Examkin

Deployment

376 questions

All types376Multiple choice191Multiple select171Ordering14
Question 281Question →

A developer is deploying a containerized microservice to Amazon ECS on AWS Fargate. The application code inside the container must read and write data to an Amazon DynamoDB table. During startup, the Amazon ECS container agent must retrieve sensitive API keys from AWS Secrets Manager to inject as environment variables and send container logs to Amazon CloudWatch Logs. Which of the following configurations must the developer perform to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate an IAM role containing DynamoDB read and write permissions as the Task Role (taskRoleArn) in the task definition.; Associate an IAM role containing Secrets Manager decryption and CloudWatch Logs creation permissions as the Task Execution Role (executionRoleArn) in the task definition.

Answer

The developer must associate the IAM role containing DynamoDB permissions as the Task Role (taskRoleArn) and associate the IAM role containing Secrets Manager and CloudWatch permissions as the Task Execution Role (executionRoleArn).
The correct configurations involve assigning the correct responsibilities to the Task Role and the Task Execution Role. The Task Role is used by the containers running inside the task to make AWS API calls, so the permission to read and write to the DynamoDB table must be attached to the Task Role. The Task Execution Role is used by the Amazon ECS container agent to perform actions on behalf of the task before the containers start, such as pulling the container image, writing logs to CloudWatch Logs, and retrieving secrets from Secrets Manager to inject as environment variables.

Step-by-Step Solution

1
Analyze the requirements for permissions that the containerized application code needs during execution.
The application code needs to read and write to Amazon DynamoDB.
Permissions for AWS API calls made by the application code must be granted via the ECS Task Role.
2
Analyze the requirements for permissions that the ECS agent needs to set up the container.
The ECS agent needs to retrieve secrets from Secrets Manager and write logs to CloudWatch Logs.
Permissions for pulling images, retrieving secrets for container initialization, and writing logs are managed by the ECS Task Execution Role.
3
Identify the correct configurations that map these roles to the task definition.
The DynamoDB role is associated with taskRoleArn, and the role containing Secrets Manager and CloudWatch Logs permissions is associated with executionRoleArn.
This configuration correctly separates runtime application permissions from container initialization permissions.

Key Concept

Separation of concerns between the ECS Task Role and the ECS Task Execution Role.
Estimated Time:2m 0s
Question 282Question →

A developer is deploying a multi-tier application using an AWS CloudFormation template. The template defines an Amazon RDS DBInstance that contains critical production data. To ensure data safety and prevent downtime, the developer must meet two requirements:

1. Prevent the database instance from being deleted when the CloudFormation stack is deleted.
2. Prevent the database instance from being accidentally updated or replaced during stack updates, while still allowing other stack resources to be updated.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template.; Define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.

Answer

The developer should set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template, and define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.
To satisfy the requirements, the developer must configure both DeletionPolicy and a Stack Policy. Setting the DeletionPolicy to Retain ensures that the RDS DBInstance is kept when the stack is deleted. Applying a Stack Policy with an explicit Deny for Update actions on the DBInstance resource prevents it from being modified or replaced during stack updates, while still allowing other stack resources to be updated.

Step-by-Step Solution

1
Identify the mechanism to prevent resource deletion upon stack deletion.
Determine that setting the DeletionPolicy attribute to Retain in the template ensures the DBInstance persists even if the CloudFormation stack is deleted.
By default, deleting a stack deletes all of its resources. The DeletionPolicy attribute allows overriding this behavior for specific resources.
2
Identify the mechanism to prevent resource updates or replacement during stack updates.
Determine that applying a Stack Policy with an explicit Deny statement for Update actions on the DBInstance prevents accidental updates or replacements during stack updates.
Stack policies define update permissions for stack resources. Applying an explicit Deny on the DBInstance prevents modifications to it, while allowing other stack resources to update normally.

Key Concept

AWS CloudFormation Resource Lifecycle Protection
Estimated Time:1m 30s
Question 283Question →

A developer is configuring a blue/green deployment for a containerized microservice on Amazon ECS using AWS CodeDeploy. The deployment must execute an AWS Lambda function to perform database migrations before the load balancer begins routing production traffic to the new task set. The database password must be rotated automatically every week. During the configuration phase, the deployment fails because of lifecycle and permission errors. Which of the following configurations will successfully execute the database migration during the deployment?

Show answer & explanation

Answer: Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.

Answer

Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.
The configuration using the BeforeAllowTraffic lifecycle hook, AWS Secrets Manager, and proper IAM permission policies is correct because it correctly aligns with ECS-specific deployment hooks, meets the automated rotation requirements, and correctly permissions CodeDeploy to execute the validation Lambda function.

