CCNA Clp Deployment Questions

StackSets deploy a single CloudFormation template across multiple AWS accounts and regions from one administration account, satisfying the requirement to manage common resources in several accounts centrally. Stack policies, change sets, and nested stacks operate within one account, so they cannot span accounts.

CloudFormation parameters allow you to input custom values when creating or updating a stack, such as instance types, key pairs, and subnet IDs. This enables template reuse across environments without modifying the template itself. Parameters can have default values, allowed values, and descriptions, making them ideal for environment-specific configurations. This directly addresses the requirement for different configurations per environment.

RequestCountPerTarget is a metric emitted by the Application Load Balancer that measures the average number of requests received per target (e.g., EC2 instance) over a specified period. Scaling based on this metric directly ties capacity to actual demand, allowing the Auto Scaling group to add instances when request load increases, ensuring responsive scaling during traffic spikes.

The Deploy stage performs the actual release of built artefacts to the staging environment, so it is where staging deployment belongs. Build compiles, test validates, and manual approval gates production, matching the pipeline's required sequence.

A PersistentVolumeClaim (PVC) with ReadWriteOnce allows a single node to mount the volume for read-write access, which is suitable for a single pod. It provides persistent storage that survives pod restarts. This is the standard way to request durable storage in Kubernetes and meets the requirement.

The variable block declares an input variable, letting the AMI ID be supplied at plan or apply time rather than hard-coded, which makes the configuration reusable across environments. Output exposes values, locals compute intermediates, and provider configures the AWS plugin.

Bicep's declarative DSL compiles directly to ARM JSON, so it provides identical resource coverage while replacing verbose JSON brackets, quotes and nested expressions with concise, readable syntax. This directly satisfies the stem's requirement for a key benefit over ARM templates: reduced authoring complexity without losing any deployment capability.

AWS Snowball provides a physical appliance for offline bulk data transfer, bypassing the 50 Mbps bandwidth constraint that would make 50 TB take months to upload. Data is shipped to AWS and imported into S3.

The only keyword restricts a job to specified conditions, such as only: tags, so the deploy job runs solely when a tag is pushed. This satisfies the stem's requirement to control execution based on tags rather than branches or merge requests.

Amazon EFS provides a shared, elastic file system that can be mounted by multiple Fargate tasks simultaneously. It supports persistent storage that survives task restarts and can be used for database containers that require a file system. EFS is the recommended solution for persistent storage with Fargate because it integrates natively and supports the required durability and scalability.

AWS recommends using IAM roles for EC2 instances to grant permissions without embedding long-term credentials. An instance profile is a container for an IAM role that can be attached to an EC2 instance at launch or later. The instance then retrieves temporary credentials from the instance metadata service, which are automatically rotated. This method is secure and aligns with best practices.

Helm charts separate templated manifests from environment-specific values, so one chart deploys across accounts while each account supplies its own values file. This satisfies the requirement for a single set of manifests with per-account configuration, since overrides are injected at render time rather than duplicated per account.

StackSets extend a single CloudFormation template across multiple AWS accounts and regions from one administrator account, provisioning identical VPCs and security groups consistently. This directly meets the stem's requirement to deploy a common resource set to all accounts without duplicating stacks manually.

AWS::RDS::DBInstance is the correct resource for deploying a managed relational database. Setting StorageEncrypted to true ensures encryption at rest, and RDS automatically handles backups and patching, minimizing management overhead. This matches the requirements exactly and is the standard way to provision RDS via CloudFormation.

Canary deployment involves releasing the new version to a small subset of users or traffic, then gradually increasing the traffic while monitoring metrics. If issues are detected, the deployment can be automatically rolled back. This strategy minimizes risk by limiting exposure and allows for data-driven decisions based on real-time performance. It aligns perfectly with the requirements for gradual traffic shifting and automated rollback.

Lambda layers package shared libraries and dependencies separately from function code, so database connection logic is referenced by multiple functions rather than duplicated in each deployment package. This directly satisfies the requirement to reuse common code across functions while keeping individual deployment artefacts small.

A PersistentVolumeClaim requests storage from a StorageClass, which triggers dynamic provisioning of a PersistentVolume. This satisfies the stem's requirement for dynamically provisioned persistent storage on Amazon EKS, unlike a PersistentVolume, which represents already-provisioned capacity, or a StorageClass, which only defines the provisioning template.

Bicep is a declarative domain-specific language that compiles to Azure Resource Manager templates, offering concise syntax with native Azure integration. It satisfies the stem's requirement for infrastructure as code in a declarative, concise form, unlike imperative scripting or JSON-based ARM templates.

