental replacement.

How to eliminate wrong answers

Option A is wrong because change sets allow you to preview the changes that will be made to a stack before executing them, but they do not prevent the changes from being applied; they only provide visibility. Option C is wrong because resource signals are used to coordinate the creation or update of resources by sending success/failure signals (e.g., via cfn-signal), but they have no mechanism to block replacement of a specific resource. Option D is wrong because nested stacks help organize and reuse templates by embedding one stack within another, but they do not provide any resource-level protection against accidental replacement during updates.

Practice this question →

31

MCQmedium

A company uses AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The SysOps administrator needs to implement a deployment strategy that ensures zero downtime by creating a new set of instances alongside the current ones, then gradually shifting traffic to the new instances after they pass health checks. If a problem is detected, traffic can be instantly redirected back to the original instances. Which deployment configuration should the administrator use?

A.Rolling update

B.Blue/green deployment

C.All at once deployment

D.Canary deployment

AnswerB

Blue/green deployment provisions a complete second environment (green) alongside the current production environment (blue), allowing you to run tests against the new version while old traffic continues to flow. Once the new environment is validated, you shift traffic at the load balancer or DNS level—either all at once or gradually—making the cutover near-instantaneous. If the new environment fails, you simply switch traffic back to the still-available blue environment, enabling instant rollback with zero downtime, which is why this is the correct choice for high-availability web applications.

Why this answer

Blue/green deployment is the correct choice because it creates a completely new set of instances (green environment) alongside the existing ones (blue environment), shifts traffic gradually to the new instances after health checks pass, and allows instant rollback by redirecting traffic back to the original instances. AWS CodeDeploy supports this strategy natively with a blue/green deployment configuration, ensuring zero downtime during the transition.

Exam trap

The trap here is that candidates often confuse canary deployments with blue/green deployments, but canary deployments do not create a full parallel environment and lack the instant, full-traffic rollback capability that blue/green provides.

How to eliminate wrong answers

Option A is wrong because a rolling update replaces instances incrementally, which can cause temporary capacity reduction and does not guarantee zero downtime or instant rollback to the original fleet. Option C is wrong because an all-at-once deployment updates all instances simultaneously, causing downtime during the deployment and no ability to instantly redirect traffic back. Option D is wrong because a canary deployment shifts a small percentage of traffic to new instances gradually, but it does not create a full parallel environment for instant rollback; it typically requires manual or automated traffic shifting and may not provide the same instant rollback capability as blue/green.

Practice this question →

32

Multi-Selecthard

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Linux 2 AMI with specific security agents installed. The company wants to ensure that all environment instances use this custom AMI. Which combination of steps should be taken? (Choose two.)

Select 2 answers

A.Set the AMI ID in a CloudFormation template and associate it with the environment.

B.Use AWS CodeDeploy to deploy the application to the custom AMI.

C.Create a custom AMI using the Elastic Beanstalk platform as the base.

D.Configure the .ebextensions folder to set the AMI ID for the Auto Scaling launch configuration.

E.Use Packer to create the custom AMI from any base image.

AnswersC, D

This ensures compatibility with the platform.

Why this answer

To ensure all environment instances use a custom AMI with specific security agents, you must create the custom AMI from the Elastic Beanstalk platform (C) to maintain compatibility. Then configure the .ebextensions folder to set the AMI ID in the Auto Scaling launch configuration using the aws:autoscaling:launchconfiguration namespace (D). Option A is incorrect because the AMI ID is set in the environment configuration, not a CloudFormation template.

Option B is incorrect because CodeDeploy deploys application code, not the AMI itself. Option E is incorrect because while Packer can be used to create AMIs, it is not required; the custom AMI must be based on the Elastic Beanstalk platform, not any base image.

Practice this question →

33

MCQeasy

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

A.Terminate all instances and let the Auto Scaling group launch new ones.

B.Perform an immutable update.

C.Clone the environment with the new configuration and swap URLs.

D.Perform a rolling update based on health.