Step-by-Step Solution

1
Identify the correct CodeDeploy lifecycle hook for ECS deployments.
BeforeAllowTraffic is identified as the valid hook because ECS deployments do not support EC2-specific lifecycle hooks like BeforeInstall.
Choosing the correct hook prevents deployment validation errors in the AppSpec file.
2
Determine the correct service for storing database credentials requiring rotation.
AWS Secrets Manager is chosen because it supports automatic rotation natively, unlike Systems Manager Parameter Store.
Meeting the requirement for weekly automatic rotation of credentials.
3
Configure the necessary IAM permissions for CodeDeploy to invoke the migration Lambda function.
Attach an identity-based policy granting lambda:InvokeFunction to the CodeDeploy service role.
Ensuring CodeDeploy has the operational permission to trigger the validation Lambda hook during deployment.

Key Concept

AWS CodeDeploy ECS lifecycle hooks, secrets management, and IAM permission vs trust policies.
Question 284Question →

A developer is setting up an AWS CodeBuild project that needs to pull dependency packages from a third-party private repository. The credentials for this repository must be rotated automatically every 30 days. The developer needs to configure the build environment to securely retrieve these credentials during the build process.

Which configuration should the developer implement to meet these requirements with the lowest operational overhead?

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager with automatic rotation. In the buildspec.yml file, reference the secret using the secrets-manager mapping under the env sequence.

Answer

Store the credentials in AWS Secrets Manager with automatic rotation. In the buildspec.yml file, reference the secret using the secrets-manager mapping under the env sequence.
Storing the credentials in AWS Secrets Manager is the correct approach because it natively supports automatic rotation of secrets. Referencing the secret in the env/secrets-manager section of the buildspec.yml file allows CodeBuild to securely retrieve the credentials at build time without exposing them in plaintext.

Step-by-Step Solution

1
Select the appropriate storage service for secrets requiring automatic rotation.
AWS Secrets Manager is chosen because it supports built-in automatic rotation using AWS Lambda, whereas Systems Manager Parameter Store does not.
Meeting the rotation requirement with the lowest operational overhead requires utilizing native service features.
2
Configure reference to the stored secret in the build definition.
Add the secret under the env/secrets-manager section of the buildspec.yml file.
This allows CodeBuild to fetch the credential dynamically at runtime, avoiding hardcoded values.
3
Ensure correct IAM permissions are attached to the CodeBuild service role.
Attach a policy with the secretsmanager:GetSecretValue permission to the CodeBuild execution role.
CodeBuild needs permission to retrieve the secret value from Secrets Manager during the build execution.

Key Concept

Secure credential retrieval and buildspec configuration in AWS CodeBuild
Estimated Time:2m 0s
Question 285Question →

An engineering team is setting up a CI/CD pipeline using AWS CodeDeploy to deploy a Node.js web application to a fleet of Amazon EC2 instances. The deployment configuration must ensure that the application is fully running and able to handle traffic before the deployment is marked as successful. Additionally, CodeDeploy requires authorization to interact with EC2 auto-scaling groups and load balancers during the deployment process.

Which of the following configurations must be implemented to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM service role for AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.; Use the ValidateService lifecycle hook in the appspec.yml file to execute a script that checks the application's local health endpoint.

Answer

Configure an IAM service role for AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role, and use the ValidateService lifecycle hook in the appspec.yml file to execute a script that checks the application's local health endpoint.
To allow AWS CodeDeploy to perform deployments on EC2/On-Premises instances, it needs a service role that trusts the 'codedeploy.amazonaws.com' service principal. This role grants the service permission to interact with other AWS services like EC2, Auto Scaling, and Elastic Load Balancing. To verify the service health post-deployment, the 'ValidateService' lifecycle hook in the EC2 AppSpec file must be used to run validation scripts before CodeDeploy marks the deployment as successful.

Step-by-Step Solution

1
Determine the necessary IAM configuration for AWS CodeDeploy authorization.
Identify that AWS CodeDeploy must be configured with an IAM service role (not an EC2 instance profile) whose trust policy explicitly lists the 'codedeploy.amazonaws.com' service principal. This allows CodeDeploy to interact with EC2, Auto Scaling, and Elastic Load Balancing APIs.
Without this service role, CodeDeploy lacks the permissions to execute deployments across the target instances and infrastructure.
2
Map the correct AppSpec lifecycle hook for post-deployment verification on Amazon EC2.
Select the 'ValidateService' lifecycle hook inside the EC2 'appspec.yml' file to execute local verification scripts.
In EC2/On-Premises deployment groups, ValidateService is the proper hook for service validation, whereas hooks like BeforeAllowTraffic are restricted to ECS and Lambda deployment types.
3
Rule out incorrect trust policies and mismatched API permissions.
Discard modifications to the EC2 instance profile's trust policy (which must trust EC2, not CodeDeploy) and correct Systems Manager Parameter Store permissions (which require SSM API permissions rather than Secrets Manager permissions).
This isolates the correct configurations for service trust boundaries and parameter store access.