Canary deployment routes a small percentage of traffic to the new version while the majority still hits the stable release, enabling error monitoring and automatic rollback. This directly satisfies the requirement to limit initial user exposure and revert on detected issues.

Change data capture reads ongoing inserts, updates and deletes from the source's transaction log and applies them to Aurora, keeping the target synchronised until cutover. This satisfies the minimal-downtime constraint by replicating changes continuously rather than requiring a stop-and-copy migration.

Kubernetes Secrets are designed to hold sensitive information such as passwords, tokens, and keys. They are stored in etcd and can be encrypted at rest if configured. Secrets can be mounted as files or exposed as environment variables, and they are only distributed to nodes running pods that require them. Using a Secret avoids hardcoding credentials in the image or manifest and follows security best practices.

Drift detection compares each stack resource's actual configuration against its expected template-defined state, reporting any divergence. This directly satisfies the requirement to identify manual changes made outside CloudFormation, since it flags resources whose live properties no longer match the stack's declared configuration.

A workflow is the YAML-defined automation unit in GitHub Actions, containing the triggers and jobs that run. Defining it with an on: push trigger scoped to the main branch executes the test jobs automatically on every push, meeting the stated requirement.

A readiness probe checks the health endpoint and only adds the pod to the Service endpoints once it returns HTTP 200. This directly satisfies the requirement that new pods receive traffic only after the health check passes, unlike a liveness probe, which restarts containers.

Amazon ElastiCache for Redis provides a centralized, in-memory data store that can be used to store session data. By configuring the application to use Redis as the session store, sessions become available to all instances in the Auto Scaling group. This requires no application code changes if the application already supports external session stores, or minimal configuration changes. It ensures sessions persist even if instances are added or removed.

An Auto Scaling group with a scaling policy that references the Amazon CloudWatch CPUUtilization metric automatically adjusts the desired capacity of the web tier instances when average CPU crosses defined thresholds. This is the standard, declarative way to implement dynamic scaling in CloudFormation, ensuring the application can handle traffic spikes without manual intervention.

Elastic Beanstalk supports integrating an RDS database directly through the console, which automates the creation of the database and configures the necessary security groups and environment properties. This minimizes management overhead because Beanstalk handles provisioning, scaling, and monitoring of both the application and the database lifecycle. The web server tier handles HTTP requests and can scale automatically based on load.

Amazon EFS is a fully managed, POSIX-compliant file system that can be mounted on multiple EC2 instances simultaneously. It is durable across multiple Availability Zones and supports high throughput with Bursting or Provisioned Throughput modes. EFS is designed for shared access and automatically scales. This matches the requirements for a shared file system with multi-AZ durability and high throughput.

RollingUpdate replaces pods incrementally, honouring maxSurge and maxUnavailable so new pods reach readiness before old ones terminate. A bare ReplicaSet cannot orchestrate this ordering during updates, so the Deployment controller is required to satisfy the zero-downtime constraint.

S3 emits event notifications when objects are created, so configuring an S3 event trigger invokes the serverless function on upload. This directly satisfies the requirement that the function runs when a new object lands in the bucket, without polling.

The on.push trigger with a main branch filter causes the workflow to run only when commits are pushed to main, satisfying the conditional deployment requirement. This event-driven trigger is the GitHub Actions component that initiates the pipeline at the correct moment.

Blue/green deployment keeps the existing environment live while the new one is validated, then switches all traffic at once. The old environment remains available for rollback, delivering the zero-downtime cutover with fallback that the release pipeline requires.

Modules let the virtual network and subnet definitions be encapsulated into reusable files, so the parent deployment references them rather than duplicating code. This directly satisfies the modular deployment requirement, keeping each resource definition scoped and independently maintainable.

Cross-zone load balancing allows the ALB to distribute traffic evenly across all registered targets in all enabled Availability Zones. Without it, traffic is distributed only to targets in the same AZ as the load balancer node, which can lead to uneven load and reduced fault tolerance. Enabling cross-zone load balancing ensures that if one AZ fails, the remaining AZs handle the full load.

Ansible pushes modules over SSH on Linux and WinRM on Windows, so managed hosts need no installed agent or persistent daemon. This agentless push model is the architectural axis distinguishing it from agent-based configuration tools such as Puppet or Chef.

Canary deployment routes a small percentage of live traffic to the new version while the majority continues using the stable release, directly satisfying the requirement to validate performance and functionality with a subset of users before full rollout. Unlike blue-green, which switches all traffic at once, canary limits blast radius incrementally.

Configuring `backend "s3"` writes the Terraform state file directly to an Amazon S3 bucket, satisfying the remote-backend requirement for shared team access. Terraform's S3 backend also supports state locking via DynamoDB, preventing concurrent runs from corrupting state. Other backend types target different storage services, so they cannot store state in S3.