AnswerD

Rolling updates replace instances in batches, minimizing downtime.

Why this answer

A rolling update based on health (Option D) is the correct method to minimize downtime when updating an instance type in Elastic Beanstalk. This approach updates instances in batches, replacing them with the new instance type only after the previous batch passes health checks, ensuring application availability throughout the process. Elastic Beanstalk's rolling update with health-based batching terminates and launches instances incrementally, avoiding full environment disruption.

Exam trap

The trap here is that candidates often confuse 'immutable update' (Option B) as the best minimal-downtime method, but for a simple instance type change, a rolling update based on health is more appropriate because it avoids the overhead of provisioning a full parallel environment and the potential for brief traffic interruption during the swap.

How to eliminate wrong answers

Option A is wrong because terminating all instances and relying on the Auto Scaling group to launch new ones causes complete downtime until all instances are replaced and pass health checks, which is not minimal. Option B is wrong because an immutable update launches a full new set of instances in a separate Auto Scaling group, then swaps them in, which can cause a brief traffic interruption during the DNS swap and is not the most minimal-downtime approach for a simple instance type change. Option C is wrong because cloning the environment and swapping URLs introduces additional complexity and potential DNS propagation delays, and while it can achieve zero downtime, it is overkill for a simple configuration change and not the recommended minimal-downtime method for this specific task.

Practice this question →

34

MCQmedium

A SysOps administrator manages a CloudFormation stack that deploys a web application. The stack includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to update the stack to change the EC2 instance type. The administrator wants to ensure that the update does not accidentally replace the RDS database. Which CloudFormation feature should the administrator use to protect the RDS resource from being replaced during the stack update?

A.Use a DeletionPolicy of Retain on the RDS resource.

B.Use a stack policy that denies updates to the RDS resource.

C.Use the Resource Signal and CreationPolicy attributes.

D.Use a Change Set to review changes before executing.

AnswerB

A stack policy can explicitly deny update, replace, or delete actions on specific resources. By applying a policy that denies update to the RDS resource, the CloudFormation update will fail if it attempts to modify the RDS instance, thus protecting it from accidental replacement.

Why this answer

A stack policy is an AWS CloudFormation feature that explicitly denies update or replacement actions on specified resources. By applying a stack policy that denies updates to the RDS resource, the administrator prevents any stack update operation (including changing the EC2 instance type) from modifying or replacing the database, even if the template changes would otherwise affect it. This is the correct approach because it provides a guardrail specifically against accidental replacement during updates.

Exam trap

The trap here is that candidates often confuse DeletionPolicy (which only applies on stack deletion) with stack policies (which control updates), leading them to incorrectly choose Option A as a safety measure during updates.

How to eliminate wrong answers

Option A is wrong because a DeletionPolicy of Retain only protects the resource when the stack is deleted, not during a stack update; it does not prevent replacement or modification during an update. Option C is wrong because Resource Signal and CreationPolicy are used to control stack creation behavior (e.g., waiting for signals before marking a resource as created), not to protect resources from being replaced during updates. Option D is wrong because a Change Set only allows you to review proposed changes before executing them; it does not prevent the update from being executed or protect the RDS resource from replacement if the update is applied.

Practice this question →

35

Drag & Dropmedium

Drag and drop the steps to troubleshoot high CPU usage on an Amazon EC2 instance into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order for troubleshooting high CPU usage on an EC2 instance starts with checking CloudWatch metrics to confirm the issue and gain initial insights. Next, connect to the instance using SSH or Systems Manager to access the operating system. Then, identify the process causing high CPU using tools like top or ps.

After identification, analyze the process to understand its behavior, such as checking logs or memory usage. Finally, take corrective action, which may include stopping, killing, or optimizing the process, or scaling the instance up. This sequence ensures efficient and accurate troubleshooting.

Practice this question →

36

MCQeasy

A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon EC2 instance. The administrator wants to update the instance type from t3.medium to t3.large without recreating the instance. The instance type change is supported as a simple update in CloudFormation. Which stack update method should the administrator use to apply this change with the least disruption?

A.Directly update the stack by modifying the template and submitting the update via the AWS Management Console, AWS CLI, or API.

B.Create a change set to review the changes, then execute the change set.

C.Apply a stack policy to the EC2 instance to allow the update, then update the stack.

D.Delete the existing stack and create a new stack with the updated instance type.

AnswerA

A direct stack update is the correct method because CloudFormation compares the modified template against the current stack and applies the changed InstanceType property to the existing EC2 instance without replacement. The update can be submitted via the AWS Management Console, AWS CLI, or API, and because this is a simple, in-place attribute change, it minimizes downtime and avoids extra operational overhead. This approach is the fastest and least disruptive way to achieve the desired configuration.

Why this answer

Changing an EC2 instance type from t3.medium to t3.large is a supported simple update in CloudFormation, meaning the resource can be updated in-place without replacement. By directly updating the stack via the AWS Management Console, AWS CLI, or API, the administrator applies the change immediately with minimal disruption, as CloudFormation will stop the instance, modify the instance type, and restart it. This method avoids the overhead of creating a change set or deleting and recreating the stack, which would cause unnecessary downtime or complexity.

Exam trap

The trap here is that candidates often assume a change set is required for all updates or that it reduces disruption, when in fact it is only a review mechanism and does not change the update behavior; the direct update is equally safe and faster for simple, supported changes.

How to eliminate wrong answers

Option B is wrong because creating a change set is an optional review step that adds delay and does not reduce disruption; executing a change set still performs the same in-place update as a direct update, so it is not the least disruptive method. Option C is wrong because stack policies are used to prevent updates to specific resources, not to allow them; applying a stack policy to allow the update is unnecessary and could inadvertently block other updates if misconfigured. Option D is wrong because deleting and recreating the stack would destroy the existing EC2 instance and create a new one, causing complete disruption and data loss (unless data is stored externally), which is far more disruptive than an in-place update.

Practice this question →

37

MCQhard

A SysOps administrator is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. What should the administrator check FIRST?

A.The CodeDeploy agent version on the instances

B.The Auto Scaling group's minimum size

C.The load balancer health check configuration

D.The ApplicationStop lifecycle event hook script in the AppSpec file

AnswerD

The ApplicationStop lifecycle event hook script in the AppSpec file is the correct cause. This hook runs on each instance before the new application revision is installed, and if it exits with a non-zero code or hangs, CodeDeploy marks that instance's deployment as failed. Each failed instance reduces the count of healthy instances, and once that count falls below the minimum healthy threshold, the overall deployment fails with the exact error observed. Therefore, checking this script for syntax errors, missing dependencies, or permission issues is the first troubleshooting step.

Why this answer

The ApplicationStop lifecycle event hook script in the AppSpec file often fails with a non-zero exit code, causing the deployment to fail with this error. The error indicates that too many instances failed or are unhealthy, and the most common cause is a faulty script. Option A is incorrect because the CodeDeploy agent version is not the first thing to check; the error is about instance failures during deployment, not agent issues.

Option B is incorrect because the Auto Scaling group's minimum size is already set to 2, and the error is not about group size but about individual instance health. Option C is incorrect because a load balancer health check configuration problem would result in a different error related to health check failures, not the specific message about instance deployment failures.

Practice this question →

38

MCQmedium

Operators have been making direct changes to AWS resources (security group rules, IAM policy modifications) that were originally created by CloudFormation stacks. The team wants to identify which stacks and specific resources have drifted from their template definitions. What is the correct tool and operation sequence?

A.Run drift detection on each CloudFormation stack; review the results in the Drift status panel to see which resources have MODIFIED or DELETED status

B.Enable AWS Config conformance packs that check CloudFormation stack compliance against desired template states

C.Re-deploy all stacks with the original templates using CloudFormation update-stack to overwrite any manual changes

D.Use AWS Trusted Advisor to identify resources that have been modified outside of their originating CloudFormation stacks

AnswerA

Drift detection calls AWS APIs to read the current configuration of each resource and compares it to the template. Resources with live configurations differing from the template are marked MODIFIED. Deleted resources outside the stack are marked DELETED. The results show the exact property-level differences, enabling targeted remediation.

