Examkin

Deployment

376 questions

All types376Multiple choice191Multiple select171Ordering14
Question 321Question →

A developer is writing an AWS CloudFormation template to deploy an Amazon EC2 instance that runs a web server. The developer wants to ensure that the EC2 instance is not marked as CREATE_COMPLETE until the web server application package is successfully installed and the service is started. If the installation fails or does not complete within 15 minutes, the stack creation should fail and rollback. Which TWO actions must the developer perform in the CloudFormation template and instance configuration to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Add a CreationPolicy attribute to the EC2 instance resource in the template and set the timeout property to 15 minutes.; Execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.

Answer

To meet the requirements, the developer must add a CreationPolicy attribute to the EC2 instance resource with a timeout of 15 minutes, and execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.
The correct actions are adding a CreationPolicy attribute to the EC2 instance resource in the template and executing the cfn-signal helper script in the instance's UserData. The CreationPolicy tells CloudFormation to wait for a signal before marking the instance as successfully created, and the cfn-signal script transmits that signal from the EC2 instance after setup steps finish.

Step-by-Step Solution

1
Identify the mechanism CloudFormation uses to pause stack creation for resource initialization.
The CreationPolicy attribute is used to block resource completion until a success signal is received.
This prevents the EC2 instance from transitioning to CREATE_COMPLETE immediately after VM provisioning.
2
Determine the tool used inside the EC2 instance to send the initialization status to CloudFormation.
The cfn-signal helper script is executed at the end of the bootstrap script (UserData).
This sends the success or failure signal back to AWS CloudFormation, satisfying the CreationPolicy wait condition.

Key Concept

AWS CloudFormation CreationPolicy and Helper Scripts
Estimated Time:2m 0s
Question 322Question →

A developer is configuring an AWS CodeBuild project to compile and package a Java application. The buildspec.yml file is placed in the root of the source repository and contains a valid artifacts section listing the target JAR file. The build execution completes with a status of SUCCEEDED, but no artifacts are uploaded to the destination Amazon S3 bucket. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The artifact type in the CodeBuild project configuration is set to 'No artifacts'.

Answer

The artifact type in the CodeBuild project configuration is set to 'No artifacts'.
The correct answer is correct because AWS CodeBuild requires the artifact output configuration to be enabled in the project configuration (e.g., set to Amazon S3) for it to upload the files specified in the buildspec.yml. When set to 'No artifacts', CodeBuild executes the build successfully but performs no upload actions.

Step-by-Step Solution

1
Analyze the build status and output.
The build status is SUCCEEDED, which means CodeBuild successfully executed all build phases defined in the buildspec.yml without encountering fatal errors.
Understanding the status helps rule out configuration errors that would cause execution failures, such as missing buildspec files or parameter retrieval errors.
2
Evaluate the artifact upload behavior in AWS CodeBuild.
CodeBuild relies on both the buildspec.yml file (which defines which files to upload) and the project configuration (which defines where to upload them).
If the project configuration is set to 'No artifacts', CodeBuild runs the build but does not look for or upload any output files.

Key Concept

AWS CodeBuild project configuration settings for artifacts override buildspec declarations.
Question 323Question →

A developer is deploying a new version of a critical web application to AWS Elastic Beanstalk. The deployment must satisfy the following constraints:

- The application must maintain 100%100\% of its serving capacity throughout the deployment process to handle high user traffic without performance degradation.
- In the event of a deployment failure, the application must support an immediate rollback to the previous version without requiring a rolling update of the older version.
- The development team has approved a temporary increase in resource capacity to allow up to twice the normal instance count during the deployment.

Which deployment strategy will meet these requirements?

Show answer & explanation

Answer: Immutable

Answer

The Immutable deployment strategy satisfies all the constraints by maintaining full capacity during deployment, supporting immediate rollback, and utilizing a temporary doubling of instance resources.
The Immutable deployment strategy deploys the new version to a separate, temporary Auto Scaling group alongside the existing one. This preserves 100%100\% capacity throughout the deployment. If health checks fail, the rollback is immediate because Elastic Beanstalk simply terminates the new Auto Scaling group without affecting the original instances. This strategy temporarily doubles the resource count, which is acceptable under the approved budget increase.

Step-by-Step Solution

1
Analyze the capacity requirement.
The application must maintain 100%100\% capacity during the deployment. This rules out All-at-once (causes downtime) and Rolling (reduces capacity during deployment).
To identify strategies that can sustain the required traffic load without performance degradation.
2
Evaluate the rollback and budget constraints.
The rollback must be immediate and clean. Additionally, a temporary doubling of instance capacity is allowed. This matches the Immutable strategy, which deploys to a temporary Auto Scaling group and can be quickly terminated upon failure. Rolling with additional batch is ruled out because its rollback requires a slow rolling deployment of the older version.
To determine which of the remaining strategies satisfies both the recovery time objective and the resource availability parameters.

Key Concept

Understanding the trade-offs of AWS Elastic Beanstalk deployment strategies, specifically regarding capacity preservation, rollback mechanism, and temporary cost overhead.
Estimated Time:1m 30s
Question 324Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The developer wants to run a validation script to perform smoke tests before production traffic is routed to the new task set. The developer creates the following `appspec.yaml` file:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/my-app:1"
LoadBalancerInfo:
ContainerName: "my-app-container"
ContainerPort: 8080
Hooks:
- BeforeAllowTraffic:
- location: scripts/run-smoke-tests.sh
timeout: 300

During deployment, the CodeDeploy agent fails to parse the AppSpec file. How should the developer modify the AppSpec file to resolve this issue?

Show answer & explanation

Answer: Replace the BeforeAllowTraffic script block with the Amazon Resource Name (ARN) of an AWS Lambda function that executes the validation logic.

Answer

Replace the BeforeAllowTraffic script block with the Amazon Resource Name (ARN) of an AWS Lambda function that executes the validation logic.
For Amazon ECS deployments, CodeDeploy AppSpec files require the hooks to reference the Amazon Resource Name (ARN) of an AWS Lambda function rather than a local file path. The script execution structure (location, timeout, runas) is only supported for Amazon EC2 and on-premises deployments. Replacing the script block with the Lambda ARN enables CodeDeploy to trigger the validation function properly.

Step-by-Step Solution

1
Analyze the target deployment platform and AppSpec configuration.
The target platform is Amazon ECS, and the AppSpec file defines Resources and Hooks sections.
Different compute platforms (EC2 vs ECS/Lambda) have different AppSpec validation schemas and lifecycle hook requirements.
2
Evaluate the syntax used under the BeforeAllowTraffic hook in the AppSpec file.
The developer specified a local script path ('location: scripts/run-smoke-tests.sh'), which is EC2-specific syntax.
For ECS deployments, CodeDeploy lifecycle hooks must map to an AWS Lambda function ARN rather than a local file path.
3
Select the correction that provides a valid AWS Lambda function ARN for the ECS hook.
Replacing the script block with a Lambda function ARN resolves the parser error.
This complies with the ECS AppSpec specification for Hook definitions.

Key Concept

For Amazon ECS and AWS Lambda deployments in CodeDeploy, AppSpec lifecycle hooks can only execute validation tests via AWS Lambda functions specified by their ARNs, not through local shell scripts.
Question 325Question →

A company is updating an infrastructure stack deployed via AWS CloudFormation. The template contains an Amazon DynamoDB table that needs to be modified. The planned modification requires CloudFormation to replace the DynamoDB resource. The developer wants to ensure that the database's existing data is preserved and the resource is not deleted during this replacement, as well as if the stack is deleted in the future. Which configuration should the developer apply to the DynamoDB resource in the template?

Show answer & explanation

Answer: Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.

Answer

Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.
To protect a resource from being deleted during both stack updates (when a change requires resource replacement) and stack deletion, you must specify both the DeletionPolicy and UpdateReplacePolicy attributes and set their values to Retain (or Snapshot if supported). Setting DeletionPolicy only protects the resource when the stack is deleted or the resource is removed from the template, but does not prevent deletion of the old resource during a replacement update. UpdateReplacePolicy specifically controls the behavior when a resource is replaced during a stack update.

Step-by-Step Solution

1
Analyze the resource modification requirements in the AWS CloudFormation template.
Identify that the modification to the Amazon DynamoDB table will trigger a resource replacement during a stack update.
Certain property updates (such as changing a partition key) cannot be applied to an existing DynamoDB table and require CloudFormation to create a new table and delete the old one.
2
Evaluate resource protection attributes for both stack updates and stack deletion.
Determine that DeletionPolicy only protects resources when the stack is deleted or when the resource is removed from the template, while UpdateReplacePolicy protects resources when they are replaced during updates.
Using only DeletionPolicy would result in the deletion of the old DynamoDB table when it is replaced during a stack update.
3
Apply both attributes to the resource definition in the template.
Configure DeletionPolicy: Retain and UpdateReplacePolicy: Retain on the DynamoDB table resource.
This combination ensures the table is preserved (retained in the AWS account) during both resource replacement updates and stack deletion.

Key Concept

Managing resource lifecycle and preserving data during AWS CloudFormation stack updates and deletions using DeletionPolicy and UpdateReplacePolicy.
Question 326Question →

A developer is configuring a blue/green deployment for a containerized application on Amazon ECS using AWS CodeDeploy. The deployment configuration utilizes an Application Load Balancer with two target groups and a test listener. The developer wants to run automated integration tests against the replacement task set via the test listener to validate the new version of the application before shifting any production traffic.

Which AppSpec lifecycle hook should the developer use to run these integration tests?

Show answer & explanation

Answer: AfterAllowTestTraffic

Answer

AfterAllowTestTraffic
The correct answer is the hook named AfterAllowTestTraffic. During an ECS blue/green deployment, AWS CodeDeploy executes hooks in a specific order: BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic. The test listener begins routing traffic to the replacement task set just before AfterAllowTestTraffic runs. This is the only point where the application is reachable via the test listener for validation tests before the production listener is updated to point to the replacement task set.

Step-by-Step Solution

1
Analyze the deployment architecture and requirements.
The target is Amazon ECS using AWS CodeDeploy for blue/green deployment. The requirement is to run automated integration tests against the replacement (new) task set using the test listener before shifting production traffic.
Understanding the target platform and specific validation workflow constraints is essential for selecting the correct lifecycle hook.
2
Map the sequence of AWS CodeDeploy ECS lifecycle hooks.
The ECS lifecycle hooks run in the following order: BeforeInstall -> AfterInstall -> AfterAllowTestTraffic -> BeforeAllowTraffic -> AfterAllowTraffic. The test listener starts routing traffic to the replacement tasks just before the AfterAllowTestTraffic hook runs.
Identifying the execution order of ECS hooks allows us to determine when the replacement tasks are reachable via the test listener.
3
Select the hook that matches the requirement of using the test listener for validation.
The AfterAllowTestTraffic hook is executed after the test listener begins routing traffic to the replacement task set. This allows running tests against the test listener endpoint.
Running tests at any other stage would fail because the replacement task set would not yet be reachable via the test listener.

Key Concept

AWS CodeDeploy ECS Blue/Green Lifecycle Hooks
Question 327Question →

A developer is using AWS Serverless Application Model (SAM) to deploy a database-backed API. The database password is saved as a SecureString in AWS Systems Manager Parameter Store. The developer attempts to reference this password in the SAM template's `Parameters` section as follows:

yaml
Parameters:
DbPassword:
Type: AWS::SSM::Parameter::Value<String>
Default: /prod/db/password

During the `sam deploy` process, AWS CloudFormation returns a validation error indicating that `AWS::SSM::Parameter::Value<String>` cannot reference SSM SecureString parameters.

How should the developer resolve this deployment failure while keeping the database password secure?

Show answer & explanation

Answer: Remove the parameter from the template's `Parameters` section and reference it directly in the function's environment variables using the `{{resolve:ssm-secure:/prod/db/password}}` dynamic reference.

Answer

Remove the parameter from the template's `Parameters` section and reference it directly in the function's environment variables using the `{{resolve:ssm-secure:/prod/db/password}}` dynamic reference.
AWS CloudFormation parameters cannot resolve SSM SecureString parameters when using the `AWS::SSM::Parameter::Value<String>` type. To secure and dynamically retrieve sensitive configuration data from Parameter Store, developers must use dynamic references. By removing the parameter from the template's `Parameters` section and referencing `{{resolve:ssm-secure:/prod/db/password}}` directly within the resource properties (e.g., inside the environment variables of the function), the secure value is retrieved securely at deployment time without validation errors.

Step-by-Step Solution

1
Identify the cause of the CloudFormation deployment validation error.
CloudFormation parameters of type `AWS::SSM::Parameter::Value<String>` do not support SSM SecureString parameters to prevent accidental exposure of secrets.
This is a native limitation of AWS CloudFormation's Parameter Store integration.
2
Replace the static parameter declaration with a dynamic reference in the template.
Remove the parameter definition from the `Parameters` section and instead reference the SecureString using the dynamic reference format: `{{resolve:ssm-secure:/prod/db/password}}`.
Dynamic references tell CloudFormation to resolve the value from SSM at deployment/runtime without exposing the value in the template definition.
3
Ensure the Lambda execution role has permissions to read the parameter.
The Lambda function's IAM role permissions (not the trust policy) must allow `ssm:GetParameters` or `ssm:GetParameter` for the resource path.
This enables the Lambda execution context to successfully resolve the value.

Key Concept

AWS SAM Integration with Systems Manager Parameter Store Secure Strings
Question 328Question →

An engineer is deploying a serverless application using a template that defines a Lambda function triggered by an Amazon S3 event. The function needs to execute with a custom IAM role. During the deployment, the stack fails to create the resources successfully. The relevant section of the template is structured as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
ProcessFileFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs20.x
Role: !GetAtt ProcessingRole.Arn
ProcessingRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: Service: s3.amazonaws.com
Action: sts:AssumeRole

Which of the following modifications will resolve the deployment failure and allow the Lambda function to assume the role?

Show answer & explanation

Answer: Update the Service principal under the AssumeRolePolicyDocument of the ProcessingRole to lambda.amazonaws.com.

Answer

Update the Service principal under the AssumeRolePolicyDocument of the ProcessingRole to lambda.amazonaws.com.
The correct answer updates the Service principal in the trust policy to lambda.amazonaws.com. An IAM execution role for a Lambda function must have a trust relationship that allows the lambda.amazonaws.com service principal to perform the sts:AssumeRole action. Even though the function is triggered by S3, the S3 service does not assume the Lambda execution role directly; instead, S3 invokes the function, and the Lambda service assumes the role to execute the function runtime.

Step-by-Step Solution

1
Analyze the resource definitions in the template.
The template defines an AWS::Serverless::Function and a custom AWS::IAM::Role named ProcessingRole.
To understand the relationship between the Lambda function execution role and its configuration.
2
Inspect the AssumeRolePolicyDocument of the custom role.
The trust policy has the Service principal set to s3.amazonaws.com.
The trust policy dictates which AWS service or identity is allowed to assume the role. The Lambda execution role must be assumed by the AWS Lambda service (lambda.amazonaws.com) to execute the function code, not the event source (s3.amazonaws.com).
3
Select the correction that updates the trust relationship correctly.
Changing the principal service to lambda.amazonaws.com allows AWS Lambda to assume the role.
This establishes the correct trust relationship so the execution role can be successfully used by the function.

Key Concept

AWS Lambda Execution Role Trust Policy
Question 329Question →

An organization runs a critical web application on a fleet of Amazon EC2 instances managed by an Auto Scaling group. The developer needs to configure a deployment strategy for application updates that guarantees the application maintains 100% of its capacity throughout the deployment process. Additionally, if the new version fails health checks, the system must support the fastest possible rollback to the previous version with minimal operational overhead. The organization accepts the temporary additional cost of provisioning duplicate resources during the deployment.

Which two deployment strategies meet these requirements?

Select all that apply

Show answer & explanation

Answer: Blue/green deployment; Immutable deployment

Answer

Blue/green deployment and Immutable deployment
Blue/green deployment and immutable deployment are the correct choices. Both strategies deploy the new version on new, separate resources while the original resources remain fully functional, ensuring 100% capacity is maintained. If a failure occurs, rollback is nearly instantaneous: traffic is directed back to the original instances (for blue/green) or the new resources are deleted (for immutable), requiring no redeployment overhead.

Step-by-Step Solution

1
Analyze capacity requirements.
The requirement specifies maintaining 100% capacity during deployment. This eliminates strategies that take existing instances offline, such as rolling deployment.
To ensure no performance degradation or downtime during the deployment.
2
Analyze rollback requirements.
The requirement specifies the fastest possible rollback. This eliminates strategies that require redeploying the old version in place, such as rolling with additional batch.
To minimize the mean time to recovery (MTTR) if a faulty version is deployed.
3
Evaluate remaining options against resource costs.
Both blue/green and immutable deployments deploy to new resources, maintaining 100% capacity of the old version and allowing instantaneous rollback (by switching DNS/routing or terminating new resources). Both meet the budget constraint because the organization accepts temporary duplicate resource costs.
To select the strategies that align with the cost profile and technical requirements.

Key Concept

Deployment strategies present different trade-offs among deployment time, capacity during deployment, rollback speed, and resource costs.
Question 330Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation AWS Lambda function to verify the health of the new task set before shifting production traffic. The validation function requires access to a database password that must be automatically rotated every 30 days. Additionally, the CodeDeploy service itself requires permissions to manage the ECS deployment. Which combination of configurations should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Answer

Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.
The correct configuration uses the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function, stores the database password in AWS Secrets Manager to support automatic rotation, and assigns CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook in the appspec.yaml file for invoking validation tests on Amazon ECS.
The BeforeAllowTraffic hook is identified as the valid lifecycle hook for ECS deployments.
ECS deployments only support BeforeAllowTraffic and AfterAllowTraffic hooks for running validation Lambda functions, whereas BeforeInstall is an EC2 hook.
2
Select the AWS service to store the database password with automatic 30-day rotation support.
AWS Secrets Manager is selected.
AWS Secrets Manager natively supports automatic rotation of database credentials, whereas Systems Manager Parameter Store does not provide built-in automatic rotation.
3
Verify the trust policy configuration for the IAM role assumed by AWS CodeDeploy.
The trust policy must allow the codedeploy.amazonaws.com service principal to assume the role.
AWS CodeDeploy needs permission to interact with ECS on the developer's behalf. The trust relationship must be with codedeploy.amazonaws.com, not ecs-tasks.amazonaws.com.

Key Concept

AWS CodeDeploy deployment configuration for ECS including AppSpec lifecycle hooks, Secrets Manager integration, and IAM trust policies.
Estimated Time:1m 30s
Question 331Question →

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The template defines an AWS::Serverless::Function resource that needs to read and write items in an Amazon DynamoDB table defined in the same template. During initial testing, the function fails to access the table due to missing permissions. The developer wants to resolve this issue by applying the principle of least privilege using the most operationally efficient method that native AWS SAM features support. Which configuration should the developer add to the template to resolve the permission issue?

Show answer & explanation

Answer: Add the Policies property to the AWS::Serverless::Function resource and reference the DynamoDBCrudPolicy policy template, passing the name of the DynamoDB table as a parameter.

Answer

Add the Policies property to the AWS::Serverless::Function resource and reference the DynamoDBCrudPolicy policy template, passing the name of the DynamoDB table as a parameter.
The correct answer provides the most secure and operationally efficient configuration. Specifying the DynamoDBCrudPolicy policy template under the Policies property of the AWS::Serverless::Function resource allows SAM to generate a scoped IAM policy for the function that only permits read/write actions on the designated DynamoDB table.

Step-by-Step Solution

1
Analyze the permission requirements for the Lambda function.
The function requires read and write (CRUD) operations on a specific DynamoDB table.
This establishes the scope of permissions needed to satisfy the principle of least privilege.
2
Evaluate the native AWS SAM features for handling function permissions.
AWS SAM provides built-in policy templates (such as DynamoDBCrudPolicy) that allow developers to reference pre-defined permission scopes with minimal configuration.
Using native policy templates reduces template complexity compared to writing custom IAM policies.
3
Apply the policy template in the function's Properties block.
The DynamoDBCrudPolicy is added under the Policies attribute, specifying the target TableName.
This automatically creates the execution role with the correct permissions scoped only to the target table.

Key Concept

AWS SAM Policy Templates
Estimated Time:1m 30s
Question 332Question →

A development team needs to deploy an update to an Amazon ECS service running on an EC2-backed cluster. The service currently runs 4 tasks. Due to strict budget limits, the cluster has no additional EC2 instance capacity to run extra tasks during the deployment. However, the service must maintain at least 50% of its capacity at all times to handle the baseline request volume. Which ECS service deployment configuration should the developer specify to meet these requirements?

Show answer & explanation

Answer: Set the minimum healthy percent to 50% and the maximum percent to 100%.

Answer

Set the minimum healthy percent to 50% and the maximum percent to 100%.
The correct option sets the minimum healthy percent to 50% and the maximum percent to 100%. This ensures that at least 2 tasks remain running at all times to handle baseline traffic. Because the maximum percent is 100%, ECS will not attempt to exceed 4 tasks at any point, meaning it will first terminate 2 old tasks to free up space on the existing EC2 hosts before launching 2 new tasks.

Step-by-Step Solution

1
Analyze the service configuration and constraints.
Current tasks = 4. Target minimum capacity = 50% (2 tasks). Additional EC2 capacity = 0.
To ensure no extra EC2 capacity is used, the maximum percent must not exceed 100%.
2
Evaluate the rolling update deployment parameter mathematical constraints.
Maximum percent of 100% means the service cannot exceed 4 concurrent tasks. Minimum healthy percent of 50% means at least 2 tasks must remain active.
This forces ECS to stop 2 tasks first, freeing up slot capacity on existing instances, and then start 2 new tasks.
3
Select the matching configuration option.
Minimum healthy percent = 50%, Maximum percent = 100%.
This is the only configuration that maintains the baseline service capacity without requiring extra EC2 instances.

Key Concept

Amazon ECS Rolling Update deployment parameters (minimumHealthyPercent and maximumPercent) control the task lifecycle and capacity requirements during a deployment.
Estimated Time:1m 30s
Question 333Question →

A developer is setting up an automated canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment is defined by the following `appspec.yml` template fragment:

yaml
version: 0.0
Resources:
- MyLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "MyLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"

The developer needs to modify this configuration to execute a validation Lambda function before traffic shifting begins, and must configure the CodeDeploy service role with the correct trust relationship and permissions.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the AppSpec file, add a Hooks section under the root level and configure the BeforeAllowTraffic lifecycle event to point to the validation Lambda function.; Configure the IAM service role used by AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role, and attach the AWSCodeDeployRoleForLambda managed policy.

Answer

Add a Hooks section with BeforeAllowTraffic pointing to the validation Lambda function, and configure the IAM service role for AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role.
For AWS Lambda deployments, the AppSpec file uses the 'Hooks' section to trigger Lambda functions during lifecycle events. The 'BeforeAllowTraffic' event runs validation functions before the traffic shifting begins. Additionally, AWS CodeDeploy requires an IAM service role with a trust policy that allows the 'codedeploy.amazonaws.com' service to assume the role via 'sts:AssumeRole' so it can execute deployments on your behalf.

Step-by-Step Solution

1
Identify the correct AppSpec schema and lifecycle hooks for AWS Lambda deployments.
Confirm that the 'Hooks' section is used at the root level and 'BeforeAllowTraffic' is the valid event to run validation tests before shifting traffic.
Ensure validation logic is executed at the correct lifecycle stage for serverless deployments.
2
Configure the IAM trust policy for the CodeDeploy service role.
Ensure the trust policy allows the 'codedeploy.amazonaws.com' service to assume the role.
Allows AWS CodeDeploy to assume the role and execute the deployment operations.
3
Verify credentials storage and rotation configuration.
Avoid choosing Parameter Store for secrets that require native automatic rotation capabilities.
Avoid common configuration mistakes related to credential security.

Key Concept

AWS CodeDeploy Lambda Deployment Lifecycle Hooks and Service Role configuration
Estimated Time:2m 0s
Question 334Question →

A developer is updating a critical serverless application and needs to configure traffic shifting for a new version of an AWS Lambda function using AWS CodeDeploy. The deployment must meet the following requirements:

* Route exactly 10%10\% of traffic to the new version in the first increment.
* Allow at least 1010 minutes of monitoring for errors before shifting any additional traffic or completing the deployment.

Which two AWS CodeDeploy deployment configurations should the developer select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: CodeDeployDefault.LambdaCanary10Percent10Minutes; CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

Answer

The correct configurations are CodeDeployDefault.LambdaCanary10Percent10Minutes and CodeDeployDefault.LambdaLinear10PercentEvery10Minutes.
The configurations CodeDeployDefault.LambdaCanary10Percent10Minutes and CodeDeployDefault.LambdaLinear10PercentEvery10Minutes both satisfy the requirements. The canary configuration shifts 10%10\% of the traffic to the new version initially and waits 1010 minutes before shifting the remaining 90%90\%. The linear configuration shifts 10%10\% initially and waits 1010 minutes before shifting the next 10%10\% increment, which allows the required 1010 minutes of monitoring in both cases.

Step-by-Step Solution

1
Analyze the requirement for initial traffic allocation.
The configuration must shift exactly 10%10\% of the traffic in the first increment. This rules out CodeDeployDefault.LambdaAllAtOnce, which shifts 100%100\% immediately.
Identifying the initial increment size helps narrow down the candidates to Canary 10%10\% and Linear 10%10\% configurations.
2
Evaluate the monitoring window constraint of at least 1010 minutes before shifting more traffic.
CodeDeployDefault.LambdaCanary10Percent5Minutes shifts the remaining traffic after 55 minutes, and CodeDeployDefault.LambdaLinear10PercentEvery1Minute shifts more traffic after 11 minute. Both fail the 1010-minute threshold.
Eliminating configurations that shift traffic too quickly ensures the deployment meets the safety window constraint.
3
Confirm the configurations that meet both constraints.
CodeDeployDefault.LambdaCanary10Percent10Minutes (shifts 10%10\% and waits 1010 minutes) and CodeDeployDefault.LambdaLinear10PercentEvery10Minutes (shifts 10%10\% and waits 1010 minutes before each subsequent shift) both satisfy the requirements.
Both configurations guarantee a 10%10\% initial traffic split and a minimum of 1010 minutes of evaluation time before further traffic modification.

Key Concept

AWS CodeDeploy deployment configurations for AWS Lambda functions specify how traffic is shifted between the original and new versions. Canary configurations shift a specified percentage in one increment and then shift the rest after a delay. Linear configurations shift traffic in equal increments at regular intervals.
Estimated Time:1m 30s
Question 335Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set after test traffic is routed, but before production traffic is shifted. The validation tests require a database password that must be rotated automatically every 30 days. Additionally, CodeDeploy requires an IAM service role to perform the deployment. Which configuration should the developer implement?

Show answer & explanation

Answer: Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.

Answer

Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.
The correct configuration requires the AWS CodeDeploy service role to have a trust policy allowing codedeploy.amazonaws.com to assume it. For storing credentials that need automatic rotation, AWS Secrets Manager is the appropriate service as it has native integration for rotation (unlike Systems Manager Parameter Store). In Amazon ECS deployments, validation tests are run using the AfterAllowTestTraffic lifecycle hook in the AppSpec file, which runs after test traffic is routed but before production traffic is allowed. ValidateService is an EC2-specific lifecycle hook and is not supported in ECS deployments.

Step-by-Step Solution

1
Determine the required IAM trust policy principal for the CodeDeploy service role.
The trust policy must allow the principal codedeploy.amazonaws.com to assume the role.
CodeDeploy requires permission to assume the service role to orchestrate the deployment on behalf of the developer.
2
Identify the proper storage service for a database password requiring automatic rotation.
AWS Secrets Manager must be used instead of Systems Manager Parameter Store.
Secrets Manager natively supports automatic rotation (e.g., every 30 days) via built-in integration, whereas Parameter Store does not support automatic rotation natively.
3
Select the correct lifecycle hook for running validation tests on an ECS blue/green deployment.
The validation Lambda function must be defined under the AfterAllowTestTraffic hook in the AppSpec file.
ECS blue/green deployments support validation tests after test traffic is routed using the AfterAllowTestTraffic hook. ValidateService is an EC2-specific hook and cannot be used in ECS deployments.

Key Concept

AWS CodeDeploy deployment configuration, IAM service roles, secret rotation, and ECS lifecycle hooks.
Estimated Time:2m 0s
Question 336Question →

A developer is using AWS SAM to build and deploy a serverless application. The application consists of an Amazon API Gateway HTTP API that triggers an AWS Lambda function. During the initial deployment of the template using the AWS SAM CLI, the deployment fails with an error stating that the resource type 'AWS::Serverless::Function' is unrecognized. After addressing the deployment failure, the developer tests the API endpoint but receives a 502 Bad Gateway error, even though Amazon CloudWatch Logs show that the Lambda function executed successfully and returned the correct data. Which two actions must the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Add the Transform: AWS::Serverless-2016-10-31 declaration at the root of the template file.; Format the Lambda function's return value to be a JSON object containing the statusCode and body keys.

Answer

The developer must add the Transform: AWS::Serverless-2016-10-31 declaration at the root of the template file and format the Lambda function's return value to be a JSON object containing the statusCode and body keys.
The deployment error is caused by the missing Transform header, which instructs CloudFormation to run the AWS SAM translator macro. The runtime 502 error is caused by the Lambda function returning a response format that API Gateway cannot parse for its proxy integration, requiring the output to be structured as a JSON object with statusCode and body.

Step-by-Step Solution

1
Diagnose the CloudFormation deployment failure.
Identify that the error 'AWS::Serverless::Function is unrecognized' indicates that CloudFormation does not know how to parse the SAM-specific resource.
AWS CloudFormation requires the Transform header to invoke the SAM translation service.
2
Add the Transform declaration.
Add 'Transform: AWS::Serverless-2016-10-31' at the root of the template.
This enables successful compilation and deployment of the SAM resources.
3
Diagnose the 502 Bad Gateway runtime error.
A 502 Bad Gateway error when the Lambda logs indicate success points to a response parsing failure by API Gateway.
In Lambda Proxy integrations, API Gateway expects a specific schema from the Lambda response, containing the status code and body.
4
Format the Lambda response.
Ensure the function returns a JSON response matching the proxy integration structure.
This allows API Gateway to successfully parse the response and return it to the client.

Key Concept

AWS SAM Template Validation and API Gateway Lambda Proxy Response Schema
Question 337Question →

A development team is deploying an updated AWS Lambda function using AWS CodeDeploy with a linear traffic-shifting configuration. Before any production traffic is routed to the new function version, the deployment process must run a separate validation Lambda function to perform smoke tests.

Which lifecycle hook must be specified in the `Hooks` section of the `appspec.yml` file to execute the validation function?

Show answer & explanation

Answer: BeforeAllowTraffic

Answer

BeforeAllowTraffic
The BeforeAllowTraffic lifecycle hook is one of the two hooks supported for AWS Lambda deployments in AWS CodeDeploy. It executes before traffic routing to the new Lambda version starts, which is the correct phase to run a validation function.

Step-by-Step Solution

1
Identify the target compute platform for the AWS CodeDeploy deployment.
The target compute platform is AWS Lambda.
Deployment lifecycle hooks in AWS CodeDeploy are platform-specific and differ between EC2/on-premises, Amazon ECS, and AWS Lambda.
2
Determine the required phase of the deployment for running the validation test.
The validation test must run before any production traffic is shifted to the new Lambda version.
Running tests early prevents routing production traffic to a broken or misconfigured version.
3
Select the appropriate Lambda-supported lifecycle hook from the available options.
The BeforeAllowTraffic hook is the correct hook that executes before traffic shifting begins.
AWS Lambda deployments in CodeDeploy support only BeforeAllowTraffic and AfterAllowTraffic hooks.

Key Concept

AWS CodeDeploy supports a specific set of deployment lifecycle hooks for AWS Lambda, which are different from those used for Amazon ECS and EC2. Specifically, only BeforeAllowTraffic and AfterAllowTraffic are valid for Lambda deployments.
Estimated Time:1m 0s
Question 338Question →

A software team is designing a serverless microservice using the AWS Serverless Application Model (SAM). The architecture requires an API Gateway HTTP API that triggers a backend AWS Lambda function. The function must securely fetch database credentials at runtime and also publish messages to an Amazon SQS queue.

Which two configuration steps must be implemented to ensure the deployment succeeds and the function operates correctly?

Select all that apply

Show answer & explanation

Answer: Declare the 'Transform' header with the value 'AWS::Serverless-2016-10-31' at the root of the template file to instruct CloudFormation to process the SAM syntax.; Under the function's Properties block in the template, define the 'Policies' key referencing the 'SQSSendMessagePolicy' SAM policy template with the target queue name.

Answer

The correct configurations are to declare the 'Transform' header with the value 'AWS::Serverless-2016-10-31' at the root of the template, and define the 'Policies' key referencing the 'SQSSendMessagePolicy' SAM policy template under the function's properties block.
Declaring the 'Transform' header with 'AWS::Serverless-2016-10-31' is mandatory for AWS SAM templates to convert serverless resource declarations into standard CloudFormation resources. Additionally, using the 'SQSSendMessagePolicy' template under the function's 'Policies' block is the standard, secure way in SAM to grant write permissions to an SQS queue without writing a full, custom IAM policy.

Step-by-Step Solution

1
Ensure the AWS SAM template contains the required header to parse SAM resource types.
The template includes 'Transform: AWS::Serverless-2016-10-31' at the root, enabling CloudFormation to recognize AWS::Serverless resource types.
Without this transform declaration, CloudFormation will fail to deploy, treating SAM resources as invalid.
2
Grant the Lambda function permission to send messages to the SQS queue using SAM policy templates.
The 'Policies' property under the Lambda function resource is configured with the 'SQSSendMessagePolicy' template pointing to the queue.
Using built-in SAM policy templates is the recommended method to grant granular permissions to a function efficiently.
3
Verify and avoid common security and integration misconfigurations.
IAM trust policies are set to 'lambda.amazonaws.com', database secrets are stored securely in Secrets Manager (not standard SSM parameter strings), and the function returns the correct proxy response format.
This prevents runtime integration failures, permission issues, and credential leakage.

Key Concept

AWS SAM templates require a Transform declaration at the root and support SAM policy templates to securely grant AWS resource permissions to serverless functions.
Estimated Time:2m 0s
Question 339Question →

A developer is planning the deployment of a new version of a critical web application hosted on AWS Elastic Beanstalk. The application runs on a fleet of Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer. The deployment must satisfy the following constraints:

* The update must be rolled out with zero downtime.
* The application must maintain 100%100\% of its instance capacity to handle the current traffic load at all times during the deployment.
* In the event of a deployment failure, the application must support an immediate rollback to the previous version without requiring a full redeployment of the original code.

Which two deployment strategies meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Blue/Green deployment; Immutable deployment

Answer

Blue/Green deployment and Immutable deployment
Blue/Green deployment and Immutable deployment satisfy all requirements. Blue/Green deployment provisions a separate environment with the new version and performs a DNS CNAME swap, keeping both environments at 100%100\% capacity and allowing an instant swap back in case of failure. Immutable deployment creates a temporary Auto Scaling group with the new version alongside the existing one, maintaining 100%100\% capacity, and immediately rolls back by terminating the new Auto Scaling group if the deployment fails.

Step-by-Step Solution

1
Analyze the capacity requirement.
Since the application must maintain 100%100\% of its instance capacity during the deployment, strategies that take existing instances out of service (like Rolling and All at once) are disqualified.
To ensure there is no performance degradation under high load.
2
Analyze the rollback requirement.
The rollback must be immediate and not require a full redeployment. This disqualifies Rolling with additional batch deployment, where rollback requires redeploying the old version onto updated instances.
To minimize the duration of service issues if the new version is buggy.
3
Evaluate the remaining options.
Blue/Green deployment (via CNAME swap) and Immutable deployment both run a full set of new instances alongside the old ones (maintaining 100%100\% capacity) and support immediate rollback (by swapping CNAMEs back or terminating the temporary Auto Scaling group, respectively).
Both strategies satisfy all the constraints in the scenario.

Key Concept

AWS Elastic Beanstalk deployment strategies trade-offs including capacity, downtime, and rollback mechanisms.
Question 340Question →

A developer is configuring AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The deployment must copy application files to the target instances and run a shell script (scripts/initialize.sh) that installs application dependencies. During execution, this script must download a configuration file from a secured Amazon S3 bucket.

Which two options must the developer configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the script path and execution settings under the AfterInstall lifecycle hook in the hooks section of the appspec.yml file.; Attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.

Answer

Define the script path and execution settings under the AfterInstall lifecycle hook in the appspec.yml file, and attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.
The correct options are to define the script execution under the AfterInstall hook in the appspec.yml file and to attach an S3 read permission policy to the EC2 instance profile. The AfterInstall hook is a standard EC2 deployment lifecycle hook suitable for post-installation tasks like installing dependencies. Because the CodeDeploy agent runs directly on the EC2 instances, any commands executed by the agent (such as scripts in the hooks section) run under the security context of the EC2 instance. Therefore, the instance profile attached to the EC2 instances must have permissions to access the S3 bucket.

Step-by-Step Solution

1
Determine the correct lifecycle hook for the EC2 deployment script.
The AfterInstall hook is selected as the appropriate hook to run dependency installation scripts after the application bundle has been copied.
EC2 deployments use specific lifecycle hooks like BeforeInstall, Install, AfterInstall, and ApplicationStart. The script must run after files are copied.
2
Determine the proper IAM credentials configuration for script execution.
The EC2 instance profile must be granted the s3:GetObject permission.
Scripts executed by the CodeDeploy agent run on the EC2 instance itself and use the instance's IAM role (instance profile) to authenticate to S3, not the CodeDeploy service role.

Key Concept

Understanding AWS CodeDeploy EC2 lifecycle hooks and how IAM permissions are resolved for scripts executed by the CodeDeploy agent on EC2 instances.
PreviousPage 17 / 19Next
Deployment Practice Questions — AWS Certified Developer - Associate — Page 17 | Examkin