Deployment practice questions

A company is deploying a new web application in a hybrid cloud environment. The application must be able to scale out automatically during peak usage and scale in during low usage. The deployment must also ensure that the application remains available if a single Availability Zone fails. Which deployment strategy should the architect recommend?

Trap 1: Deploy a cluster of instances in a single Availability Zone with a…

Single AZ is a single point of failure.

Trap 2: Use a single large instance and manually resize during peak periods.

Manual scaling is not automatic and can cause downtime.

Trap 3: Deploy a load balancer in front of a single instance.

This provides no scaling or fault tolerance.

A
Deploy a cluster of instances in a single Availability Zone with a load balancer.
Why wrong: Single AZ is a single point of failure.
B
Create an auto-scaling group spanning multiple Availability Zones.
Auto-scaling provides automatic scaling and multi-AZ ensures high availability.
C
Use a single large instance and manually resize during peak periods.
Why wrong: Manual scaling is not automatic and can cause downtime.
D
Deploy a load balancer in front of a single instance.
Why wrong: This provides no scaling or fault tolerance.

Review the full subnetting walkthrough →

Question 2hardmultiple choice

A cloud administrator is deploying a critical application that requires the lowest possible latency between compute instances. The instances will be running in a private subnet and must communicate with each other using their private IP addresses. Which of the following deployment configurations would best meet these requirements?

Trap 1: Deploy instances in different Availability Zones within the same…

Different AZs introduce higher latency.

Trap 2: Deploy instances in the same subnet behind a NAT gateway.

NAT gateway adds latency and is unnecessary for private subnet communication.

Trap 3: Deploy instances in different regions and use inter-region peering.

Inter-region latency is high.

A
Deploy instances in different Availability Zones within the same region.
Why wrong: Different AZs introduce higher latency.
B
Deploy instances in the same subnet behind a NAT gateway.
Why wrong: NAT gateway adds latency and is unnecessary for private subnet communication.
C
Deploy instances in different regions and use inter-region peering.
Why wrong: Inter-region latency is high.
D
Deploy instances in a placement group within the same Availability Zone.
Placement groups ensure low latency and high throughput.

Study the full virtualization explanation →

Question 3easymultiple choice

An organization is migrating its on-premises virtualization environment to a public cloud. The current environment uses VMware vSphere with VM templates. The cloud provider supports importing VMs in OVF format. Which step should the cloud administrator take to prepare the VMs for migration?

Trap 1: Take a snapshot of each VM and copy the snapshot files.

Snapshots are not a portable format.

Trap 2: Convert each VM to an ISO image.

ISO is for optical discs, not VM images.

Trap 3: Copy the VM's VMDK files and import them as VHDX.

VHDX is not directly compatible with OVF import.

A
Take a snapshot of each VM and copy the snapshot files.
Why wrong: Snapshots are not a portable format.
B
Export each VM as an OVF template.
OVF is a standard format for VM import/export.
C
Convert each VM to an ISO image.
Why wrong: ISO is for optical discs, not VM images.
D
Copy the VM's VMDK files and import them as VHDX.
Why wrong: VHDX is not directly compatible with OVF import.

Question 4mediummultiple choice

A cloud engineer is deploying a containerized application using Kubernetes. The application consists of a frontend, a backend API, and a database. The engineer needs to ensure that the backend API can be reached by the frontend but not from outside the cluster. Which Kubernetes resource should the engineer use to expose the backend API?

Trap 1: NodePort service

NodePort exposes the service on each node's IP, accessible externally.

Trap 2: Ingress resource

Ingress typically exposes HTTP/HTTPS routes externally.

Trap 3: LoadBalancer service

LoadBalancer creates an external load balancer.

A
NodePort service
Why wrong: NodePort exposes the service on each node's IP, accessible externally.
B
ClusterIP service
ClusterIP provides internal-only access.
C
Ingress resource
Why wrong: Ingress typically exposes HTTP/HTTPS routes externally.
D
LoadBalancer service
Why wrong: LoadBalancer creates an external load balancer.

Question 5hardmultiple choice

A company is deploying a multi-tier application in a cloud environment. The application must comply with PCI DSS, which requires encryption of data at rest and in transit. The database tier must be isolated from direct internet access, while the web tier must be accessible from the internet. Which of the following deployment architectures best meets these requirements?

Trap 1: Place all tiers in the same subnet and use security groups to…

Same subnet cannot fully isolate database from internet.

Trap 2: Use a single instance for web and database, and place it behind a…

Single instance is not scalable or secure.

Trap 3: Use a VPN connection from the web tier to the database tier and…

Encryption is still required for data at rest and in transit.

A
Place all tiers in the same subnet and use security groups to restrict traffic.
Why wrong: Same subnet cannot fully isolate database from internet.
B
Use a single instance for web and database, and place it behind a load balancer.
Why wrong: Single instance is not scalable or secure.
C
Use a VPN connection from the web tier to the database tier and disable encryption.
Why wrong: Encryption is still required for data at rest and in transit.
D
Deploy web tier in a public subnet, database tier in a private subnet, and use SSL/TLS for encryption.
Public subnet for web, private for database, and encryption satisfies PCI DSS.

Question 6mediummulti select

Which TWO of the following are valid considerations when deploying a virtual machine in a cloud environment? (Choose two.)

Trap 1: The log retention policy

Log retention is an operational consideration, not deployment.

Trap 2: The password complexity requirements

Password policy is a security configuration, not a deployment consideration.

Trap 3: The number of virtual CPUs assigned to the hypervisor

Hypervisor CPU assignment is not a VM deployment consideration.

A
The log retention policy
Why wrong: Log retention is an operational consideration, not deployment.
B
The password complexity requirements
Why wrong: Password policy is a security configuration, not a deployment consideration.
C
The instance size and family
Instance size determines vCPU, memory, and cost.
D
The number of virtual CPUs assigned to the hypervisor
Why wrong: Hypervisor CPU assignment is not a VM deployment consideration.
E
The type of storage (SSD or HDD)
Storage type impacts performance and cost.

Question 7hardmulti select

Which THREE of the following are best practices when deploying a cloud application using Infrastructure as Code (IaC)? (Choose three.)

Trap 1: Embed credentials directly in the IaC templates.

Credentials should be stored in a secure secrets manager.

Trap 2: Manually modify resources after deployment to tune performance.

Manual modifications cause configuration drift.

A
Store IaC templates in a version control system.
Version control enables collaboration and rollback.
B
Break down complex deployments into reusable modules.
Modularization improves maintainability and reuse.
C
Embed credentials directly in the IaC templates.
Why wrong: Credentials should be stored in a secure secrets manager.
D
Manually modify resources after deployment to tune performance.
Why wrong: Manual modifications cause configuration drift.
E
Use immutable infrastructure patterns where possible.
Immutable infrastructure prevents drift and simplifies rollback.

Question 8mediummultiple choice

A company is deploying a web application across multiple cloud regions for high availability. The application must maintain session state. Which deployment strategy should be used?

Trap 1: Active-passive failover

Active-passive failover provides redundancy but does not guarantee session continuity.

Trap 2: Geo-routing with DNS

Geo-routing directs based on location, not session persistence.

Trap 3: Round-robin load balancing

Round-robin distributes requests evenly but does not maintain session affinity.

A
Active-passive failover
Why wrong: Active-passive failover provides redundancy but does not guarantee session continuity.
B
Geo-routing with DNS
Why wrong: Geo-routing directs based on location, not session persistence.
C
Sticky sessions with a load balancer
Sticky sessions route a client to the same server, preserving session state.
D
Round-robin load balancing
Why wrong: Round-robin distributes requests evenly but does not maintain session affinity.

Question 9hardmultiple choice

A cloud architect must design a deployment for a containerized microservices application. The requirements include automated scaling based on CPU utilization, rolling updates with zero downtime, and service discovery. Which orchestration feature should be used?

Trap 1: Docker Compose with a reverse proxy

Docker Compose is for single-host orchestration, lacks autoscaling.

Trap 2: Ansible playbooks with Docker modules

Ansible is for configuration management, not real-time orchestration.

Trap 3: AWS ECS with Fargate

ECS with Fargate supports autoscaling but service discovery requires extra setup.

A
Docker Compose with a reverse proxy
Why wrong: Docker Compose is for single-host orchestration, lacks autoscaling.
B
Kubernetes with Horizontal Pod Autoscaler
Kubernetes natively supports autoscaling, rolling updates, and service discovery.
C
Ansible playbooks with Docker modules
Why wrong: Ansible is for configuration management, not real-time orchestration.
D
AWS ECS with Fargate
Why wrong: ECS with Fargate supports autoscaling but service discovery requires extra setup.

Question 10easymultiple choice

A deployment of a new application version fails with a '503 Service Unavailable' error after a rolling update. The previous version was working. What is the most likely cause?

Trap 1: Database connection pool exhausted

Would affect both versions equally.

Trap 2: DNS propagation delay

DNS changes do not usually cause 503 errors.

Trap 3: SSL certificate expired

SSL errors are different (e.g., certificate warning).

A
Database connection pool exhausted
Why wrong: Would affect both versions equally.
B
DNS propagation delay
Why wrong: DNS changes do not usually cause 503 errors.
C
SSL certificate expired
Why wrong: SSL errors are different (e.g., certificate warning).
D
New version missing a required dependency
Missing dependency can cause health check failure, resulting in 503.

Question 11mediummultiple choice

A cloud engineer needs to deploy a virtual machine with a specific configuration that includes a custom script to install software after boot. The deployment must be repeatable and version-controlled. Which approach should be used?

Trap 1: Run a shell script after the VM is deployed

Running a script manually is not automated or version-controlled.

Trap 2: Create a golden image with the software pre-installed

Golden images are harder to version-control and update.

Trap 3: Manually install software after creating the VM

Manual process is not repeatable or version-controlled.

A
Run a shell script after the VM is deployed
Why wrong: Running a script manually is not automated or version-controlled.
B
Create a golden image with the software pre-installed
Why wrong: Golden images are harder to version-control and update.
C
Manually install software after creating the VM
Why wrong: Manual process is not repeatable or version-controlled.
D
Use an Infrastructure as Code template with a user data script
IaC provides repeatable, version-controlled deployments.

Question 12mediummulti select

A cloud administrator is deploying a web application that must be highly available across two availability zones. The deployment includes an application load balancer and multiple EC2 instances. Which TWO configurations are required to meet the high availability requirement?

Trap 1: Use a single EC2 instance with an auto-recovery policy

Single instance is a single point of failure.

Trap 2: Set up health checks to automatically replace unhealthy instances

Health checks are operational, not a deployment requirement for HA.

Trap 3: Enable cross-zone load balancing on the ALB

Cross-zone distributes traffic within a region, not a high availability requirement.

A
Launch EC2 instances in at least two availability zones
Distributes instances across zones to withstand zone failure.
B
Use a single EC2 instance with an auto-recovery policy
Why wrong: Single instance is a single point of failure.
C
Set up health checks to automatically replace unhealthy instances
Why wrong: Health checks are operational, not a deployment requirement for HA.
D
Configure the load balancer to route traffic to both availability zones
Ensures traffic reaches instances in both zones.
E
Enable cross-zone load balancing on the ALB
Why wrong: Cross-zone distributes traffic within a region, not a high availability requirement.

Question 13hardmultiple choice

A DevOps engineer runs a rollout status command for a Kubernetes deployment and receives the error shown. The deployment specification includes a rolling update strategy with maxSurge=25% and maxUnavailable=25%. What is the most likely cause of the failure?

Exhibit

Refer to the exhibit.

```bash
$ kubectl rollout status deployment/myapp
Waiting for deployment "myapp" rollout to finish: 0 of 3 updated replicas are available...
Error: deployment "myapp" exceeded its progress deadline
```

Trap 1: The cluster does not have enough CPU resources to schedule new pods

Resource constraints would prevent scheduling, not cause progress deadline.

Trap 2: The maxSurge and maxUnavailable settings are too restrictive

Those settings allow the rollout; they don't cause the deadline error.

Trap 3: The old ReplicaSet is still running and preventing the new one from…

Old ReplicaSet is scaled down as new pods become ready.

A
The cluster does not have enough CPU resources to schedule new pods
Why wrong: Resource constraints would prevent scheduling, not cause progress deadline.
B
The new pod template contains an invalid container image tag
Invalid image causes pods to fail readiness, leading to rollout timeout.
C
The maxSurge and maxUnavailable settings are too restrictive
Why wrong: Those settings allow the rollout; they don't cause the deadline error.
D
The old ReplicaSet is still running and preventing the new one from scaling up
Why wrong: Old ReplicaSet is scaled down as new pods become ready.

Review the full subnetting walkthrough →

Question 14hardmultiple choice

A company has a hybrid cloud environment with on-premises servers and AWS. They deploy a new application using AWS Elastic Beanstalk with a load balancer and auto scaling group. The application is a Node.js API that connects to an RDS MySQL database. After deployment, users report that the API returns a '500 Internal Server Error' intermittently. The application logs show 'ETIMEDOUT' errors when connecting to the database. The database is deployed in a private subnet with a security group that allows inbound traffic from the Elastic Beanstalk environment's security group. The database connection string uses the RDS endpoint. The same application works perfectly when deployed on-premises. What is the most likely cause?

Trap 1: The database connection string uses the wrong port number

The default MySQL port is 3306, which is standard and unlikely to be wrong.