Why this answer

AWS CloudFormation drift detection is the correct tool because it directly compares the current state of resources in a stack (including security group rules and IAM policies) against the stack's template definitions. Running drift detection on each stack and reviewing the Drift status panel reveals which resources have been modified or deleted outside of CloudFormation, providing the exact identification the team needs.

Exam trap

The trap here is that candidates may confuse drift detection with compliance checks (AWS Config) or remediation actions (update-stack), but the question specifically asks for identification of drifted stacks and resources, not remediation or compliance evaluation.

How to eliminate wrong answers

Option B is wrong because AWS Config conformance packs evaluate resource compliance against rules, not against CloudFormation template states; they cannot detect drift from a specific stack template. Option C is wrong because re-deploying stacks with update-stack overwrites manual changes but does not identify which stacks or resources have drifted; it is a remediation action, not a detection tool. Option D is wrong because AWS Trusted Advisor checks for best practices and cost optimization, not for drift between CloudFormation templates and actual resource configurations.

Practice this question →

39

MCQhard

An organization uses AWS OpsWorks for configuration management. The SysOps administrator notices that a stack's instances are not receiving the updated custom cookbooks after a new deployment. The cookbooks are stored in a private GitHub repository. What is the most likely cause?

A.The cookbooks are not stored in an S3 bucket.

B.The OpsWorks agent is not running on the instances.

C.The instances do not have internet access.

D.The SSH key for the Git repository is not configured in the stack.

AnswerD

Correct. AWS OpsWorks uses the SSH key stored in the stack configuration to authenticate with private GitHub repositories. If the key is missing or invalid, the instances cannot download the updated cookbooks, causing the failure.

Why this answer

AWS OpsWorks uses the SSH key configured in the stack to clone private Git repositories. Without a valid SSH key, the cookbook update fails silently. Option A is incorrect because cookbooks can be stored in S3 or Git; S3 is not required.

Option B is incorrect because the OpsWorks agent must be running, but the symptom of a missing SSH key is specific to private repositories. Option C is incorrect while instances need internet access to reach GitHub, a missing SSH key is a more specific cause for private repos.

Practice this question →

40

MCQeasy

An organization is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS DB instance. The update requires changing the DB instance class. However, the administrator wants to minimize downtime. What should the administrator do?

A.Use CloudFormation's 'DeletionPolicy' attribute to retain the database during updates.

B.Enable Multi-AZ on the DB instance (if not already enabled) before performing the stack update.

C.Update the stack directly with 'ApplyImmediately' set to true.

D.Create a read replica, promote it, and then delete the original DB instance.

AnswerB

Enabling Multi-AZ gives the DB instance a standby replica in a different Availability Zone, which RDS can fail over to during maintenance. When a stack update changes the DB instance class, RDS applies the modification to the standby first, performs a failover, and then updates the former primary—this keeps the database available during the transition. Because the failover only causes a brief connection interruption rather than a full shutdown, Multi-AZ is the correct way to minimize downtime during an instance class update.

Why this answer

Enabling Multi-AZ allows the RDS instance to have a standby in a different Availability Zone. When updating the DB instance class, CloudFormation can modify the standby first, then fail over to it, minimizing downtime. Options A, C, and D are incorrect: A (DeletionPolicy) controls resource retention on stack deletion, not updates; C (ApplyImmediately) may cause a brief outage; D (read replica promotion) is for scaling reads, not for minimizing downtime during instance class changes.

Practice this question →

41

MCQhard

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

A.Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional

B.Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it

C.Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement

D.Add a DeletionPolicy: Retain attribute to the RDS resource in the template

AnswerA

The stack policy evaluates each update action per resource. A Deny on Replace for the RDS logical resource ID prevents CloudFormation from completing any update that would recreate the database — the update fails with a clear policy error. A temporary override policy passed via --stack-policy-during-update can explicitly allow the replacement for a deliberate migration.

Why this answer

A CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Exam trap

The trap here is that candidates confuse RDS deletion protection or DeletionPolicy: Retain with stack policies, mistakenly believing those features can block CloudFormation from replacing a resource during an update, when in fact they only protect against deletion in specific scenarios (e.g., stack deletion or direct API calls).

How to eliminate wrong answers

Option B is wrong because RDS deletion protection prevents the database from being deleted via the RDS API or console, but CloudFormation can still replace the instance (which involves creating a new one and deleting the old one) if the template triggers a replacement; deletion protection does not block CloudFormation from performing a replacement. Option C is wrong because change sets only provide a preview of changes and require manual approval, but they do not prevent a user from accidentally executing a change set that includes a replacement; the team wants a guardrail that blocks replacement without an explicit override, not just a manual review step. Option D is wrong because DeletionPolicy: Retain only preserves the resource when the stack is deleted, but it does not prevent CloudFormation from replacing the resource during a stack update; a replacement still deletes the original resource and creates a new one, and the Retain policy does not block that deletion.

Practice this question →

42

MCQeasy

An organization uses AWS Service Catalog to manage approved IT services. A SysOps administrator needs to update a CloudFormation template used by a product. The administrator wants to ensure that existing provisioned products are updated with the new template version. What step must the administrator take after updating the product?

A.Update the portfolio that contains the product.

B.Create a new product version and update the provisioned products to use the new version.

C.Update the product's CloudFormation template directly in the Service Catalog console.

D.Terminate the existing provisioned products and reprovision them.

AnswerB

To update an existing provisioned product, you must create a new product version in AWS Service Catalog, typically by uploading a new CloudFormation template. Once the version is available, you then use the console or AWS CLI to update each provisioned product to the new version, which triggers CloudFormation change sets to apply only the necessary modifications. This preserves the resource lifecycle and minimizes disruption while ensuring your approved infrastructure is updated consistently.

Why this answer

To update existing provisioned products, you must create a new product version and update the provisioned product to that version. Simply updating the template directly or modifying the portfolio does not automatically propagate changes to provisioned products.

Practice this question →

43

MCQeasy

A company uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The SysOps administrator wants to deploy a new version of the application by first shifting 10% of traffic to the new version, monitoring for errors, and then after manual approval, shifting the remaining 90%. Which deployment configuration should be used?

A.In-place deployment

B.Blue/green deployment with Canary10Percent configuration

C.Blue/green deployment with Linear10PercentEvery10Minutes configuration

D.Blue/green deployment with AllAtOnce configuration

AnswerB

Blue/green with Canary10Percent shifts 10% of traffic to the new version, waits, then automatically shifts the remaining 90%. It matches the pattern but does not natively support manual approval.

Why this answer

A Blue/green deployment with Canary10Percent configuration shifts 10% of traffic to the new version, waits for a specified period (default 10 minutes), and then automatically shifts the remaining 90%. Note that manual approval is not natively supported by this configuration; it would need to be implemented separately (e.g., via a lifecycle hook). The question's requirement for manual approval is not directly met by the deployment configuration itself, but among the options, Canary10Percent is the only one that shifts traffic in the described pattern of 10% first then 90%.

Exam trap

The trap is confusing Canary10Percent (which automatically shifts the remaining traffic after a wait) with Linear10PercentEvery10Minutes (which automatically shifts 10% every 10 minutes). Both are automated; neither natively includes manual approval. Candidates may incorrectly believe that one supports manual approval natively.

How to eliminate wrong answers

Option A is wrong because in-place deployment updates existing instances without traffic shifting, so it cannot shift 10% of traffic to a new version. Option C is wrong because Linear10PercentEvery10Minutes automatically shifts 10% every 10 minutes without requiring manual approval, which does not meet the manual approval requirement. Option D is wrong because AllAtOnce shifts 100% of traffic immediately, which does not allow for a 10% initial shift and monitoring.

Practice this question →

44

MCQmedium

An administrator is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS Elastic Beanstalk. The build succeeds, but the deployment fails with 'Access Denied' when Elastic Beanstalk tries to read the artifact from S3. What should the administrator check?

A.The IAM role assumed by the Elastic Beanstalk environment

B.The IAM role used by CodeBuild

C.Whether the artifact bucket is in the same region as the pipeline

D.The S3 bucket policy for the artifact bucket

AnswerA

The Elastic Beanstalk environment uses an IAM service role to interact with other AWS services. To read the artifact from S3, that role must have s3:GetObject permission on the artifact bucket. Denial often indicates the role lacks these permissions.

Why this answer

The Elastic Beanstalk environment's IAM service role must have permissions to read the artifact from the S3 bucket. If this role lacks the necessary s3:GetObject permission, the deployment fails with 'Access Denied'. Option B is incorrect because the CodeBuild role handles build tasks, not deployment actions.

Option C is incorrect because CodePipeline can manage cross-region artifacts; the region mismatch is unlikely to cause an access-denied error. Option D is incorrect because the artifact bucket is managed by CodePipeline and its bucket policy is typically configured correctly; the issue is more likely with the Elastic Beanstalk service role's permissions.

Practice this question →

45

MCQmedium

A company uses AWS Systems Manager Patch Manager to automate patching of Amazon EC2 instances. The SysOps administrator needs to configure a maintenance window that will patch instances on the second Tuesday of every month at 2:00 AM. The administrator wants to ensure that patches are automatically applied but reboots are only performed if required. Which combination of configurations should the administrator use?

A.Create a maintenance window with a cron schedule of cron(0 2 ? * TUE#2 *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.

B.Create a maintenance window with a rate schedule of 30 days and use an AWS-ApplyPatchBaseline document with operation 'Scan' and reboot option 'RebootIfNeeded'.

C.Create a maintenance window with a cron schedule of cron(0 2 14 * ? *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.

D.Create a maintenance window with a cron schedule of cron(0 2 2 * 2 *) and use an AWS-InstallPatchBaseline document with operation 'Install' and reboot option 'NoReboot'.

AnswerA

This schedule correctly specifies the second Tuesday of each month at 2 AM. The document and operation apply patches, and RebootIfNeeded only reboots if necessary.

Why this answer

It uses the cron expression `cron(0 2 ? * TUE#2 *)` to schedule the maintenance window for the second Tuesday of every month at 2:00 AM, and the `AWS-RunPatchBaseline` document with operation `Install` and reboot option `RebootIfNeeded` ensures patches are applied automatically and reboots only occur when required by the patch installation.

Exam trap

The trap here is that candidates often confuse the cron syntax for 'second Tuesday' with simpler day-of-month or day-of-week expressions, or mistakenly use invalid SSM document names like `AWS-ApplyPatchBaseline` or `AWS-InstallPatchBaseline`, which do not exist in AWS Systems Manager.

How to eliminate wrong answers

Option B is wrong because it uses a rate schedule of 30 days, which does not guarantee execution on the second Tuesday of every month and can drift over time; also, `AWS-ApplyPatchBaseline` is not a valid SSM document name (the correct document is `AWS-RunPatchBaseline`), and operation `Scan` only reports missing patches without applying them. Option C is wrong because the cron expression `cron(0 2 14 * ? *)` runs on the 14th day of every month regardless of the day of the week, which does not target the second Tuesday specifically. Option D is wrong because the cron expression `cron(0 2 2 * 2 *)` runs on the 2nd day of the month only when it is also a Tuesday, which is not the second Tuesday; additionally, `AWS-InstallPatchBaseline` is not a valid SSM document name, and reboot option `NoReboot` prevents reboots even when required, contradicting the requirement.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Deployment, Provisioning, and Automation questions.

Start 20-question session