Azure Database Migration Service performs online migrations, continuously replicating ongoing transactions from the source SQL Server to Azure SQL Database until cutover. This satisfies the minimal-downtime constraint, since the source stays operational and readable throughout. Offline approaches such as backup-and-restore or BACPAC export would require pausing writes for the full 10 TB transfer.

AWS Schema Conversion Tool converts the SQL Server schema and objects to MySQL-compatible definitions, while AWS DMS performs the ongoing data replication. Together they satisfy the heterogeneous engine migration with minimal downtime that the scenario demands.

Jenkins orchestrates the pipeline stages: it triggers builds, runs Docker commands to build and push images to a registry, then applies Kubernetes manifests to deploy. Its extensive plugin ecosystem integrates each of these steps, satisfying the stem's requirement for automated build, push and deployment tooling.

Application Auto Scaling for ECS supports target tracking scaling policies that can automatically adjust the desired count of tasks based on a specified metric. The ECSServiceAverageCPUUtilization metric is a predefined metric that represents the average CPU utilization across all tasks in the service. This directly meets the requirement to scale based on CPU utilization.

Amazon S3 event notifications invoke Lambda directly when objects are created, satisfying the automatic trigger requirement. Configuring the bucket's `s3:ObjectCreated:*` event type with the function as destination removes polling entirely. This is the native push integration for object-creation events, unlike pull-based sources such as Kinesis or DynamoDB Streams.

Offline data transfer via a physical device ships data on encrypted disks to the cloud provider, bypassing limited network bandwidth. This satisfies the 50 TB volume and one-week deadline that online upload over the constrained link cannot meet.

Input variables let the configuration accept the AMI ID and instance type at runtime via CLI flags, variable files, or environment variables, rather than hardcoding values. This satisfies the requirement to pass values in without editing the configuration.

Helm is the Kubernetes package manager, bundling manifests into charts with templating, versioning and release tracking. It simplifies deploying and managing the containerised application across cluster environments, which is precisely the package-manager capability the developer requires.

maxUnavailable caps how many pods may be taken offline simultaneously during a rolling update, directly satisfying the no-downtime constraint. Setting it to 0 with maxSurge above 0 keeps full capacity while new pods start, so the deployment never drops below the desired replica count.

The DependsOn attribute in CloudFormation explicitly defines that a resource creation or update depends on another resource. By specifying DependsOn, you can ensure that the RDS instance is created before the Auto Scaling group, and the Auto Scaling group waits for the load balancer. This controls the order of resource provisioning and updates, meeting the requirement.

A Kubernetes Deployment manages the rollout of new versions by creating a ReplicaSet and gradually replacing pods. It supports rolling updates and automatic rollback if the new version fails health checks, ensuring zero downtime and safe deployment, which matches the administrator's requirements.

Automated unit tests run during the Build stage, immediately after compilation and before artefacts are published. Executing them here fails fast on broken code, satisfying the stem's CI/CD requirement by gating later Release and Deploy stages on passing tests.

S3 bucket event notifications push records directly to Lambda when objects are created, satisfying the stem's requirement to process uploads automatically. This native integration invokes the function per object without polling, unlike scheduled or manual triggers. Configuring the notification on the bucket, filtered by event type, delivers the object metadata Lambda needs.

SSH uses TCP port 22 by default. To allow remote management, an inbound rule permitting TCP port 22 from the specific corporate network CIDR is necessary. This restricts access to known IP addresses, enhancing security. Without this rule, the VM would be unreachable via SSH, preventing management. This is a fundamental step in securing remote access to cloud instances.

A Deployment manages ReplicaSets, which maintain the desired pod count and automatically replace failed containers, satisfying the self-healing requirement. Its Horizontal Pod Autoscaler integration adjusts replica counts as load varies, delivering the scalability the stem demands. Bare pods or DaemonSets cannot reschedule failed replicas or scale dynamically in this manner.

Change Data Capture reads the source's transaction logs and streams ongoing inserts, updates and deletes to the target, so RDS stays synchronised after the initial full load. This satisfies the requirement to minimise downtime during cutover.

Amazon EFS is a shared, elastic file system that can be mounted by multiple ECS tasks across different Availability Zones. It provides persistent storage that survives task restarts. Fargate tasks support EFS mounts, making it suitable for a shared cache that requires concurrent access and durability.

The push event with a branches filter limited to main triggers the workflow only when commits land on that branch, ignoring pushes to feature branches. This precisely matches the requirement to deploy solely on main-branch changes.

Amazon EFS is a fully managed, scalable, elastic file system that can be mounted by multiple EC2 instances and Fargate tasks simultaneously. It provides shared storage that persists independently of task lifecycle, meeting the requirements for high availability and scalability in a multi-task Fargate deployment.

Transfer Appliance is Google's physical, rackable device shipped to the customer, loaded with data, then returned for ingestion into GCP. It bypasses the limited-bandwidth constraint by moving 200 TB offline rather than over the network.

Amazon EFS is a fully managed, highly available, and scalable file storage service that can be mounted to multiple ECS tasks across different Availability Zones simultaneously. It supports the Network File System (NFS) protocol and is designed for shared access, making it ideal for this requirement.

Helm packages Kubernetes manifests into versioned charts, letting the team install, upgrade and roll back the whole application as one unit. It bundles Deployments, Services and ConfigMaps into a single release, satisfying the requirement for a package manager.

Ansible connects to target nodes over standard SSH or WinRM, pushing modules at runtime rather than relying on a persistent agent. This agentless architecture satisfies the constraint that no software be pre-installed on managed hosts.

Ansible modules are provider-specific plugins that translate playbook tasks into each cloud API's native calls, so AWS, Azure and GCP each expose dedicated modules covering compute, networking and storage. This satisfies the stem's multi-cloud requirement, since a single playbook can invoke the appropriate module per provider without custom API scripting.

IaC codifies infrastructure definitions, so provisioning happens through automated pipelines rather than manual console work. This directly satisfies the scenario's adoption goal: repeatable, version-controlled deployment of cloud resources. Templates or configuration files drive the automation, removing human error and enabling consistent environments across deployments.

A rolling update replaces pods incrementally, keeping the service available throughout. Its maxUnavailable and maxSurge settings control the gradual replacement, and the rollout halts automatically when new pods fail readiness probes, satisfying the zero-downtime and health-check constraints.

S3 event notifications publish ObjectCreated events to Lambda, invoking the function whenever an object lands in the bucket. This satisfies the automatic invocation requirement for uploaded objects, avoiding polling and needing no manual trigger configuration.

A Deployment with RollingUpdate strategy gradually replaces old pods with new ones while maintaining availability. By setting maxSurge and maxUnavailable, the engineer controls the pace of the rollout. This allows monitoring and, if needed, pausing or rolling back the deployment. It is the standard way to achieve zero-downtime updates in Kubernetes without additional tools.

Bicep's declarative syntax removes much of ARM JSON's boilerplate, such as repeated parameters and nested resource declarations, and supports modules for reusable, composable deployments. This directly satisfies the stem's requirement for a benefit over ARM JSON templates.

AWS Fargate is a serverless compute engine for containers that eliminates the need to manage EC2 instances. It automatically scales based on CPU utilization when used with ECS service auto scaling. The team only defines task definitions and services, and Fargate handles the infrastructure. This directly reduces operational overhead and meets the requirement for automatic scaling without manual host management.

AWS CloudFormation allows you to define infrastructure as code using JSON or YAML templates. It supports version control, parameterization, and reuse across environments. It can create and manage a wide range of AWS resources, including VPCs, subnets, and security groups, making it ideal for this scenario.

DMS performs the initial full load while Change Data Capture continuously replicates ongoing inserts, updates and deletes from the source MySQL binlog, keeping the target in sync until cutover. This satisfies the minimal-downtime and ongoing-replication constraints for the 50 TB migration.

DataSync can accelerate transfers over the network and is designed for large datasets.

An Auto Scaling group can be configured with multiple subnets across different Availability Zones. When the group scales, it launches instances evenly across the specified subnets, providing fault tolerance. This directly meets the requirement for multi-AZ deployment without additional complexity.

StackSets deploy a single CloudFormation template across multiple accounts and Regions from one administration account, satisfying the requirement to roll out shared logging configuration organisation-wide. Unlike ordinary stacks, which are scoped to one account and Region, StackSets use service-managed or self-managed permissions to target every account in the AWS Organization automatically.

SCT converts the SQL Server schema and stored procedures into Aurora MySQL-compatible DDL, which is essential because the two engines use different syntax. Without this conversion the migrated schema would fail on Aurora, so it satisfies the heterogeneous-engine requirement underpinning the minimal-downtime cutover.

AWS DMS with change data capture continuously replicates ongoing changes from the live Oracle source to RDS, so the source stays running and cutover downtime is limited to final catch-up. Native tools like Data Pump require quiescing the database, which the minimal-downtime constraint rules out.

SSE-KMS with customer managed keys allows the company to create and manage their own KMS keys, control key policies, enable automatic key rotation, and audit key usage via AWS CloudTrail. This meets all requirements: customer-managed keys, auditing, rotation, and minimal operational overhead since KMS handles the encryption/decryption.