Trap 2: The security group attached to the RDS instance does not allow…

The security group is already configured to allow inbound from the Elastic Beanstalk security group.

Trap 3: The RDS instance is in a failed state and needs to be rebooted

The database is running; ETIMEDOUT indicates network issue, not database failure.

A
The database connection string uses the wrong port number
Why wrong: The default MySQL port is 3306, which is standard and unlikely to be wrong.
B
The Elastic Beanstalk environment is in a different VPC or subnet that cannot reach the RDS instance
Network connectivity between VPCs or subnets is likely misconfigured, causing timeouts.
C
The security group attached to the RDS instance does not allow traffic from the Elastic Beanstalk environment
Why wrong: The security group is already configured to allow inbound from the Elastic Beanstalk security group.
D
The RDS instance is in a failed state and needs to be rebooted
Why wrong: The database is running; ETIMEDOUT indicates network issue, not database failure.

Read the full NAT/PAT explanation →

Question 15mediummultiple choice

A financial services company is deploying a PCI-DSS compliant workload in a public cloud. The deployment must include a web application (port 443) and a database (port 3306). The security requirements mandate that the web application is internet-facing, but the database must be in a private subnet with no direct internet access. The cloud administrator creates two VPCs: one for the web tier and one for the database tier. The web tier is deployed in VPC-A with a public subnet and an internet gateway. The database tier is deployed in VPC-B with a private subnet and a NAT gateway for outbound updates. The administrator configures VPC peering between VPC-A and VPC-B, and updates route tables accordingly. The web application can connect to the database, but the database cannot initiate outbound connections to the internet for updates. What is the most likely issue?

Trap 1: The database security group does not allow outbound traffic to the…

Security groups are stateful; outbound is allowed by default.

Trap 2: The route table in VPC-B does not have a default route to the NAT…

The administrator says the route tables are updated, but the NAT gateway may not work over peering.

Trap 3: The VPC peering connection does not support DNS resolution between…

DNS resolution works across VPC peering if configured.

A
The database security group does not allow outbound traffic to the internet
Why wrong: Security groups are stateful; outbound is allowed by default.
B
The route table in VPC-B does not have a default route to the NAT gateway
Why wrong: The administrator says the route tables are updated, but the NAT gateway may not work over peering.
C
The VPC peering connection does not support DNS resolution between VPCs
Why wrong: DNS resolution works across VPC peering if configured.
D
The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection
NAT gateways do not support traffic through VPC peering; each VPC needs its own NAT gateway.

Question 16mediummultiple choice

A company is deploying a new web application in a hybrid cloud environment. The application must be highly available and able to handle traffic spikes. The cloud team decides to use an auto-scaling group across multiple availability zones with a load balancer. Which additional step should the team take to ensure session persistence during scaling events?

Trap 1: Implement a stateless application design

While good practice, it may not be feasible for existing applications.

Trap 2: Increase the instance size to handle more sessions

Scaling vertically does not ensure session persistence.

Trap 3: Configure the load balancer to use a round-robin algorithm

Round-robin distributes requests without session affinity.

A
Implement a stateless application design
Why wrong: While good practice, it may not be feasible for existing applications.
B
Increase the instance size to handle more sessions
Why wrong: Scaling vertically does not ensure session persistence.
C
Configure the load balancer to use a round-robin algorithm
Why wrong: Round-robin distributes requests without session affinity.
D
Enable sticky sessions on the load balancer
Sticky sessions maintain session affinity during scaling.

Question 17hardmulti select

A cloud architect is designing a deployment for a multi-tier application that must meet compliance requirements for data residency. The application consists of a web tier, application tier, and database tier. Which TWO deployment strategies should the architect consider to ensure data remains in a specific geographic region while maintaining high availability?

Trap 1: Set up a VPN to a neighboring region

Would route data outside the required region.

Trap 2: Deploy in a single availability zone

Single point of failure, not highly available.

Trap 3: Deploy across multiple regions

May violate data residency requirements.

A
Set up a VPN to a neighboring region
Why wrong: Would route data outside the required region.
B
Deploy across multiple availability zones in the same region
Keeps data in region and provides HA.
C
Deploy in a single availability zone
Why wrong: Single point of failure, not highly available.
D
Use regional load balancers
Keeps traffic within the region.
E
Deploy across multiple regions
Why wrong: May violate data residency requirements.

Read the full VPN explanation →

Question 18mediumdrag order

Arrange the steps to configure a VPN connection between an on-premises network and a cloud VPC.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 19mediumdrag order

Arrange the steps to implement a cloud security group that allows only specific IPs to access an application.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediummatching