Deployment

376 questions

All types376 Multiple choice191 Multiple select171 Ordering14

An engineer is setting up a build process in AWS CodeBuild for a repository where the build specification file is named buildspec.yml and is located inside a directory named config/ instead of the root directory. The build fails during the initial phase because the buildspec file cannot be found. How can the engineer configure CodeBuild to successfully locate and use this buildspec file?

Leave the file in the config/ directory without changing the project configuration, as CodeBuild automatically performs a recursive search of the repository for any file named buildspec.yml.

Update the buildspec path in the AWS CodeBuild project configuration to point to config/buildspec.yml.

Modify the trust policy of the CodeBuild service role to allow the Amazon S3 service principal to assume the role, which enables directory traversal permissions.

Store the buildspec contents in Systems Manager Parameter Store and configure the project to pull it using Secrets Manager integration syntax.

Show answer & explanation

Answer: Update the buildspec path in the AWS CodeBuild project configuration to point to config/buildspec.yml.

Answer

Update the buildspec path in the AWS CodeBuild project configuration to point to config/buildspec.yml.

The correct action is to update the buildspec path in the AWS CodeBuild project settings to point to the actual subdirectory path. AWS CodeBuild allows developers to override the default root location by specifying a custom file path relative to the root of the repository.

Step-by-Step Solution

Identify the default behavior of AWS CodeBuild regarding the buildspec file.

CodeBuild expects the buildspec.yml file to be located at the root of the source directory by default.

To understand why the build is failing when the file is in the config/ directory.

Determine how to override the default buildspec path in CodeBuild.

The project configuration allows defining a custom path relative to the root directory, such as config/buildspec.yml.

To tell CodeBuild where to look for the configuration file during the build initialization phase.

Update the CodeBuild project settings using the AWS Console, AWS CLI, or AWS CloudFormation.

The build specification is resolved successfully and the build starts.

To apply the configuration changes and fix the failing build.

Key Concept

Custom Buildspec File Paths

Question 302Question →

A developer is deploying a three-tier web application using an AWS CloudFormation template. The template defines an Amazon RDS DB instance that requires database credentials. The company's security policy requires that database passwords must be stored securely, rotated every 30 days, and retrieved dynamically during stack operations. Additionally, the developer must ensure that any failed stack updates automatically revert to the last stable state without leaving orphaned resources or requiring manual intervention. Which two actions should the developer take to meet these security and deployment requirements? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format.

Rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.

Store the database password in Systems Manager Parameter Store as a standard String parameter and use the Ref intrinsic function to retrieve the password.

If a stack update fails and enters the UPDATE_ROLLBACK_FAILED state, immediately execute another update stack command with a corrected template to clear the status.

Manually delete the resources that failed to update using the AWS Management Console to force the stack to bypass the rollback phase.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format.; Rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.

Answer

Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format, and rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.

Storing database credentials in AWS Secrets Manager and referencing them using dynamic references satisfies the credential security and 30-day rotation policy while keeping passwords out of plaintext template properties. Relying on default CloudFormation update rollbacks ensures that stack updates that fail revert all affected resources back to their original stable configurations automatically.

Step-by-Step Solution

Select AWS Secrets Manager as the secure vault for credentials.

The database password is created and stored in AWS Secrets Manager, allowing automatic 30-day rotation configurations.

Parameter Store does not support automatic rotation natively, making Secrets Manager the compliant choice for rotated secrets.

Integrate the secret reference into the CloudFormation template using dynamic references.

CloudFormation retrieves the password dynamically at runtime during stack operations without exposing the password in template files.

Dynamic references are resolved only during resource provisioning and keep plaintext passwords out of templates and outputs.

Determine the automatic rollback strategy on deployment failure.

The rollback mechanism reverts stack resources back to their pre-update state, returning the stack to UPDATE_ROLLBACK_COMPLETE on failure.

This behavior prevents orphan resources and returns the infrastructure configuration to the last known stable state.

Key Concept

AWS CloudFormation deployment lifecycle controls stack update rollbacks and integrates with AWS Secrets Manager via dynamic references to handle rotated secrets securely.

Estimated Time:2m 0s

Question 303Question →

A company runs a containerized web application on Amazon ECS using the AWS Fargate launch type. The ECS service is configured with a desired count of $8$ tasks. Due to strict budget constraints, the developer cannot allocate any additional Fargate tasks or capacity during a deployment. However, the application must remain online, maintaining at least $50\%$ of its desired processing capacity throughout the update process.

Which two deployment configuration values should the developer specify in the ECS service definition to meet these requirements?

Select all that apply

`minimumHealthyPercent` set to

50

`maximumPercent` set to

100

`maximumPercent` set to

150

`minimumHealthyPercent` set to

100

`minimumHealthyPercent` set to

0

Show answer & explanation

Answer: `minimumHealthyPercent` set to $50$ ; `maximumPercent` set to $100$

Answer

Setting the minimum healthy percent to

50

and the maximum percent to

100

Specifying a `maximumPercent` of

100

and a `minimumHealthyPercent` of

50

satisfies all constraints. Setting `maximumPercent` to

100

ensures that Amazon ECS does not provision any extra Fargate tasks beyond the desired count during the deployment, adhering to the strict budget limits. Setting `minimumHealthyPercent` to

50

ensures that at least half of the tasks (

4

out of

8

) remain running and healthy during the update, maintaining the required processing capacity online.

