Examkin

Deployment

376 questions

All types376Multiple choice191Multiple select171Ordering14
Question 201Question →

A developer needs to deploy a new version of an application to an AWS Elastic Beanstalk environment. The application is for internal testing and can tolerate a brief period of service unavailability. The developer wants the deployment to be completed as quickly as possible without launching any new instances to keep costs at zero. Which deployment strategy meets these requirements?

Show answer & explanation

Answer: All-at-once

Answer

All-at-once
The All-at-once deployment strategy is correct because it applies the update to all instances in the environment simultaneously. This results in service downtime during the deployment, but it requires no additional resource provisioning (keeping cost at zero) and completes the deployment in the shortest time possible.

Step-by-Step Solution

1
Analyze the requirements from the deployment scenario.
The key constraints are: 1. Service unavailability (downtime) is acceptable. 2. The deployment must complete as quickly as possible. 3. Zero additional costs or new instances should be launched.
Identifying constraints helps filter out strategies that launch temporary instances or focus on zero-downtime at the expense of speed or cost.
2
Evaluate each deployment strategy against the constraints.
All-at-once causes downtime but requires zero new instances and is the fastest. Immutable and Rolling with additional batch launch new instances. Rolling takes longer and reduces serving capacity without using new instances.
Comparing strategies allows us to match the one that satisfies all constraints simultaneously.

Key Concept

Selecting the appropriate AWS Elastic Beanstalk deployment strategy based on cost, speed, and downtime constraints.
Estimated Time:1m 0s
Question 202Question →

A developer is writing an AWS Serverless Application Model (SAM) template to deploy a Lambda function that handles API requests. The developer wants to apply a default timeout of 10 seconds to all functions and ensure that the template is parsed correctly by AWS CloudFormation as a SAM template.

yaml
AWSTemplateFormatVersion: '2010-09-09'
# [Configuration 1]

Globals:
# [Configuration 2]

Resources:
ProcessRequestFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: src/
Handler: index.handler
Runtime: nodejs18.x

Which two configuration steps must the developer take to complete the template?

Select all that apply

Show answer & explanation

Answer: Declare `Transform: AWS::Serverless-2016-10-31` at the root level of the template; Define `Function:` followed by `Timeout: 10` inside the `Globals` section

Answer

The developer must declare the correct SAM transform at the root level of the template and specify the function timeout under the Globals section.
To complete the AWS SAM template, the template must include the correct `Transform` header at the root level to instruct CloudFormation to process it using the SAM translator, and the `Globals` section must define the `Timeout` under `Function` to apply it to all functions in the template.

Step-by-Step Solution

1
Identify the required header to enable AWS SAM parsing in CloudFormation.
The root of the template must include the `Transform: AWS::Serverless-2016-10-31` declaration.
Without the correct Transform header, AWS CloudFormation will fail to recognize SAM-specific resources such as AWS::Serverless::Function.
2
Configure the global default properties for all Lambda functions defined in the template.
Under the `Globals` section, add a `Function` block containing `Timeout: 10`.
The `Globals` section allows properties common to multiple resources, like function timeouts, to be defined once and applied to all instances of that resource type.

Key Concept

AWS Serverless Application Model (SAM) templates require a specific Transform header to be processed by CloudFormation, and support a Globals section to define shared resource properties.
Question 203Question →

A developer is deploying a web application to Amazon EC2 instances using AWS CodeDeploy. The developer needs to execute a script named initialize.sh immediately after the application files are copied to the target instances, but before the application service starts. Which configuration action should the developer take to accomplish this?

Show answer & explanation

Answer: Define the script path under the AfterInstall event in the hooks section of the appspec.yml file.

Answer

Define the script path under the AfterInstall event in the hooks section of the appspec.yml file.
Defining the script path under the AfterInstall event in the hooks section of the appspec.yml file is the correct way to execute scripts on Amazon EC2 instances immediately after files are copied, but before the application starts.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment.
The target compute platform is Amazon EC2.
Different compute platforms (EC2 vs ECS/Lambda) have different AppSpec file structures and lifecycle hooks.
2
Select the correct section in the AppSpec file for Amazon EC2 deployments.
The 'hooks' section is used for EC2 deployments, whereas the 'resources' section is used for ECS/Lambda.
EC2 deployments use the 'hooks' section to execute scripts during deployment lifecycle events.
3
Choose the appropriate lifecycle hook that executes after file copying but before application startup.
The 'AfterInstall' hook runs right after the files are copied, which is before the application service starts.
This meets the requirement of running the initialization script immediately after file copy and before startup.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for EC2 deployments require using the 'hooks' section and the 'AfterInstall' event to run scripts after files are copied.
Question 204Question →

An organization requires a build environment in AWS CodeBuild to execute integration tests against an internal Amazon RDS DB instance situated in a private subnet. The build container must fetch external software packages from the public internet and retrieve a database password from AWS Secrets Manager. Currently, the build execution fails because it cannot access external repositories, and an authorization error occurs when fetching the credential from AWS Secrets Manager.

Which combination of steps should be taken to resolve these network and access issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet to allow internet connectivity.; Ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions and that its trust policy allows the service principal codebuild.amazonaws.com to assume the role.

Answer

To resolve the issues, configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet, and ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions with a trust policy allowing codebuild.amazonaws.com to assume the role.
The correct configuration requires routing outbound traffic from CodeBuild's private VPC subnets to a NAT gateway so that the build container can reach the public internet to download external dependencies. Additionally, the CodeBuild IAM service role must have secretsmanager:GetSecretValue permission and a trust policy that allows codebuild.amazonaws.com to assume the role, enabling CodeBuild to authenticate and retrieve the database password.

Step-by-Step Solution

1
Analyze the networking failure
Identify that CodeBuild containers configured to run within a VPC do not receive public IP addresses. Therefore, placing them in public subnets or subnets without NAT gateways will prevent them from accessing the public internet to download dependencies.
To fix internet access inside a VPC, the CodeBuild project must be configured with private subnets that route outbound traffic through a NAT gateway.
2
Analyze the authorization failure for the database password
Identify that CodeBuild relies on an IAM service role to perform API operations like retrieving Secrets Manager secrets. The role requires the permission to get the secret, and the role's trust policy must trust codebuild.amazonaws.com.
Configuring the IAM service role with the correct trust relationship and the secretsmanager:GetSecretValue permission enables the build process to retrieve the secret.

Key Concept

AWS CodeBuild VPC networking and service role configuration
Estimated Time:2m 30s
Question 205Question →

A development team is deploying a containerized worker application to Amazon ECS using the AWS Fargate launch type. The application is designed to process messages from an Amazon SQS queue. The container image is hosted in a private Amazon Elastic Container Registry (Amazon ECR) repository, and the ECS agent must send container logs to Amazon CloudWatch Logs. Which of the following IAM configurations are required for this deployment to succeed? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS Task Role (taskRoleArn) with a policy that allows SQS actions (sqs:ReceiveMessage, sqs:DeleteMessage), and establish a trust relationship allowing ecs-tasks.amazonaws.com to assume the role.; Configure the ECS Task Execution Role (executionRoleArn) with a policy that allows ECR actions (ecr:GetAuthorizationToken, ecr:BatchGetImage) and CloudWatch Logs actions (logs:CreateLogStream, logs:PutLogEvents), and trust ecs-tasks.amazonaws.com.

Answer

Configure the ECS Task Role with a policy allowing SQS actions and a trust policy for the ECS tasks service principal, and configure the ECS Task Execution Role with ECR and CloudWatch Logs permissions along with a trust policy for the ECS tasks service principal.
For an ECS container running on Fargate, the application code inherits permissions from the Task Role (taskRoleArn), while the ECS agent requires permissions from the Task Execution Role (executionRoleArn). Therefore, the Task Role must be configured to allow the application's SQS calls, and the Task Execution Role must be configured to allow the ECS agent's ECR pull and CloudWatch logging actions. Both roles require trust policies that allow the ecs-tasks.amazonaws.com service principal to assume them.

Step-by-Step Solution

1
Determine the resource access required by the application code executing inside the container.
The application code needs to communicate with Amazon SQS to receive and delete messages, requiring an ECS Task Role.
Permissions for resource access by application code must be granted via the taskRoleArn parameter.
2
Determine the resource access required by the ECS agent/infrastructure to instantiate and monitor the container.
The ECS agent needs to authenticate with Amazon ECR to pull the image and write to CloudWatch Logs, requiring an ECS Task Execution Role.
Permissions for infrastructure operations performed by the ECS container agent must be granted via the executionRoleArn parameter.
3
Configure trust policies for both IAM roles to allow the ECS service to assume them.
Both roles must have trust relationships defined for the ecs-tasks.amazonaws.com service principal.
AWS services require explicit trust relationships to assume roles on behalf of resources.

Key Concept

Distinguishing between the ECS Task Role and the ECS Task Execution Role.
Question 206Question →

A developer is managing a production web application deployed on AWS Elastic Beanstalk. The application experiences consistent high traffic, and the environment's capacity must remain at 100%100\% at all times during updates to prevent performance degradation. In the event of a deployment failure, the application must support an immediate rollback with minimal impact, without requiring a manual rollback deployment. Additionally, to avoid issues with client-side DNS caching, the deployment must not involve swapping DNS CNAMEs or changing Route 53 configurations.

Which Elastic Beanstalk deployment strategy should the developer select?

Show answer & explanation

Answer: Immutable

Answer

The immutable deployment strategy
The immutable deployment strategy meets all requirements. It maintains 100%100\% capacity by deploying the new version to a temporary Auto Scaling group alongside the existing one under the same load balancer. If the deployment fails, Elastic Beanstalk immediately deletes the temporary Auto Scaling group, resulting in an immediate rollback with zero downtime. Since it uses the same environment and load balancer, no CNAME swaps or DNS changes are required.

Step-by-Step Solution

1
Analyze capacity constraints.
The requirement to maintain 100%100\% capacity during updates rules out the standard Rolling strategy because it takes active instances out of service, reducing capacity.
To prevent performance degradation on a high-traffic site, capacity cannot drop below the baseline.
2
Evaluate rollback speed and procedure.
The requirement for immediate rollback without a manual rollback deployment rules out Rolling with additional batch.
Rolling with additional batch requires a new deployment of the previous version to revert changes, which is slow and manual.
3
Check DNS and routing constraints.
The requirement to avoid DNS CNAME swapping or Route 53 changes rules out Blue/Green deployment.
Blue/Green deployments rely on switching DNS CNAMEs, which can cause traffic to split due to client-side DNS caching.
4
Identify the matching strategy.
The Immutable strategy satisfies all constraints by deploying to a temporary Auto Scaling group behind the same load balancer, maintaining 100%100\% capacity, and allowing immediate automatic rollback by terminating the new group if health checks fail.
It runs the new version in parallel behind the same load balancer, avoiding DNS changes, and rolls back instantly by deleting the temporary group.

Key Concept

AWS Elastic Beanstalk Deployment Strategies
Estimated Time:2m 30s
Question 207Question →

A developer is deploying a containerized API application to Amazon ECS on AWS Fargate. The container needs to send its application logs to Amazon CloudWatch Logs using the awslogs log driver. Additionally, the application code itself needs to store uploaded user profile images in an Amazon S3 bucket. How should the developer configure the IAM roles in the task definition to satisfy these requirements?

Show answer & explanation

Answer: Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

Answer

Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.
The correct answer correctly separates the roles: the Task Role provides AWS credentials to the application code running inside the container, granting access to Amazon S3. The Task Execution Role provides credentials to the Amazon ECS container agent, allowing it to write container logs to Amazon CloudWatch Logs.

Step-by-Step Solution

1
Analyze the permission requirements for the containerized application.
The application code running inside the container requires access to Amazon S3, while the container agent requires access to Amazon CloudWatch Logs for logging.
This separates the security contexts of the application code versus the infrastructure/agent management.
2
Map the application code permissions to the appropriate ECS configuration parameter.
Assign the S3 access permissions to the Task Role.
The Task Role is designed to provide credentials to the containerized application code.
3
Map the ECS agent permissions to the appropriate ECS configuration parameter.
Assign the CloudWatch Logs write permissions to the Task Execution Role.
The Task Execution Role is designed to grant permissions to the Amazon ECS container agent to pull images and write logs.

Key Concept

ECS Task Role vs. ECS Task Execution Role
Estimated Time:1m 30s
Question 208Question →

A developer is setting up AWS CodeDeploy to deploy an application to Amazon EC2 instances. The deployment fails because CodeDeploy lacks the necessary permissions to interact with AWS services on behalf of the developer.

Which configuration must the developer implement to resolve this permission issue?

Show answer & explanation

Answer: Create an IAM service role for CodeDeploy and configure its trust policy to allow the codedeploy.amazonaws.com service to assume the role.

Answer

Create an IAM service role for CodeDeploy and configure its trust policy to allow the codedeploy.amazonaws.com service to assume the role.
The correct answer is to create an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role. This permits CodeDeploy to perform necessary operations, such as interacting with EC2 instances, on the developer's behalf.

Step-by-Step Solution

1
Identify the service that requires permissions.
AWS CodeDeploy needs permissions to interact with EC2 instances and other AWS services.
CodeDeploy acts as a service principal and must be authorized to perform actions on your behalf.
2
Create an IAM service role with the correct trust relationship.
A service role is created where the trust policy allows the service principal codedeploy.amazonaws.com to perform the sts:AssumeRole action.
This trust relationship enables the CodeDeploy service to assume the permissions defined in the role.
3
Attach the AWSManagedPolicy for CodeDeploy to the role.
The AWSCodeDeployRole policy is attached to the created IAM role.
This policy contains the permissions CodeDeploy needs to manage deployments.

Key Concept

AWS CodeDeploy Service Role configuration and trust policy requirements
Question 209Question →

A developer is deploying a secure microservice to Amazon ECS using the AWS Fargate launch type behind an Application Load Balancer (ALB). The container definition references a database connection string stored in AWS Systems Manager Parameter Store using the container definition `secrets` parameter. The containerized application listens on port 8080. Which combination of configurations must the developer implement to successfully route traffic to the application and allow the container to start?

Show answer & explanation

Answer: Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Attach an IAM policy with ssm:GetParameters permissions to the ECS task execution role.

Answer

To deploy a containerized service on AWS Fargate behind an ALB and retrieve secrets from Systems Manager Parameter Store at task startup, the developer must use the awsvpc network mode, configure the ALB target group with target type ip, and grant ssm:GetParameters permission to the ECS task execution role.
The correct option correctly identifies that the awsvpc network mode is required for AWS Fargate. When using awsvpc, the ALB target group must register targets by IP address, so the target type must be set to ip. Additionally, since the database connection string is retrieved at task startup by the ECS agent via the container definition's secrets parameter, the permissions for ssm:GetParameters must be assigned to the ECS task execution role.

Step-by-Step Solution

1
Identify the networking requirements for AWS Fargate tasks.
AWS Fargate tasks must use the awsvpc network mode.
Fargate does not support other network modes like bridge or host.
2
Determine the correct ALB target group registration type for the awsvpc network mode.
The target group type must be configured as ip.
Because tasks using the awsvpc network mode are allocated their own Elastic Network Interfaces (ENIs) with private IP addresses, they must be registered with the ALB by IP address rather than instance ID.
3
Identify the correct IAM role required for the ECS container agent to retrieve secrets during task initialization.
The ssm:GetParameters permission must be attached to the ECS task execution role.
The task execution role is used by the Amazon ECS container agent to pull images and retrieve secrets from Parameter Store or Secrets Manager before the containers start. The task role is used by the application code itself once running.

Key Concept

Differentiating between ECS Task Role and Task Execution Role, and configuring networking for Fargate behind an Application Load Balancer.
Estimated Time:2m 30s
Question 210Question →

A developer is deploying a serverless application using AWS SAM. The application features a Lambda function triggered by an API Gateway HTTP API. After using the AWS SAM CLI to package and deploy the application, the developer observes two issues:
1. The CloudFormation stack deployment fails with an error indicating that the Lambda service is unauthorized to assume the execution role associated with the function.
2. After manual role adjustment, a test request to the API Gateway endpoint fails with a 502 Bad Gateway error, even though the Lambda function executes successfully without code exceptions.

Which TWO actions should the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Modify the trust policy of the IAM execution role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.; Ensure the Lambda function returns a structured JSON payload containing the statusCode and body keys to match the API Gateway Lambda proxy integration requirements.

Answer

To resolve the issues, the developer must modify the trust policy of the IAM execution role to allow the lambda.amazonaws.com service principal to assume the role, and ensure the Lambda function returns a structured JSON payload containing the statusCode and body keys to match API Gateway Lambda proxy integration requirements.
The correct configurations directly address the two distinct issues. First, the IAM execution role's trust policy must explicitly permit the 'lambda.amazonaws.com' service principal to assume the role via 'sts:AssumeRole'. Second, when using Lambda proxy integration with API Gateway, the Lambda function must return a JSON response containing 'statusCode' and a stringified 'body' for API Gateway to parse the integration response successfully without returning a 502 Bad Gateway error.

Step-by-Step Solution

1
Analyze the CloudFormation error regarding role authorization.
Identify that the IAM execution role lacks a trust relationship (assume role policy) allowing the Lambda service to assume it.
Without a valid trust policy trusting lambda.amazonaws.com, the Lambda service cannot assume the role to run the code.
2
Analyze the API Gateway 502 Bad Gateway error.
Identify that the Lambda function, under Lambda proxy integration, must return a specific schema containing 'statusCode' and 'body'.
API Gateway requires this structured response to construct the HTTP response; returning arbitrary JSON structures causes a 502 error.
3
Formulate correct configuration adjustments.
Update the execution role's trust policy and modify the function code to return the required JSON response structure.
This fixes both the deployment-time trust issue and the execution-time integration format issue.

Key Concept

AWS SAM resources rely on correctly configured IAM service trust policies for function execution, and API Gateway Lambda proxy integrations demand a strict return payload contract from the backend Lambda function.
Estimated Time:2m 30s
Question 211Question →

An engineering team is developing a serverless application using the AWS Serverless Application Model (SAM). The team wants to define a default timeout of 15 seconds that automatically applies to all Lambda functions declared in the template, rather than specifying the timeout property individually for each function resource. Which of the following approaches should the team use to meet this requirement?

Show answer & explanation

Answer: Declare a Globals section at the root level of the template with a Function property containing Timeout: 15.

Answer

Declare a Globals section at the root level of the template with a Function property containing Timeout: 15.
Declaring the configuration under the Globals section at the root level of the template using the Function property allows the AWS SAM translator to apply that property (Timeout: 15) to all serverless functions in the template.

Step-by-Step Solution

1
Identify the AWS SAM feature used to define common configurations across resources.
The Globals section of an AWS SAM template allows developers to define common configuration settings for supported resources like Functions, APIs, and SimpleTables.
Using Globals reduces template redundancy and enforces consistent configurations.
2
Determine the correct structure for the Globals section to define Lambda timeouts.
The Globals section must be defined at the root level (same level as Transform and Resources) and contain a Function block with properties like Timeout.
This syntax tells the SAM translator to inject these properties into all AWS::Serverless::Function resources during deployment.

Key Concept

AWS SAM Globals Section
Question 212Question →

A developer is evaluating deployment strategies for an internal web application hosted on an AWS Elastic Beanstalk environment. The application can tolerate temporary downtime or reduced capacity during the update process. The primary constraint is to avoid any additional costs or the provisioning of temporary instances. Which two deployment strategies should the developer consider? (Select two.)

Select all that apply

Show answer & explanation

Answer: All-at-once; Rolling

Answer

All-at-once and Rolling
The All-at-once strategy updates all instances simultaneously, which causes downtime but incurs no additional instance costs. The Rolling strategy updates instances in batches, which reduces capacity during the deployment process but does not provision any new instances. Both strategies satisfy the requirement of not incurring additional charges or provisioning new instances while accepting downtime or reduced capacity.

Step-by-Step Solution

1
Analyze the application constraints: temporary downtime or reduced capacity is acceptable, and there must be zero additional costs or temporary instance provisioning.
Identified the need for in-place update strategies that do not increase the instance count.
This filters out any strategies that launch temporary instances to maintain capacity.
2
Evaluate the 'All-at-once' strategy against the constraints.
The strategy updates all instances at once, causing downtime, but requires no additional instances.
This is a valid option because downtime is acceptable and no additional costs are incurred.
3
Evaluate the 'Rolling' strategy against the constraints.
The strategy updates instances in batches, temporarily reducing capacity, but requires no additional instances.
This is a valid option because reduced capacity is acceptable and no additional costs are incurred.
4
Evaluate 'Immutable', 'Rolling with additional batch', and 'Traffic splitting' against the constraints.
These strategies launch new/temporary instances, which temporarily increases costs.
These are invalid because they violate the constraint against additional costs.

Key Concept

AWS Elastic Beanstalk deployment strategies trade-offs regarding cost, capacity, and downtime.
Question 213Question →

A developer is deploying a serverless application using AWS SAM. The developer needs to deploy a Lambda function that retrieves a database credential from AWS Secrets Manager. The developer writes the following template (`template.yaml`):

yaml
Resources:
DBSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: my-db-secret
SecretString: '{"password":"mypassword"}'

RetrieveSecretFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Policies:
- AWSSecretsManagerGetSecretValuePolicy:
SecretArn: !Ref DBSecret
Environment:
Variables:
SECRET_NAME: !Ref DBSecret

When attempting to deploy this template using the AWS CLI `aws cloudformation deploy` command, the deployment fails with the error: `Template format error: Unrecognized resource type: AWS::Serverless::Function`. Additionally, the Lambda function code is incorrectly configured to retrieve the database credential using the Systems Manager Parameter Store SDK API client.

Which two actions must the developer take to resolve the deployment failure and ensure the Lambda function can retrieve the database credential?

Select all that apply

Show answer & explanation

Answer: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.; Modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.

Answer

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template, and modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.
To successfully deploy an AWS SAM template, the `Transform: AWS::Serverless-2016-10-31` declaration must be present at the root level of the template so that AWS CloudFormation can use the serverless transform macro to compile the resources. Furthermore, the Lambda function must call the correct service API (AWS Secrets Manager client's `GetSecretValue`) since the resource is defined as `AWS::SecretsManager::Secret` and the two services do not replicate data between each other automatically.

Step-by-Step Solution

1
Add the Transform header to the AWS SAM template.
The template now contains `Transform: AWS::Serverless-2016-10-31` at the root level, allowing AWS CloudFormation to invoke the SAM transform to compile serverless resources.
Without this declaration, CloudFormation does not recognize AWS SAM resource types like `AWS::Serverless::Function`.
2
Ensure the Lambda execution role has correct permissions.
The execution role is provisioned with Secrets Manager access using the `AWSSecretsManagerGetSecretValuePolicy` SAM policy template.
The Lambda function needs permission to fetch the secret value.
3
Update the Lambda function code to use the Secrets Manager SDK client.
The code calls `GetSecretValue` from the AWS Secrets Manager client instead of querying Systems Manager Parameter Store.
SSM Parameter Store and Secrets Manager are distinct services, and the credential is saved as a Secrets Manager resource.

Key Concept

AWS SAM Template Structure and AWS Secrets Manager Integration
Question 214Question →

A developer is managing an AWS CloudFormation stack for a production backend application. During a stack update, the deployment fails, and the stack enters the UPDATE_ROLLBACK_FAILED state because an IAM role referenced by the template was manually deleted out-of-band. The developer has corrected the template and needs to apply the update to the stack. Which action should the developer take to resolve the stack state and successfully deploy the update?

Show answer & explanation

Answer: Use the ContinueUpdateRollback operation to return the stack to the UPDATE_ROLLBACK_COMPLETE state, optionally recreating the deleted IAM role or skipping it during the rollback, and then perform the stack update with the corrected template.

Answer

Use the ContinueUpdateRollback operation to return the stack to the UPDATE_ROLLBACK_COMPLETE state (optionally skipping or recreating the deleted role), and then perform the stack update with the corrected template.
To update a CloudFormation stack that is stuck in the UPDATE_ROLLBACK_FAILED state, you must first return the stack to a stable state. Triggering ContinueUpdateRollback allows CloudFormation to complete the rollback by either skipping the deleted resource or using a recreated version of it. Once the stack is in the UPDATE_ROLLBACK_COMPLETE state, you can successfully apply the corrected template.

Step-by-Step Solution

1
Analyze the cause of the stack failure.
Confirm the stack is stuck in UPDATE_ROLLBACK_FAILED due to the missing IAM role.
You must identify the missing resource that is blocking CloudFormation from performing rollback operations.
2
Run the ContinueUpdateRollback operation.
Specify the deleted IAM role to be skipped during rollback, or recreate the IAM role with the exact same physical ID/name.
This allows CloudFormation to bypass the block and complete the rollback sequence.
3
Perform the stack update.
Deploy the corrected CloudFormation template once the stack reaches the stable UPDATE_ROLLBACK_COMPLETE state.
CloudFormation stack updates can only be initiated when the stack is in a stable, non-transitioning state.

Key Concept

Resolving CloudFormation update rollback failures due to deleted resources.
Estimated Time:1m 30s
Question 215Question →

A developer is configuring a continuous integration pipeline using AWS CodeBuild to compile a Node.js application, run unit tests, and push the resulting container image to an Amazon Elastic Container Registry (ECR) repository. The developer needs to configure the build process to meet the following requirements:

* The unit tests must run during the build process. If they fail, the build must stop immediately and mark the build run as failed.
* A cleanup script must execute to remove temporary files, regardless of whether the unit tests succeed or fail.
* The Docker image must only be built and pushed to Amazon ECR if all unit tests pass.

Which configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure the buildspec file to run the unit tests in the build phase. Place the cleanup script in the post_build phase to run unconditionally. In the post_build phase, check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable, and only build and push the Docker image if its value is 1.

Answer

Configure the buildspec file to run the unit tests in the build phase, place the cleanup script in the post_build phase to run unconditionally, and check the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase before building and pushing the Docker image.
The correct configuration uses the build phase to run the tests and the post_build phase to run the cleanup script unconditionally. By checking the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase, the developer can conditionally build and push the Docker image only if all previous phases succeeded.

Step-by-Step Solution

1
Determine the appropriate lifecycle phases for execution and cleanup.
Unit tests are placed in the build phase so they fail the build immediately if they return a non-zero exit code. The cleanup script is placed in the post_build phase because it is guaranteed to execute even if the build phase fails.
CodeBuild executes the post_build phase regardless of the success or failure of previous phases, making it the correct place for cleanup tasks.
2
Implement conditional execution for the Docker build and push.
Check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase. If it is 1, proceed with the Docker build and ECR push commands; otherwise, skip them.
Using the built-in CODEBUILD_BUILD_SUCCEEDING variable prevents pushing an invalid or untested image if the unit tests in the build phase failed.
3
Ensure security and permission compliance.
Verify that the CodeBuild service role has a trust policy allowing codebuild.amazonaws.com to assume the role and permissions to write to ECR.
This guarantees that the CodeBuild service can assume the role and successfully push the Docker image to the registry.

Key Concept

AWS CodeBuild buildspec phases, environment variables, and execution behavior.
Question 216Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must meet the following requirements:
- Provide zero downtime for users during updates.
- Run automated integration tests to validate the replacement task set (Green) using a test port before any production traffic is shifted.
- Automatically and immediately roll back the deployment if the validation tests fail, or if a CloudWatch alarm for HTTP 5xx errors is triggered.
- Shift 10% of the production traffic to the new version initially, and shift the remaining 90% after a 15-minute soak period.

Which two configurations or lifecycle hooks should the developer use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke an AWS Lambda function that runs the validation tests.; Select the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration for the deployment group.

Answer

Use the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke a Lambda function that runs the validation tests, and select the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration for the deployment group.
The correct configurations are the AfterAllowTestTraffic lifecycle hook (which runs validation tests against the replacement task set while it is accessible via the test listener) and the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration (which routes 10% of traffic to the green deployment and the remaining 90% after 15 minutes).

Step-by-Step Solution

1
Identify the required traffic shifting behavior.
Traffic must shift 10% initially and the rest after 15 minutes.
This matches a canary traffic routing model with a 15-minute soak period, which corresponds to the CodeDeployDefault.ECSCanary10Percent15Minutes configuration.
2
Determine the correct CodeDeploy lifecycle hook for validation testing in an ECS environment.
Use the AfterAllowTestTraffic hook to run validation tests via the test port before production traffic starts shifting.
In ECS blue/green deployments, the AfterAllowTestTraffic hook executes after the replacement task set is reachable via the test listener but before production traffic is routed.
3
Identify the correct execution target for ECS lifecycle hooks.
The hook must invoke an AWS Lambda function.
Unlike EC2 deployments which run shell scripts, ECS deployments require AppSpec hooks to trigger Lambda functions.

Key Concept

Deploying updates to Amazon ECS using AWS CodeDeploy blue/green traffic shifting and lifecycle hooks.
Question 217Question →

A developer is configuring a blue/green deployment for a containerized microservice running on Amazon ECS using AWS CodeDeploy. The deployment must execute a database schema migration before the replacement task set is created. Additionally, after the replacement task set is provisioned and test traffic is routed to it via a test listener, the developer must run integration tests against the test port to validate the deployment before shifting production traffic.

Which of the following configurations should the developer implement in the AppSpec file to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Specify a BeforeInstall hook in the hooks section that references the Amazon Resource Name (ARN) of an AWS Lambda function designed to run the database migrations.; Specify an AfterAllowTestTraffic hook in the hooks section that references the Amazon Resource Name (ARN) of an AWS Lambda function designed to run the integration tests against the test port.

Answer

Specify a BeforeInstall hook in the hooks section referencing the ARN of a Lambda function to run the database migrations, and specify an AfterAllowTestTraffic hook referencing the ARN of a Lambda function to run the integration tests against the test port.
For an Amazon ECS deployment, CodeDeploy lifecycle hooks must reference AWS Lambda functions. The BeforeInstall hook runs before the replacement task set is created, which is the correct time to run database schema migrations. The AfterAllowTestTraffic hook runs after test traffic is routed to the new task set, which is the correct phase to validate the application via the test port before production traffic is shifted.

Step-by-Step Solution

1
Analyze the compute platform and deployment type for the CodeDeploy configuration.
The target compute platform is Amazon ECS, and the deployment type is blue/green.
ECS deployments have a different set of lifecycle hooks compared to EC2/On-Premises, and hooks must target AWS Lambda functions rather than local scripts.
2
Determine the correct hook for running database migrations before task set creation.
The BeforeInstall hook is selected.
BeforeInstall runs before CodeDeploy creates the replacement task set, which is the correct time to run database schema migrations.
3
Determine the correct hook for running integration tests via the test port after test traffic routing.
The AfterAllowTestTraffic hook is selected.
AfterAllowTestTraffic runs after test traffic is shifted to the replacement task set, allowing validation of the application before production traffic is routed.

Key Concept

AWS CodeDeploy ECS Lifecycle Hooks
Question 218Question →

A developer is updating a microservice hosted on Amazon ECS. Due to budget constraints, the developer cannot provision any additional container instances in the ECS cluster. The application is currently running at its desired task count and must remain at least 50% operational during the deployment. Which deployment configuration for minimum healthy percent and maximum percent will allow the deployment to succeed under these constraints?

Show answer & explanation

Answer: minimumHealthyPercent set to 50, and maximumPercent set to 100

Answer

Setting the minimumHealthyPercent to 50 and maximumPercent to 100 allows Amazon ECS to deploy the updates within the existing cluster capacity while keeping the application partially available.
The configuration specifying minimumHealthyPercent as 50 and maximumPercent as 100 ensures that ECS can terminate up to half of the running tasks before launching new ones. This satisfies the requirement to keep the application 50% operational while ensuring that the task count never exceeds 100% of the desired limit, avoiding the need for additional instances.

Step-by-Step Solution

1
Determine the resource availability limit.
The maximum percent must be set to 100.
Since no additional container instances can be provisioned in the cluster, the deployment cannot scale out. The total number of tasks running at any time must not exceed the desired task count.
2
Determine the minimum service availability requirement.
The minimum healthy percent must be set to 50.
The service is required to remain at least 50% operational during the update, meaning at least 50% of the desired task count must be healthy and running at all times.
3
Combine the parameters to define the deployment configuration.
Select the configuration with minimumHealthyPercent at 50 and maximumPercent at 100.
This allows ECS to stop 50% of the tasks first, then start 50% of the new tasks, proceeding iteratively without exceeding the resource capacity or dropping below the availability threshold.

Key Concept

Amazon ECS Rolling Update Parameters (minimumHealthyPercent and maximumPercent)
Estimated Time:1m 0s
Question 219Question →

A developer is configuring an Amazon ECS task definition to deploy a microservice to AWS Fargate. The container image is stored in a private Amazon ECR repository. During startup, the containerized application must read database credentials from AWS Secrets Manager. The developer wants to inject these credentials as container environment variables without exposing them in plaintext or embedding them in the container image.

Which two actions should the developer take to configure the task definition and IAM roles for this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS Task Execution Role with a policy that allows the secretsmanager:GetSecretValue action.; In the container definition, use the secrets parameter to reference the database credential secret and map it to a container environment variable.

Answer

The correct configurations are to configure the ECS Task Execution Role with a policy that allows the secretsmanager:GetSecretValue action, and to reference the database credential secret using the secrets parameter in the container definition to map it to an environment variable.
The ECS agent is responsible for both pulling the container image from Amazon ECR and retrieving database credentials from Secrets Manager to inject them as environment variables during container creation. Therefore, these permissions must be granted to the ECS Task Execution Role, and the task definition container definition must use the secrets parameter to map the secret ARN to the desired environment variable name.

Step-by-Step Solution

1
Understand who performs image pulls and secrets retrieval.
The ECS agent performs these tasks during task initialization, not the containerized application code.
This determines that permissions for pulling ECR images and retrieving Secrets Manager secrets belong in the ECS Task Execution Role rather than the ECS Task Role.
2
Identify the proper IAM permissions for Secrets Manager retrieval.
Assign the secretsmanager:GetSecretValue permission to the ECS Task Execution Role policy.
The ECS agent needs this permission to call AWS Secrets Manager to retrieve the credential values.
3
Determine the proper method to inject secrets into the container definition.
Use the secrets parameter in the container definition to map the secret ARN to the environment variable.
This keeps credentials secure by injecting them at runtime, preventing the exposure of plaintext credentials in the task definition.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role, and secure injection of secrets into ECS containers.
Question 220Question →

A developer is designing an AWS CloudFormation template to deploy a microservice. The microservice requires access to a database password that must be automatically rotated every 30 days, as well as a non-sensitive API endpoint URL for an external service. Which two configuration strategies should the developer use to reference these values in the CloudFormation template to ensure security, rotation support, and cost-efficiency? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Reference the database password dynamically in the template using an AWS Secrets Manager dynamic reference.; Reference the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.

Answer

Referencing the database password dynamically in the template using an AWS Secrets Manager dynamic reference, and referencing the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.
For sensitive credentials requiring automatic rotation, the correct practice is to store them in AWS Secrets Manager and reference them via an AWS Secrets Manager dynamic reference. For non-sensitive configurations that do not need rotation, the correct and cost-efficient practice is to store them in AWS Systems Manager Parameter Store and reference them via a Parameter Store dynamic reference.

Step-by-Step Solution

1
Identify the security and rotation requirements for the sensitive database password.
Determine that AWS Secrets Manager is required because it supports native automatic rotation and encryption.
Secrets Manager is built to securely store sensitive data and automate rotation workflows.
2
Identify the requirements for the non-sensitive API endpoint URL.
Determine that AWS Systems Manager Parameter Store is the most appropriate service.
Parameter Store is more cost-effective for non-sensitive data and configuration parameters that do not require rotation.
3
Integrate both services into the CloudFormation template using dynamic references.
The template securely fetches the values at runtime without exposing them in plaintext or risking resource drift.
Dynamic references allow CloudFormation to retrieve external configuration values securely when the stack is created or updated.

Key Concept

Securely referencing sensitive credentials and non-sensitive configurations in AWS CloudFormation templates using Secrets Manager and Systems Manager Parameter Store.
PreviousPage 11 / 19Next
Deployment Practice Questions — AWS Certified Developer - Associate — Page 11 | Examkin