Key Concept

Configuring AWS CodeDeploy service roles and understanding EC2-specific AppSpec lifecycle hooks.
Estimated Time:2m 0s
Question 286Question →

An application development team is migrating their continuous integration process to AWS CodeBuild. The build environment needs to compile a Node.js application, install packages, and build a container image. To optimize build performance, the team wants to cache both the downloaded node modules and the intermediate Docker image layers using local caching on the build host.

Which combination of actions must the developer perform to configure the required caching? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the buildspec.yml file, add a cache block specifying the path to the node packages (e.g., node_modules/**/*).; In the CodeBuild project configuration, enable local cache and select both custom cache and Docker layer cache.

Answer

In the buildspec.yml file, add a cache block specifying the path to the node packages (e.g., node_modules/**/*), and in the CodeBuild project configuration, enable local cache and select both custom cache and Docker layer cache.
To cache custom paths such as dependency folders, the developer must specify the target directory in the buildspec.yml cache block. To use local host caching for both custom buildspec paths and intermediate Docker layers, the developer must also configure local cache in the project settings, explicitly enabling the custom cache and Docker layer cache types.

Step-by-Step Solution

1
Configure the buildspec file to define the custom folder to be cached.
A cache section is added to the buildspec.yml with the path 'node_modules/**/*'.
This instructs CodeBuild's caching mechanism which files to look for and package at the end of a build.
2
Configure the CodeBuild project's local caching behavior.
The project is configured to use local caching with 'Custom cache' and 'Docker layer cache' enabled.
This tells CodeBuild to store the custom path specified in buildspec.yml and intermediate Docker layers locally on the build host rather than uploading them to S3.

Key Concept

AWS CodeBuild Caching Configurations
Estimated Time:2m 0s
Question 287Question →

A company is migrating its build pipelines to AWS. A developer is setting up an AWS CodeBuild project that needs to run automated integration tests against a database. The build configuration requires retrieving a database password securely and using a custom build specification file named build-config.yml instead of the default buildspec.yml file.

Which combination of actions must the developer perform to successfully configure this build project? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter, and reference it under the parameter-store mapping in the env section of build-config.yml.; In the AWS CodeBuild project configuration, specify build-config.yml in the buildspec build settings.

Answer

Store the database password as a SecureString in Parameter Store and reference it in the parameter-store section of the custom buildspec file, and specify the custom buildspec filename in the CodeBuild project settings.
To successfully configure this project, the developer must override the default buildspec filename in the AWS CodeBuild project configuration by setting it to build-config.yml. Additionally, the developer must store the password as a SecureString in Systems Manager Parameter Store and reference it in the parameter-store mapping of the env section in the buildspec file. This allows CodeBuild to decrypt and expose the password as an environment variable during the build phases securely.

Step-by-Step Solution

1
Configure the CodeBuild project to use the custom buildspec file.
Specify the name build-config.yml in the buildspec settings of the project configuration.
By default, CodeBuild looks for a file named buildspec.yml at the root of the source directory. A custom filename must be explicitly defined.
2
Secure the database password using Parameter Store.
Store the database password as a SecureString parameter in Systems Manager Parameter Store.
SecureString ensures the parameter is encrypted at rest using a KMS key, which is standard practice for sensitive credentials like passwords.
3
Reference the parameter securely in the build specification.
Add the parameter-store mapping under the env section of the buildspec and map the environment variable to the Parameter Store parameter name.
This allows CodeBuild to retrieve the decrypted value dynamically during the build execution without hardcoding it in the source repository.

Key Concept

AWS CodeBuild project configuration including custom buildspec overrides and secure parameter retrieval via Systems Manager Parameter Store.
Question 288Question →

A development team uses AWS CloudFormation to manage a serverless application consisting of Amazon DynamoDB tables and AWS Lambda functions. The application requires a database API key that must be rotated every 30 days. Additionally, a developer recently modified the read capacity units of one of the DynamoDB tables directly in the AWS Management Console to handle a temporary traffic spike. The team now needs to perform a stack update to deploy new application logic while addressing both the rotation requirement and the manual configuration changes.

Which of the following actions should the team take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database API key in AWS Secrets Manager, configure automatic rotation for the secret, and reference the secret in the CloudFormation template using a dynamic reference.; Perform drift detection on the CloudFormation stack, identify the modified DynamoDB read capacity properties, and update the CloudFormation template or the resource to resolve the drift before updating the stack.

Answer

Store the database API key in AWS Secrets Manager with automatic rotation enabled, reference it via a dynamic reference in the template, and run drift detection to identify and reconcile the manual DynamoDB configurations before updating the stack.
Storing the API key in AWS Secrets Manager is correct because Secrets Manager natively supports automatic rotation of secrets and allows safe retrieval via dynamic references in CloudFormation templates. Performing drift detection on the stack is correct because it identifies manual out-of-band changes, allowing the developer to align the template or resource state before applying the stack update, preventing update failures.

Step-by-Step Solution

1
Evaluate the secret storage and rotation requirement.
Determine that AWS Secrets Manager must be used because it provides built-in automatic rotation capabilities, unlike Systems Manager Parameter Store, and can be resolved in templates via dynamic references.
Parameter Store does not natively support automated secrets rotation, making Secrets Manager the correct choice.
2
Address the configuration drift from the manual out-of-band modifications.
Detect drift using CloudFormation drift detection, identify the difference in DynamoDB read capacity units, and update either the CloudFormation template or the resource to resolve the drift.
Updating a stack with out-of-band modifications can result in deployment failures or unintended resource configurations unless the template is synchronized with the actual state.

Key Concept

Managing secrets with rotation and handling resource drift in AWS CloudFormation.
Question 289Question →

A company runs a high-traffic web application on an AWS Elastic Beanstalk environment. The application is highly sensitive to performance degradation, so the deployment of a new version must maintain 100% of the environment's instance capacity to handle traffic at all times. Additionally, if the new version fails health checks, the environment must roll back automatically with minimal rollback time and no manual intervention. The developer wants to avoid configuring a secondary environment or changing DNS records. Which deployment strategy should the developer select to meet these requirements?

Show answer & explanation

Answer: Immutable deployment

Answer

Immutable deployment
The correct strategy is an Immutable deployment. This policy launches a temporary Auto Scaling group with the new application version and tests it. If the instances pass health checks, Elastic Beanstalk moves them to the main Auto Scaling group and terminates the old instances. If they fail, the temporary Auto Scaling group is terminated immediately, achieving a clean and fast rollback without modifying any of the original instances and maintaining 100% capacity throughout the process.

Step-by-Step Solution

1
Analyze the capacity requirement.
The requirement specifies that the deployment must maintain 100% of the environment's instance capacity. This rules out 'All at once' and 'Rolling' deployments, as they temporarily take instances out of service.
To prevent performance degradation during the deployment process.
2
Analyze the environment and DNS requirements.
The deployment must occur within the existing environment without creating a secondary environment or changing DNS records (CNAME swap), which rules out external Blue/Green deployments.
To simplify management and satisfy the single-environment constraint.
3
Evaluate the rollback and failure recovery requirements.
The strategy must support automatic rollback with minimal recovery time if health checks fail. An immutable deployment creates a temporary Auto Scaling group to test the new version, making rollbacks as simple as terminating the temporary group. A rolling with additional batch deployment would require a slow, manual rollback deployment of the previous version if some instances had already been updated.
To find the strategy that minimizes the blast radius and rollback time within a single environment.

Key Concept

AWS Elastic Beanstalk deployment policies and their trade-offs regarding capacity, downtime, and rollback mechanisms.
Estimated Time:1m 30s
Question 290Question →

A developer is configuring a buildspec.yml file for an AWS CodeBuild project. The build environment requires access to a database connection password stored in AWS Secrets Manager and a non-sensitive configuration parameter stored in Systems Manager Parameter Store. The developer wants to retrieve these values securely and inject them as environment variables during the build phases without hardcoding them in the source code. Which approach should the developer take to retrieve these values?

Show answer & explanation

Answer: Define the non-sensitive configuration under the parameter-store mapping and the database password under the secrets-manager mapping inside the env section of the buildspec.yml file.

Answer

Define the non-sensitive configuration under the parameter-store mapping and the database password under the secrets-manager mapping inside the env section of the buildspec.yml file.
The correct option correctly uses CodeBuild's native capabilities to resolve environment variables. Defining the parameter in the parameter-store block and the secret in the secrets-manager block under the env section of buildspec.yml ensures that CodeBuild calls the appropriate AWS APIs at build initialization, retrieves the values securely, and makes them available to the build environment phases.

Step-by-Step Solution

1
Identify where the database connection password and non-sensitive configuration parameters are stored.
The password is in AWS Secrets Manager, and the parameter is in Systems Manager Parameter Store.
Understanding the source storage determines the corresponding configuration block to use in the buildspec.
2
Map the storage locations to the native environment variable structures supported by AWS CodeBuild.
AWS CodeBuild provides parameter-store and secrets-manager blocks under the env section of buildspec.yml to natively retrieve these values.
Using native blocks allows CodeBuild to automatically fetch the values at runtime using the build's IAM role, ensuring they are not hardcoded or exposed.
3
Specify the parameters under their correct respective blocks in the env section.
The configuration parameter goes under parameter-store and the database password goes under secrets-manager.
This guarantees that both services are accessed using the correct APIs and the fetched values are injected as environment variables.

Key Concept

AWS CodeBuild Environment Variable Resolution
Question 291Question →

A developer is configuring an AWS CodeDeploy deployment group for an in-place deployment to a fleet of 10 Amazon EC2 instances. The deployment must not provision any new EC2 instances due to budget limitations. Additionally, the application must maintain at least 50% of its healthy instance capacity at all times during the update to handle the incoming traffic load.

Which two CodeDeploy default deployment configurations can the developer select to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: CodeDeployDefault.OneAtATime; CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.OneAtATime and CodeDeployDefault.HalfAtATime
The correct configurations are CodeDeployDefault.OneAtATime and CodeDeployDefault.HalfAtATime. An in-place deployment to a fleet of 10 EC2 instances requires at least 5 instances (50%) to remain healthy at all times. CodeDeployDefault.OneAtATime updates one instance at a time, keeping 90% capacity active. CodeDeployDefault.HalfAtATime updates up to 5 instances at a time, keeping exactly 50% capacity active. Both satisfy the minimum capacity requirement.

Step-by-Step Solution

1
Analyze the deployment target and capacity constraints.
The deployment is in-place on a fleet of 10 EC2 instances and requires at least 50% capacity (5 instances) to remain healthy at all times.
To identify which deployment configurations are compatible with EC2 and satisfy the minimum instance count requirements.
2
Evaluate compatible CodeDeploy deployment configurations for EC2.
CodeDeployDefault.OneAtATime, CodeDeployDefault.HalfAtATime, and CodeDeployDefault.AllAtOnce are default configurations for EC2. Configurations prefixed with ECS or Lambda are incompatible.
To filter out platform-incompatible configurations.
3
Calculate the active capacity during deployment for the remaining configurations.
OneAtATime keeps 90% (9 instances) active. HalfAtATime keeps 50% (5 instances) active. AllAtOnce keeps 0% (0 instances) active. Only OneAtATime and HalfAtATime meet the 50% threshold.
To select the configurations that satisfy the capacity constraint.

Key Concept

AWS CodeDeploy deployment configurations for EC2 in-place deployments.
Question 292Question →

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application code reads configuration files from an Amazon S3 bucket. Additionally, the container definition is configured to retrieve a database password from AWS Systems Manager Parameter Store and inject it as an environment variable at startup. Which configuration of IAM roles and trust relationships is required for the application to run successfully?

Show answer & explanation

Answer: Attach the S3 access policy to the ECS Task Role, and attach the Parameter Store access policy to the ECS Task Execution Role. Configure both roles to trust the ECS tasks service (ecs-tasks.amazonaws.com).

Answer

Attach the S3 access policy to the ECS Task Role, and attach the Parameter Store access policy to the ECS Task Execution Role. Configure both roles to trust the ECS tasks service (ecs-tasks.amazonaws.com).
The correct option correctly separates the runtime application permissions (ECS Task Role for S3) from the ECS agent bootstrap permissions (ECS Task Execution Role for Parameter Store), and configures both roles to trust the ECS tasks service principal (ecs-tasks.amazonaws.com).

Step-by-Step Solution

1
Determine the role required for the application code to access S3.
The application code running inside the container needs runtime permissions, which are provided by the ECS Task Role.
The Task Role credentials are injected into the container's environment for the AWS SDK to use.
2
Determine the role required for the container agent to fetch secrets.
The ECS container agent needs permissions to pull the secret from Parameter Store at startup, which is provided by the ECS Task Execution Role.
The Task Execution Role grants the ECS infrastructure permissions to prepare the container environment.
3
Verify the IAM trust relationships.
Both roles must trust the ecs-tasks.amazonaws.com service principal.
This allows Amazon ECS to assume the specified IAM roles on behalf of the tasks.

Key Concept

ECS Task Role vs Task Execution Role
Question 293Question →

A developer uses AWS CloudFormation to manage an application's infrastructure. An administrator manually modified the inbound rules of a security group associated with an Amazon EC2 instance using the AWS Management Console to resolve a temporary connection issue. The developer runs a drift detection status check on the stack, and the security group is flagged as DRIFTED. Which action should the developer take to resolve the drift and ensure the resource configuration is correctly aligned with the CloudFormation template?

Show answer & explanation

Answer: Revert the manual changes in the security group directly via the Amazon EC2 console to match the template, or update the template to include the modified rules and run a stack update.

Answer

Revert the manual changes in the security group directly via the Amazon EC2 console to match the template, or update the template to include the modified rules and run a stack update.
To resolve drift on a resource managed by CloudFormation, you must either revert the manual out-of-band changes directly in the resource's service console (or via CLI) so it matches the template configuration, or update the CloudFormation template to match the drifted state and perform a stack update to sync the stack status.

Step-by-Step Solution

1
Identify the drifted properties of the resource using the drift detection details in the AWS CloudFormation console.
The differences between the expected template configuration and the actual live configuration of the security group are revealed.
This allows the developer to pinpoint exactly which rules were modified, added, or deleted out-of-band.
2
Decide whether to keep the manual changes or revert them.
A plan is made to either rollback the manual console edits or update the template to adopt them permanently.
Resolving drift requires aligning the expected template definition with the physical resource state.
3
Perform the alignment action by either manually updating the security group rules in the EC2 Console to match the template, or updating the CloudFormation template to match the new rules followed by a stack update.
The resource configuration matches the template, and subsequent drift detection checks will report the resource as IN_SYNC.
This establishes a clean baseline for future CloudFormation deployments and prevents deployment failures.

Key Concept

CloudFormation Drift Detection and Resolution
Question 294Question →

A software engineer is building a deployment package for an Amazon ECS service running on AWS Fargate. The application container must write logging metadata to a shared Amazon S3 bucket during execution. Additionally, the container needs to retrieve a database password stored in AWS Systems Manager Parameter Store during initialization without hardcoding it. Which of the following identity and access configuration actions must the engineer perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy granting S3 write access to the ECS Task Role, and reference this role as the taskRoleArn in the task definition.; Attach an IAM policy granting Systems Manager Parameter Store access to the ECS Task Execution Role, and reference the parameter in the secrets section of the container definition.

Answer

Attach an IAM policy granting S3 write access to the ECS Task Role, and attach an IAM policy granting Systems Manager Parameter Store access to the ECS Task Execution Role.
The ECS Task Role is assumed by the containerized application itself at runtime to interact with AWS services like Amazon S3. The ECS Task Execution Role is used by the ECS container agent to make AWS API calls on your behalf, such as pulling images from Amazon ECR or retrieving secrets/parameters from Systems Manager Parameter Store or Secrets Manager during the container provisioning phase.

Step-by-Step Solution

1
Define the permissions required by the application code at runtime.
An IAM policy with s3:PutObject is identified.
This permission is needed for application logic execution.
2
Associate the runtime S3 permissions with the ECS Task Role.
The ECS Task Role is configured with the S3 policy and referenced in the task definition.
The containerized application inherits these permissions at runtime.
3
Define the permissions required by the ECS agent at launch time.
An IAM policy with ssm:GetParameters is identified.
This permission is needed for the ECS agent to fetch parameters and inject them as environment variables before starting the container.
4
Associate the startup parameter retrieval permissions with the ECS Task Execution Role.
The ECS Task Execution Role is configured with the SSM policy and referenced in the task definition.
The ECS agent successfully pulls the parameters during initialization.

Key Concept

Differentiating between the ECS Task Role and the ECS Task Execution Role for application runtime permissions versus container agent startup permissions.
Question 295Question →

A software development team configures an AWS CodeBuild project to run within a private subnet of a VPC to perform integration testing against an Amazon RDS DB instance. The integration tests connect to the database successfully, but the build project fails during the install phase when running commands to retrieve packages from a public software registry. Which of the following actions will resolve this build failure?

Show answer & explanation

Answer: Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route outbound internet traffic through the NAT gateway.

Answer

Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route outbound internet traffic through the NAT gateway.
The correct answer is to configure a NAT gateway in a public subnet of the VPC and update the private subnet's route table. When AWS CodeBuild projects are configured to run inside a VPC, they do not have direct internet access. If the build needs to access both private resources (such as Amazon RDS) and public registries to pull dependencies, you must place the CodeBuild project in private subnets, configure a NAT gateway in a public subnet, and route outbound internet traffic (0.0.0.0/0) through that NAT gateway.

Step-by-Step Solution

1
Analyze the network path requirements.
The CodeBuild project successfully connects to Amazon RDS (inside the private VPC) but fails to reach the public internet (external package registry).
This indicates that internal VPC routing works, but there is no outbound path to the public internet.
2
Identify the standard VPC component needed for outbound-only internet access.
A NAT gateway is required to translate private IP addresses to a public IP address for internet communication.
Resources in a private VPC subnet require a NAT gateway located in a public subnet with a route to an Internet Gateway to access external endpoints.
3
Configure routing for the private subnet.
Update the private subnet route table to target the NAT gateway for destination '0.0.0.0/0'.
This ensures all internet-bound traffic from the CodeBuild container in the private subnet is forwarded through the NAT gateway.

Key Concept

AWS CodeBuild VPC connectivity and internet access requirements
Estimated Time:1m 30s
Question 296Question →

A developer is updating a web application running on an AWS Elastic Beanstalk environment. The application is highly sensitive to customer-facing bugs, so the developer wants to test the new version using a small percentage of real production traffic (10%10\%) for a duration of 1515 minutes. If the new version triggers any Amazon CloudWatch alarms during this time, the traffic must immediately route back to the old version. If no alarms are triggered, the remaining 90%90\% of traffic should automatically shift to the new version. Which deployment policy should the developer configure in the Elastic Beanstalk environment?

Show answer & explanation

Answer: Traffic splitting

Answer

Traffic splitting
Traffic splitting is the correct answer because it is the only native AWS Elastic Beanstalk deployment policy that allows developers to perform canary testing. It launches a temporary Auto Scaling group with the new version, routes a specified percentage of traffic (e.g., 10%10\%) to it for a set evaluation period (e.g., 1515 minutes), monitors health using CloudWatch alarms, and automatically rolls back if alarms are triggered, or promotes the deployment to 100\% traffic if successful.

Step-by-Step Solution

1
Analyze the requirement to route a small fraction (10%10\%) of live production traffic to a new version of the application for validation.
Identify that this represents a canary deployment pattern, which requires splitting load balancer traffic between the existing environment and a new deployment.
This rules out standard rolling, rolling with additional batch, and immutable deployment policies, which update instances without fractional traffic routing.
2
Evaluate the rollback and promotion criteria (1515 minutes of evaluation using CloudWatch alarms, followed by automatic promotion or rollback).
Determine that the deployment policy must natively support CloudWatch alarm monitoring and automated rollback/promotion based on health status.
Traffic Splitting in Elastic Beanstalk allows configuring a specific evaluation time (e.g., 1515 minutes) and linking CloudWatch alarms to trigger a rollback.
3
Select the Elastic Beanstalk deployment policy that matches these constraints.
The Traffic Splitting policy is chosen as it is the only native Elastic Beanstalk policy designed specifically for percentage-based traffic shifting and automatic CloudWatch-based rollbacks.
Other policies like Immutable and Rolling with additional batch do not support fractional traffic splitting.

Key Concept

AWS Elastic Beanstalk Traffic Splitting Deployment Policy
Question 297Question →

A developer is configuring an Amazon ECS service on AWS Fargate to deploy a containerized application. The Docker image is hosted in a private Amazon Elastic Container Registry (ECR) repository located in a separate, central AWS account. The Fargate tasks will run in a private subnet within the developer's AWS account. Which configuration is required to allow the ECS service to successfully pull the container image and deploy the application?

Show answer & explanation

Answer: Configure the ECS Task Execution Role in the developer's account with permissions to call ecr:GetAuthorizationToken and pull the image. Update the central ECR repository policy to allow access to the developer's ECS Task Execution Role ARN, and configure VPC endpoints for ECR and Amazon S3.

Answer

Configure the ECS Task Execution Role in the developer's account with permissions to call ECR APIs and pull the image, update the central ECR repository policy to trust this role, and establish VPC endpoints for ECR and Amazon S3.
The correct configuration uses the ECS Task Execution Role because the ECS container agent is responsible for pulling the image and authenticating with Amazon ECR. Since the ECR repository is in another account, the repository policy in that central account must trust the Task Execution Role ARN from the developer's account. Finally, because the Fargate task runs in a private subnet, VPC endpoints for ECR and S3 (or a NAT Gateway) are required for the ECS agent to communicate with ECR.

Step-by-Step Solution

1
Determine which role is responsible for pulling container images in ECS.
The ECS Task Execution Role is identified as the role used by the ECS container agent to perform lifecycle tasks such as pulling images and writing logs, whereas the ECS Task Role provides permissions to the application code itself.
This establishes that permissions must be attached to the Task Execution Role rather than the Task Role.
2
Configure permissions for cross-account ECR access.
The ECS Task Execution Role in the developer's account is granted ECR read permissions, and the ECR repository policy in the central account is updated to allow the developer's Task Execution Role ARN to perform ecr actions.
This allows the ECS agent to authenticate and pull the image across AWS accounts.
3
Ensure network connectivity to ECR and S3 from the private subnet.
VPC endpoints for ECR and S3 are created in the developer's VPC.
Because the Fargate tasks run in a private subnet, they require private endpoints to communicate with ECR and download the container image layers stored in S3.

Key Concept

Distinction between ECS Task Role and Task Execution Role in cross-account ECR deployments
Question 298Question →

A developer is writing an AWS CloudFormation template to deploy a web application on an Amazon EC2 instance. The application requires a database password that needs automatic rotation, as well as several software packages. The developer wants to ensure that any updates to the software configuration in the template are automatically applied to the instance without replacing it.

Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Define the software configuration in the AWS::CloudFormation::Init resource metadata, run cfn-init in the UserData property to perform the initial installation, and configure the cfn-hup daemon to monitor changes.; Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Answer

Use the AWS::CloudFormation::Init resource metadata along with the cfn-init script and cfn-hup daemon to install and update software configurations, and use AWS Secrets Manager with dynamic references to securely store and automatically rotate the database password.
The correct options involve configuring the software installation using the CloudFormation metadata framework (AWS::CloudFormation::Init, cfn-init, and cfn-hup) to detect and apply updates automatically, and using AWS Secrets Manager to retrieve rotated database passwords dynamically.

Step-by-Step Solution

1
Select the appropriate storage for secret parameters that require rotation.
Identify AWS Secrets Manager as the solution because it supports automatic rotation of credentials, unlike Systems Manager Parameter Store.
Ensures the database password is secure and complies with security requirements for rotation.
2
Select the mechanism for applying and updating EC2 packages without recreating the instance.
Combine AWS::CloudFormation::Init, the cfn-init helper script in UserData, and the cfn-hup daemon running on the instance.
This configuration allows the instance to pull metadata changes and apply updates dynamically.

Key Concept

AWS CloudFormation helper scripts and dynamic references for secret management.
Question 299Question →

A high-traffic API is hosted on an AWS Elastic Beanstalk environment. The development team is preparing to deploy a major update. The deployment must satisfy the following operational requirements:

* The system must maintain at least its baseline capacity at all times to prevent performance degradation.
* A fast rollback mechanism must be available to restore the previous version within minutes if post-deployment health checks or alarms fail.
* The update must be contained within the existing environment without provisioning a separate, duplicate Elastic Beanstalk environment or performing a CNAME swap.

Which TWO of the following deployment strategies should the developer select to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Immutable deployment; Traffic splitting deployment

Answer

Immutable deployment and Traffic splitting deployment are the correct strategies.
Immutable deployment and Traffic splitting deployment both launch a temporary Auto Scaling group to deploy the new application version alongside the existing instances. This maintains 100%100\% of the baseline capacity during deployment. If the deployment fails (e.g., health checks fail or CloudWatch alarms trigger), Elastic Beanstalk can perform a fast rollback by immediately terminating the temporary instances and routing all traffic back to the original instances, without requiring external DNS changes or CNAME swaps.

Step-by-Step Solution

1
Analyze the capacity requirement.
Since baseline capacity must be maintained at 100%100\% at all times, strategies like Rolling and All-at-once, which take existing instances out of service, are eliminated.
This leaves Immutable, Traffic splitting, Rolling with additional batch, and Blue/green as candidates.
2
Analyze the environment boundary constraint.
The requirement states that the update must be contained within the existing environment without a CNAME swap.
This eliminates Blue/green deployment, which requires creating a separate Elastic Beanstalk environment and performing a CNAME swap.
3
Analyze the rollback speed requirement.
Rolling with additional batch requires a full redeployment of the previous version to rollback, which is slow. Immutable and Traffic splitting deploy to a temporary Auto Scaling group, enabling rapid rollback by terminating the new instances and reverting routing.
This identifies Immutable and Traffic splitting as the only two strategies that meet all requirements.

Key Concept

AWS Elastic Beanstalk Deployment Strategies
Question 300Question →

An application team is deploying a containerized API to Amazon ECS using the AWS Fargate launch type. The application code needs to retrieve operational parameters from Amazon DynamoDB during runtime. Additionally, the ECS agent must retrieve database credentials from AWS Secrets Manager to configure the application's environment variables before the container starts. Which configuration will allow the application to start and run successfully with the least privilege?

Show answer & explanation

Answer: Configure the ECS Task Role with permissions for dynamodb:GetItem and the ECS Task Execution Role with permissions for secretsmanager:GetSecretValue, and configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.

Answer

Configure the ECS Task Role with permissions for dynamodb:GetItem, the ECS Task Execution Role with permissions for secretsmanager:GetSecretValue, and configure both roles to trust the ecs-tasks.amazonaws.com service principal.
The correct configuration assigns DynamoDB permissions to the ECS Task Role and Secrets Manager permissions to the ECS Task Execution Role, while setting the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal. This separates responsibilities: the Task Execution Role allows the ECS agent to prepare the container environment (including resolving environment variables from Secrets Manager), while the Task Role gives the running containerized application the temporary AWS credentials it needs to perform DynamoDB API operations.

Step-by-Step Solution

1
Identify the role needed for application code runtime permissions.
The ECS Task Role is selected for DynamoDB operations.
The application code runs inside the container and requires access to DynamoDB during its execution lifecycle.
2
Identify the role needed for container agent startup and configuration permissions.
The ECS Task Execution Role is selected to fetch secrets from AWS Secrets Manager.
The ECS container agent runs outside the user container and must retrieve credentials to expose them as environment variables before the container starts.
3
Verify the correct IAM trust policy service principal.
Set the trust policy service principal to ecs-tasks.amazonaws.com for both roles.
ECS tasks require the task-specific service principal to assume the execution and task roles, rather than the core ECS service principal.

Key Concept

Amazon ECS IAM Roles Separation (Task Role vs Task Execution Role)
PreviousPage 15 / 19Next
Deployment Practice Questions — AWS Certified Developer - Associate — Page 15 | Examkin