Step-by-Step Solution

Analyze the capacity and resource constraint.

The constraint states that no additional tasks or capacity can be allocated during the deployment. Therefore, the maximum number of concurrent running or pending tasks must be capped exactly at the desired count, which is

100\%

. This determines that `maximumPercent` must be

100

Setting `maximumPercent` to

100

prevents Amazon ECS from scaling up and provisioning extra Fargate tasks during the update.

Analyze the availability constraint.

The application must maintain at least

50\%

of its processing capacity online at all times. Since the desired count is

8

tasks, at least

4

tasks must remain running and healthy. This determines that `minimumHealthyPercent` must be

50

Setting `minimumHealthyPercent` to

50

guarantees that Amazon ECS will only stop up to

4

tasks at a time, keeping the remaining

4

active to handle incoming traffic.

Key Concept

Amazon ECS Rolling Updates Configuration

Question 304Question →

A developer is configuring an AWS CodeBuild project to build a Docker image and push it to an Amazon Elastic Container Registry (ECR) repository. The CodeBuild project is configured to run inside a private VPC subnet to access internal databases. During the build execution, CodeBuild fails to pull the public base image from Docker Hub and fails to authenticate with the Amazon ECR repository. Which TWO actions should the developer take to resolve these issues?

Select all that apply

Configure a NAT Gateway in a public subnet of the VPC, and update the route table of the CodeBuild private subnet to route outbound traffic through the NAT Gateway.

Add the ecr:GetAuthorizationToken permission and repository permissions (such as ecr:BatchCheckLayerAvailability and ecr:PutImage) to the IAM service role associated with the CodeBuild project.

Store the registry login credentials in Systems Manager Parameter Store and reference them in the secrets-manager section of the env block in the buildspec file.

Modify the trust policy of the Amazon ECR repository to allow the CodeBuild service principal to directly write to the registry.

Place the buildspec.yml file in a subdirectory named docker/ within the source repository to allow the Docker daemon to locate the build instructions.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and update the route table of the CodeBuild private subnet to route outbound traffic through the NAT Gateway.; Add the ecr:GetAuthorizationToken permission and repository permissions (such as ecr:BatchCheckLayerAvailability and ecr:PutImage) to the IAM service role associated with the CodeBuild project.

Answer

The developer should configure a NAT Gateway to allow internet access for CodeBuild's private subnet, and attach the required ECR permissions to the CodeBuild service role.

Routing outbound traffic through a NAT Gateway enables the CodeBuild container inside the private subnet to connect to the public Docker Hub registry. Additionally, attaching ECR permissions to the service role allows the build container to authenticate and push the compiled Docker image to Amazon ECR.

Step-by-Step Solution

Analyze the network route for pulling external dependencies.

CodeBuild requires internet access to pull base images from public Docker Hub. Since CodeBuild is running in a private VPC subnet, a NAT Gateway must be configured in a public subnet to forward this outbound traffic.

Resolves the connection failure when attempting to pull the public base image.

Analyze IAM role permissions for ECR authentication and upload.

The CodeBuild project's service role needs permission to fetch an authorization token from ECR (ecr:GetAuthorizationToken) and perform repository write actions.

Resolves the authentication and push authorization failures when interacting with Amazon ECR.

Key Concept

AWS CodeBuild VPC routing and ECR IAM permissions

Question 305Question →

A developer is configuring a new AWS CodeBuild project to build and package a serverless application. When attempting to start a build, the execution fails immediately with the error message: "Failed to assume the service role." The developer confirms that the associated IAM service role has the correct managed policies for accessing Amazon S3, Amazon CloudWatch Logs, and VPC resources. What should the developer modify to resolve this issue and allow the build to initiate?

The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.

The identity-based permissions policy of the IAM service role, adding a statement that grants the sts:AssumeRole action to the codebuild.amazonaws.com principal.

The location of the buildspec.yml file, moving it to a configuration subdirectory and updating the buildspec path in the CodeBuild project configuration.

The build project's environment variables, dynamically fetching the temporary session credentials of the IAM service role from AWS Systems Manager Parameter Store during the install phase.

Show answer & explanation

Answer: The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.

Answer

The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.

The correct option is the one specifying the trust relationship of the IAM service role. For AWS CodeBuild to execute a build, it must assume the specified IAM service role. This trust relationship must be defined in the role's trust policy, permitting the 'codebuild.amazonaws.com' service principal to call 'sts:AssumeRole'.

Step-by-Step Solution

Analyze the error message "Failed to assume the service role."

Identify that the issue is an authorization failure preventing CodeBuild from assuming the assigned IAM role at build start.

This isolates the issue to the trust boundary between the AWS CodeBuild service and the IAM service role.

Differentiate between IAM permissions policies and IAM trust policies.

Determine that while permissions policies govern what the role can do after it is assumed, the trust policy (trust relationship) governs which entities are permitted to assume the role.

This explains why verifying the attached managed policies did not solve the startup failure.

Configure the trust relationship to trust CodeBuild.

Add codebuild.amazonaws.com as a trusted service principal with the sts:AssumeRole action.

This allows CodeBuild to successfully assume the role and execute the container environment.

Key Concept

AWS CodeBuild Service Role Trust Policy

Question 306Question →

A developer is updating a serverless API backend running on AWS Lambda. The deployment must minimize user-facing impact by routing $10\%$ of the incoming traffic to the new Lambda version for a test window of $10$ minutes, while monitoring a CloudWatch alarm. If the alarm remains green, the remaining $90\%$ of traffic must shift to the new version immediately. If the alarm is triggered, the deployment must revert to the original version. Which AWS CodeDeploy configuration meets these requirements?

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

CodeDeployDefault.LambdaCanary10Percent10Minutes

CodeDeployDefault.LambdaCanary10Percent15Minutes

CodeDeployDefault.LambdaAllAtOnce

Show answer & explanation

Answer: CodeDeployDefault.LambdaCanary10Percent10Minutes

Answer

CodeDeployDefault.LambdaCanary10Percent10Minutes

The configuration CodeDeployDefault.LambdaCanary10Percent10Minutes routes 10% of traffic to the new Lambda version, waits 10 minutes, and then immediately routes the remaining 90% if no alarms are triggered. This perfectly aligns with the requirement for a 10-minute test window at 10% traffic followed by an immediate shift of the remaining traffic.

Step-by-Step Solution

Analyze the traffic shifting requirement

The deployment requires routing 10% of traffic initially, waiting for a specific test duration, and then routing the remaining 90% immediately.

This behavior corresponds to a Canary deployment strategy rather than a Linear or All-At-Once deployment strategy.

Identify the required test window duration

The test window duration is specified as 10 minutes.

This requires a configuration that specifies a 10-minute wait time.

Select the matching pre-defined AWS CodeDeploy configuration

The configuration CodeDeployDefault.LambdaCanary10Percent10Minutes meets both the 10% initial shift and 10-minute duration criteria.

CodeDeployDefault.LambdaCanary10Percent10Minutes routes 10% of traffic first and shifts the remaining 90% after 10 minutes if health checks pass.

Key Concept

AWS CodeDeploy Canary vs Linear configurations for serverless deployments

Estimated Time:1m 30s

Question 307Question →

A developer is setting up an AWS CodeBuild project for a microservice located in a subdirectory (`services/order-service`) of a monorepo. The build process needs to run tests that require a database password stored in AWS Secrets Manager, and it must use a custom build specification file located at `services/order-service/buildspec.yml`. During the initial build run, the build fails immediately because the build specification file cannot be found, and the developer realizes that the application also lacks permission to fetch the database password.

Which combination of actions must the developer take to resolve these issues? (Select two.)

Select all that apply

Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml.

Add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

Move the buildspec file to the root of the repository and rename it to buildspec-order.yml without updating the project settings.

Update the trust policy of the CodeBuild service role to allow the Secrets Manager service (secretsmanager.amazonaws.com) to assume the role.

Retrieve the database password in the buildspec env block using the parameter-store reference type.

Show answer & explanation

Answer: Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml.; Add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

Answer

Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml, and add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

To fix the buildspec resolution issue, the developer must update the CodeBuild project settings to specify the custom path services/order-service/buildspec.yml, since CodeBuild expects buildspec.yml in the repository root by default. To resolve the permission issue, the developer must add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project so that it is authorized to retrieve the database credentials.

Step-by-Step Solution

Configure the CodeBuild project settings with the custom buildspec location.

CodeBuild searches for the buildspec at services/order-service/buildspec.yml instead of the default root path, successfully finding and executing it.

By default, CodeBuild expects the buildspec file to be named buildspec.yml and located in the root of the repository source directory. Any other configuration must be specified in the project settings.

Update the IAM service role permissions policy for the CodeBuild project.

The project gains permission to fetch the secret from Secrets Manager.

CodeBuild assumes a service role during execution. This role must have an identity-based policy allowing secretsmanager:GetSecretValue in order to read the credentials.

Key Concept

AWS CodeBuild buildspec configuration and IAM service role permissions.

Question 308Question →

A development team manages their application infrastructure using an AWS CloudFormation stack. A developer needs to update the stack to change the instance type of an Amazon EC2 instance. However, drift detection reveals that the security group attached to the EC2 instance was manually modified out-of-band in the AWS Management Console to allow traffic on port $8080$ . In addition, the developer needs to reference a database password that must be automatically rotated.

Which combination of steps should the developer take to resolve the drift and retrieve the password securely and cost-effectively? (Select TWO.)

Select all that apply

Update the CloudFormation template to match the drifted security group configuration (allowing port

8080

) before proceeding with the stack update.

Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Perform the stack update with the drift synchronization option enabled to automatically rewrite the CloudFormation template based on the live resource configuration.

Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Systems Manager Parameter Store.

Initiate a stack update rollback using the AWS Command Line Interface (AWS CLI) to revert the drifted security group rules to their template-defined values.

Show answer & explanation

Answer: Update the CloudFormation template to match the drifted security group configuration (allowing port $8080$ ) before proceeding with the stack update.; Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Answer

Update the CloudFormation template to match the drifted security group configuration before proceeding with the stack update, and use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

To resolve the configuration drift where port

8080

was manually allowed, the developer must update the template to match this state before performing subsequent updates. Additionally, retrieving an automatically rotated database credential is best achieved by storing the credential in AWS Secrets Manager and accessing it using a dynamic reference in the template.

Step-by-Step Solution

Analyze the drift detection results for the security group resource.

Identify that port

8080

was manually allowed out-of-band.

Before performing stack updates, drift must be resolved to prevent update failures or configuration overwrites.

Modify the CloudFormation template to include the port

8080

configuration in the security group resource definition.

The template now matches the live resource configuration.

This aligns the template with the drifted state, resolving the drift status.

Implement a dynamic reference using the Secrets Manager resolver pattern in the template to access the database password.

The template references the secret securely without hardcoding it.

Secrets Manager provides native support for automated credential rotation, unlike Systems Manager Parameter Store.

Key Concept

CloudFormation drift resolution and dynamic references for rotated secrets

Question 309Question →

A developer is configuring a build project in AWS CodeBuild to package an application. The build process requires retrieving a non-sensitive database port number that rarely changes, and a database password that must be automatically rotated every 30 days. To optimize for cost, operational efficiency, and security, which configuration should the developer implement?

Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.

Store both the database port and the database password in AWS Secrets Manager, and retrieve them using the secrets-manager block under the env section of the buildspec.yml file.

Store both the database port and the database password in AWS Systems Manager Parameter Store, and retrieve them using the parameter-store block under the env section of the buildspec.yml file.

Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and add the required read permissions to the trust relationship policy document of the AWS CodeBuild service role.

Show answer & explanation

Answer: Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.

Answer

Storing the port in Parameter Store is cost-effective because standard parameters are free. Storing the password in Secrets Manager meets the security requirement for automatic rotation. Referencing them in the parameter-store and secrets-manager blocks of the env section in the root buildspec.yml file allows CodeBuild to automatically fetch the values and inject them as environment variables during the build execution.

Step-by-Step Solution

Identify the security and operational requirements of the two variables.

The database port is non-sensitive and static, while the database password is sensitive and requires automatic rotation every 30 days.

This classification determines the most cost-effective and secure AWS service to store each parameter.

Select the appropriate storage service for each parameter type.

AWS Systems Manager Parameter Store is chosen for the database port to avoid costs. AWS Secrets Manager is chosen for the database password to support automatic rotation.

Parameter Store does not natively support rotation of secrets, while Secrets Manager is expensive for non-sensitive parameters.

Configure the retrieval mechanism in the build specification.

Reference the variables under their respective blocks (parameter-store and secrets-manager) in the env section of the root buildspec.yml file.

AWS CodeBuild natively supports retrieving values from both services during the build lifecycle when configured in the buildspec.

Key Concept

Retrieving configuration data and secrets in AWS CodeBuild using AWS Systems Manager Parameter Store and AWS Secrets Manager

Estimated Time:1m 30s

Question 310Question →

A developer is creating an AWS CloudFormation template to deploy a web application. The application requires access to two configuration values:

1. A database connection password that must support automatic rotation every 30 days.
2. A public API endpoint URL for a third-party service that is non-sensitive and updated infrequently.

To follow security best practices and optimize costs, how should the developer store and reference these values in the CloudFormation template?

Store both the database password and the API endpoint URL in AWS Secrets Manager, and reference both using Secrets Manager dynamic references.

Store both the database password and the API endpoint URL in AWS Systems Manager Parameter Store as SecureString parameters, and reference both using Parameter Store dynamic references.

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Hardcode both the database password and the API endpoint URL as default values in the template's Parameters section, and update them manually in the AWS Console after deployment.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Answer

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference, and store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Storing the database password in AWS Secrets Manager and referencing it via a dynamic reference satisfies the security and automatic rotation requirements. Storing the non-sensitive public API endpoint URL in Systems Manager Parameter Store standard parameters satisfies the cost-efficiency constraint because Parameter Store standard parameters are free, and using a dynamic reference allows secure integration without exposure.

Step-by-Step Solution

Determine the storage requirements for the database password.

The password requires automatic rotation every 30 days, which points to AWS Secrets Manager as the appropriate service because it integrates with AWS Lambda for automated credential rotation.

Systems Manager Parameter Store does not offer native automatic rotation for secrets.

Determine the storage requirements for the non-sensitive public API endpoint.

The endpoint URL is non-sensitive and updated infrequently, making Systems Manager Parameter Store standard parameters the most cost-effective choice since they are free.

Using Secrets Manager for non-sensitive data incurs unnecessary monthly costs.

Identify the proper CloudFormation integration method.

Use dynamic references to resolve the values dynamically at runtime (e.g., {{resolve:secretsmanager:...}} and {{resolve:ssm:...}}).

Dynamic references allow CloudFormation to securely retrieve external values during deployment without hardcoding them in the template.

Key Concept

Selecting and referencing the appropriate parameter store or secrets service in CloudFormation based on security, rotation, and cost requirements.

Estimated Time:1m 30s

Question 311Question →

A developer needs to deploy a new version of an application to an active AWS Elastic Beanstalk environment. The application must maintain 100% of its instance capacity to handle traffic during the deployment process. The deployment must be completed within the existing environment without creating a second, separate Elastic Beanstalk environment. Which two deployment strategies will meet these requirements? (Select two.)

Select all that apply

Rolling with additional batch

Immutable

Rolling

All at once

Blue/Green (Environment Swap)

Show answer & explanation

Answer: Rolling with additional batch; Immutable

Answer

The correct strategies are 'Rolling with additional batch' and 'Immutable' because they both maintain full capacity throughout the deployment process and run entirely within the existing Elastic Beanstalk environment.

The correct strategies are the 'Rolling with additional batch' and 'Immutable' deployment strategies. The 'Rolling with additional batch' strategy launches a temporary batch of instances first, ensuring that the environment's capacity never drops below 100% during the rolling update. The 'Immutable' strategy launches a full set of new instances in a temporary Auto Scaling group, ensuring full capacity is maintained, and performs a clean switchover within the existing environment once health checks pass.

Step-by-Step Solution

Analyze the capacity requirement

The application must maintain 100% capacity. This rules out standard 'Rolling' (which reduces capacity by the batch size) and 'All at once' (which takes all instances offline).

Determining which deployment strategies preserve capacity.

Analyze the environment boundary constraint

The deployment must occur within the existing environment. This rules out 'Blue/Green (Environment Swap)' because it requires provisioning a new, separate Elastic Beanstalk environment.

Filtering out strategies that require multiple environments.

Identify matching strategies

'Rolling with additional batch' and 'Immutable' both run in the existing environment, provision temporary instances to maintain 100% capacity, and clean up the extra instances afterward.

Selecting the remaining compliant strategies.

Key Concept

Elastic Beanstalk deployment policies balance cost, deployment speed, capacity, and environmental overhead.

Estimated Time:1m 30s

Question 312Question →

A developer is configuring an AWS CodeBuild project that runs as a stage in an AWS CodePipeline. During the build execution, a script generates a dynamic version identifier based on the current git commit hash. The developer needs to pass this dynamically generated version identifier directly to a subsequent deployment stage in the pipeline without creating external dependencies. Which configuration in the `buildspec.yml` file will achieve this?

Define the variable name under the `exported-variables` sequence in the `env` block.

Define the variable under the `variables` mapping in the `env` block.

Write the version identifier to a temporary text file and declare it under the `files` sequence in the `artifacts` block.

Store the version identifier in AWS Systems Manager Parameter Store during the `post_build` phase and retrieve it in the deployment stage.

Show answer & explanation

Answer: Define the variable name under the `exported-variables` sequence in the `env` block.

Answer

Define the variable name under the `exported-variables` sequence in the `env` block.

Defining the variable name under the `exported-variables` sequence in the `env` block allows CodeBuild to export the value of environment variables that are dynamically set during the build execution. AWS CodePipeline captures these exported variables and makes them available to downstream pipeline actions as variables.

Step-by-Step Solution

Add the desired environment variable name to the `exported-variables` sequence under the `env` block in `buildspec.yml`.

CodeBuild is configured to monitor and capture this specific environment variable's value at the end of the build execution.

This registers the variable name so CodeBuild knows to export it.

Assign the dynamic commit-based value to the environment variable inside one of the build commands, such as using `export MY_VERSION=$(git rev-parse --short HEAD)`.

The variable is populated with the dynamically generated value during the build execution.

This updates the environment variable's value dynamically during runtime.

Reference the exported variable in downstream CodePipeline actions using the namespace syntax.

The subsequent stages in AWS CodePipeline can access the version identifier natively.

This completes the transfer of the dynamic variable across the pipeline without external API calls or storage.

Key Concept

AWS CodeBuild Exported Variables

Question 313Question →

A developer needs to update a web application running on an AWS Elastic Beanstalk environment. The update must be performed with zero downtime. Due to strict budget constraints, the environment must not provision any additional Amazon EC2 instances during the deployment process. The development team is willing to accept a temporary reduction in application capacity while the update is in progress. Which deployment strategy should the developer configure?

Rolling

All-at-once

Rolling with additional batch

Immutable

Show answer & explanation

Answer: Rolling

Answer

Rolling

The Rolling deployment strategy updates instances in-place in batches. Because it uses the existing instances to perform the update and does not launch additional instances, it complies with the budget constraint. It keeps the remaining instances in service during the batch updates, satisfying the zero-downtime requirement at the expense of a temporary reduction in capacity.

Step-by-Step Solution

Analyze the requirements and constraints in the scenario.

Requirements identified: 1. Zero downtime. 2. No additional EC2 instances allowed due to budget. 3. Temporary capacity reduction is acceptable.

Understanding the constraints is necessary to eliminate unsuitable deployment options.

Evaluate the available AWS Elastic Beanstalk deployment policies against the constraints.

All-at-once causes downtime. Immutable and Rolling with additional batch launch new EC2 instances. Rolling updates existing instances in batches without provisioning extra instances.

To find the strategy that satisfies both zero-downtime and zero additional instance creation.

Select the strategy that meets all constraints.

Rolling is the correct selection as it updates instances in-place in batches, incurring no extra instance costs and maintaining service availability at reduced capacity.

Ensures the selected option fulfills the application requirements.

Key Concept

AWS Elastic Beanstalk deployment policies allow developers to balance application availability, capacity, and cost during updates.

Question 314Question →

A developer is deploying updates to an AWS CloudFormation stack. The update fails due to a configuration error, initiating an automatic rollback. However, the rollback fails because a security group managed by the stack was manually attached to an EC2 instance outside of CloudFormation, placing the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to successfully complete the rollback and return the stack to a stable state. Which action should the developer take to resolve this issue?

Run the drift detection tool on the stack, select the drifted security group, and choose the 'Import drifted resource state' option to force the template to sync with the manual changes.

Modify the CloudFormation template to delete the security group definition, and run a new stack update command with the '--force-update' flag to overwrite the active rollback status.

Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

Create an Amazon EC2 launch template containing the security group, store the launch template ID in AWS Systems Manager Parameter Store as a parameter of type String, and reference it to force-complete the rollback.

Show answer & explanation

Answer: Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

Answer

Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

When a resource deletion blocks a stack rollback, the correct procedure is to use the 'Continue update rollback' operation. This action allows the developer to skip the specific resource that is failing to roll back. CloudFormation will mark that resource's state as skipped and proceed to complete the rollback for the rest of the stack, bringing it back to a stable UPDATE_ROLLBACK_COMPLETE status. Afterward, the developer must manually clean up the skipped resource.

Step-by-Step Solution

Identify the cause of the rollback failure.

Determine that the security group cannot be deleted because it is still in use by an out-of-band EC2 instance.

You must identify which resource is blocking the rollback before deciding on the recovery path.

Use the CloudFormation console or AWS CLI to execute the 'Continue update rollback' action.

Specify the security group in the list of resources to skip during the rollback operation.

Skipping the blocked resource allows CloudFormation to successfully complete the rollback process for all other resources, transitioning the stack to the UPDATE_ROLLBACK_COMPLETE state.

Perform manual remediation of the skipped resource.

Manually detach the security group from the out-of-band EC2 instance and clean up the association.

Since the resource was skipped, it remains in its current state and must be manually aligned with the desired state once the stack is stable.

Key Concept

Resolving UPDATE_ROLLBACK_FAILED states by skipping blocked resources during the Continue Update Rollback operation.

Question 315Question →

A developer is configuring an AWS CodeBuild project to build a containerized application. The build process must retrieve a database credential that undergoes automatic rotation every $30$ days. In addition, the source code repository holds a custom build specification file at the path `build-configs/custom-buildspec.yml` instead of the root directory.

Which two configurations must the developer perform to ensure the build project executes successfully?

Select all that apply

Configure the CodeBuild project settings by specifying `build-configs/custom-buildspec.yml` in the buildspec configuration path.

Store the database credential in AWS Secrets Manager and reference it in the `secrets-manager` section under the `env` sequence in the buildspec file.

Store the database credential as a SecureString parameter in AWS Systems Manager Parameter Store and enable the parameter's native automatic rotation schedule.

Save the build specification file in the `build-configs` directory as `custom-buildspec.yml` and rely on CodeBuild's default file lookup behavior.

Update the trust policy of the CodeBuild service role to allow the Systems Manager service principal (`ssm.amazonaws.com`) to assume the role.

Show answer & explanation

Answer: Configure the CodeBuild project settings by specifying `build-configs/custom-buildspec.yml` in the buildspec configuration path.; Store the database credential in AWS Secrets Manager and reference it in the `secrets-manager` section under the `env` sequence in the buildspec file.

Answer

The developer must configure the CodeBuild project settings to point to the custom buildspec path, and store the database credential in AWS Secrets Manager while referencing it in the buildspec's env section.

To successfully execute this build project, the developer must specify the custom buildspec location (`build-configs/custom-buildspec.yml`) in the CodeBuild project configuration because CodeBuild defaults to looking for a file named `buildspec.yml` in the root directory. Additionally, because the database credential requires automatic rotation, it must be stored in AWS Secrets Manager (which supports rotation) and retrieved in the buildspec file using the `secrets-manager` parameter within the `env` section.

Step-by-Step Solution

Determine the correct storage and retrieval mechanism for a rotated database credential.

Choose AWS Secrets Manager over Systems Manager Parameter Store.

The requirement specifies that the credential undergoes automatic rotation, which is natively supported by AWS Secrets Manager.

Determine the configuration needed to handle the custom buildspec file location.

Explicitly set the buildspec path in the CodeBuild project settings to `build-configs/custom-buildspec.yml`.

By default, CodeBuild looks for a file named `buildspec.yml` at the root of the repository. Any custom path or filename must be declared in the project settings.

Key Concept

Configuring custom buildspec paths in AWS CodeBuild and integrating AWS Secrets Manager for secrets requiring automatic rotation.

Estimated Time:1m 30s

Question 316Question →

A developer is using AWS CodeDeploy to perform an in-place deployment of an application to an EC2 Auto Scaling group containing $4$ running instances. The application must maintain at least $75\%$ of its traffic-serving capacity during the deployment process to handle regular user traffic. The developer also wants to avoid launching any new EC2 instances to minimize additional costs.

Which of the following CodeDeploy configurations will meet these requirements? (Select TWO.)

Select all that apply

The CodeDeployDefault.OneAtATime default deployment configuration

A custom deployment configuration with the minimum healthy hosts parameter set to a host count of

3

The CodeDeployDefault.HalfAtATime default deployment configuration

A custom deployment configuration with the minimum healthy hosts parameter set to a fleet percentage of

25\%

The CodeDeployDefault.AllAtOnce default deployment configuration

Show answer & explanation

Answer: The CodeDeployDefault.OneAtATime default deployment configuration; A custom deployment configuration with the minimum healthy hosts parameter set to a host count of $3$

Answer

The correct configurations are the CodeDeployDefault.OneAtATime default deployment configuration and a custom deployment configuration with the minimum healthy hosts parameter set to a host count of

3

The correct options are the default configuration that updates one host at a time and the custom configuration that specifies a minimum of

3

healthy hosts. With a desired capacity of

4

instances, maintaining

75\%

capacity means at least

3

instances must remain online and healthy during the deployment. The configuration that deploys to one instance at a time will update exactly

1

instance, leaving

3

active (

75\%

). Similarly, setting the custom minimum healthy hosts to a host count of

3

explicitly forces CodeDeploy to maintain

3

healthy instances throughout the process.

Step-by-Step Solution

Calculate the number of healthy instances required to meet the

75\%

capacity threshold.

For a fleet of

4

instances,

75\%

capacity requires at least

3

instances to remain healthy and online (

4 \times 0.75 = 3

To understand the minimum healthy host constraint needed for the deployment configuration.

Analyze the default and custom CodeDeploy configurations against the calculated constraint.

CodeDeployDefault.OneAtATime updates

1

instance at a time, leaving

3

online (

75\%

). A custom configuration with minimum healthy hosts set to a host count of

3

explicitly guarantees

3

online instances.

To identify which specific configurations satisfy the target constraint of keeping at least

3

instances healthy.

Key Concept

AWS CodeDeploy deployment configurations and minimum healthy hosts settings for EC2 deployments

Question 317Question →

An organization is setting up a continuous integration pipeline. The build phase is executed by AWS CodeBuild using a custom IAM service role. However, during the initial run, the build fails immediately before executing any build phases, throwing an error that CodeBuild is not authorized to assume the specified service role. Which of the following actions will resolve this issue?

Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.

Attach a permission policy to the IAM service role that grants the sts:AssumeRole permission to the developer's IAM user.

Move the buildspec.yml file from the root directory to a newly created configuration subdirectory in the source repository.

Modify the build project settings to retrieve credentials using AWS Secrets Manager rather than Systems Manager Parameter Store.

Show answer & explanation

Answer: Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.

Answer

Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.

The correct answer is to modify the trust policy of the IAM service role. AWS CodeBuild requires a service role to perform actions on your behalf. For CodeBuild to assume this role, the role's trust policy must explicitly allow the 'codebuild.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. Without this trust relationship, CodeBuild cannot run the build project and fails immediately during initialization.

Step-by-Step Solution

Identify the service principal for AWS CodeBuild.

The service principal is codebuild.amazonaws.com.

AWS services require trust relationships defined by their specific service principal to assume IAM roles.

Locate the trust policy of the CodeBuild service role in the IAM console.

The trust policy is found under the 'Trust relationships' tab of the role.

The trust policy determines which entities are trusted to assume the role.

Update the trust policy document to include the service principal with sts:AssumeRole permission.

CodeBuild is now authorized to assume the role, and the build starts successfully.

Allowing the service principal in the trust policy resolves the authorization failure during CodeBuild initialization.

Key Concept

AWS CodeBuild service role trust policy configuration

Question 318Question →

An application deployed via an AWS CloudFormation stack requires a database password that must be rotated automatically every 30 days. Additionally, operators occasionally make direct manual changes to the security group rules associated with the stack, which causes drift between the physical resources and the template definition. Which two actions should the developer take to manage these requirements?

Select all that apply

Store the password in AWS Secrets Manager, enable automatic rotation, and reference the password in the CloudFormation template using a dynamic reference.

Use AWS CloudFormation drift detection to identify manual modifications, and then update the template or resource properties to align with the actual state.

Store the password in AWS Systems Manager Parameter Store as a SecureString parameter, and configure automatic rotation directly in the Parameter Store console.

Perform the stack update with the AWS CLI using the --ignore-drift parameter to allow CloudFormation to overwrite any manual resource modifications.

Run the AWS CLI command aws cloudformation rollback-stack when a stack update fails to automatically overwrite the out-of-band changes.

Show answer & explanation

Answer: Store the password in AWS Secrets Manager, enable automatic rotation, and reference the password in the CloudFormation template using a dynamic reference.; Use AWS CloudFormation drift detection to identify manual modifications, and then update the template or resource properties to align with the actual state.

Answer

To securely manage the password and handle out-of-band configuration changes, the developer should store the password in AWS Secrets Manager with automatic rotation enabled and reference it in the CloudFormation template using dynamic references. In addition, the developer should use AWS CloudFormation drift detection to identify manual modifications and update the template or resource properties to align them.

The correct approach involves using AWS Secrets Manager to store the database password with automatic rotation and reference it securely in CloudFormation using dynamic references. Additionally, using CloudFormation drift detection helps developers identify out-of-band modifications to resources and synchronize the stack configuration, avoiding deployment failures.

Step-by-Step Solution

Determine the storage and rotation method for the password.

AWS Secrets Manager is selected because it supports automatic rotation natively, unlike Systems Manager Parameter Store.

Satisfies the security requirement for automatic 30-day rotation.

Reference the stored password in the CloudFormation template.

Use dynamic references to retrieve the password from Secrets Manager at deployment time.

Avoids hardcoding sensitive passwords in the CloudFormation template.

Resolve resource drift caused by manual changes.

Run drift detection on the stack to identify differences, and update the template or import the actual resources to align them.

Prevents future stack updates from failing due to conflicts with manual modifications.

Key Concept

AWS CloudFormation Drift Detection and AWS Secrets Manager Dynamic References

Question 319Question →

A developer is setting up a blue/green deployment for a containerized application running on Amazon ECS using AWS CodeDeploy. The deployment must route $10\%$ of the production traffic to the new version of the application immediately. The remaining $90\%$ of the traffic must be routed to the new version only after a $15$ -minute validation period, during which the application's health is monitored. If any errors occur during this period, CodeDeploy must automatically roll back the deployment.

Which pre-defined CodeDeploy deployment configuration should the developer use to meet these requirements?

CodeDeployDefault.ECSCanary10Percent15Minutes

CodeDeployDefault.ECSCanary10Percent5Minutes

CodeDeployDefault.ECSLinear10PercentEvery15Minutes

CodeDeployDefault.LambdaCanary10Percent15Minutes

Show answer & explanation

Answer: CodeDeployDefault.ECSCanary10Percent15Minutes

Answer

CodeDeployDefault.ECSCanary10Percent15Minutes

The configuration CodeDeployDefault.ECSCanary10Percent15Minutes is correct because it is a pre-defined CodeDeploy deployment configuration designed for Amazon ECS. It shifts

10\%

of traffic to the replacement task set immediately, waits for

15

minutes for validation and monitoring, and then routes the remaining

90\%

of traffic to the new version.

Step-by-Step Solution

Identify the target compute platform.

The application runs on Amazon ECS, so the configuration name must begin with CodeDeployDefault.ECS.

CodeDeploy has separate pre-defined configurations for ECS, Lambda, and EC2/On-Premises.

Determine the traffic shifting pattern.

The requirement is to shift a small portion (

10\%

) and then the rest after a delay, which corresponds to a Canary deployment pattern.

Linear configurations shift traffic in equal increments at regular intervals, whereas Canary configurations shift an initial percentage, wait for a specified time, and then shift all remaining traffic.

Match the specified percentage and time interval parameters.

The parameters are

10\%

traffic shifted immediately and a

15

-minute wait time, which matches CodeDeployDefault.ECSCanary10Percent15Minutes.

This is a standard pre-defined deployment configuration provided by AWS CodeDeploy for ECS.

Key Concept

AWS CodeDeploy deployment configurations for ECS Blue/Green deployments control how traffic is shifted from the old task set to the new task set, allowing canary testing with built-in validation periods.

Question 320Question →

A developer deployed an Amazon EC2 instance and an associated security group using an AWS CloudFormation stack. Later, a network administrator manually added an inbound rule allowing TCP port 3389 (RDP) directly via the Amazon VPC Console to troubleshoot a connection issue. The developer runs drift detection on the stack and confirms that the security group is in a drifted state. The developer wants to restore the security group to the exact configuration defined in the CloudFormation template. Which of the following is the correct method to resolve this drift?

Perform a stack update using the original CloudFormation template to force CloudFormation to overwrite the out-of-band changes and remove the RDP rule.

Initiate a stack rollback to the previous successful stack status to automatically revert the out-of-band security group changes.

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Store the security group configuration in Systems Manager Parameter Store and enable automatic rotation to overwrite any out-of-band changes.

Show answer & explanation

Answer: Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Answer

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Manually removing the out-of-band RDP rule is the correct way to resolve the drift. When a resource is modified out-of-band, CloudFormation drift detection flags the difference but does not automatically remediate it. To resolve the drift without changing the template, the resource must be manually modified to align back with the template definition.

Step-by-Step Solution

Analyze the source of the configuration drift.

Identify that the security group has an extra inbound RDP rule added manually.

To determine how the live resource differs from the CloudFormation template definition.

Evaluate whether a standard stack update using the original template can remediate the drift.

Determine that running an update with the same template does not overwrite manual changes because CloudFormation checks template differences, not live resource differences.

To rule out stack updates as an automatic remediation tool for unmodified templates.

Manually remove the unauthorized inbound RDP rule.

The security group configuration matches the CloudFormation template, resolving the drift.

To successfully restore the stack's resources to their expected template-defined state.

Key Concept

AWS CloudFormation Drift Detection and Remediation

PreviousPage 16 / 19Next

Deployment

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept