Examkin

Deployment

376 questions

All types376Multiple choice191Multiple select171Ordering14
Question 41Question →

An organization's monorepo structure places the build configuration for the payment module in a file named buildspec-payment.yml inside the /services/payment/ directory. The module requires a payment gateway API key that is securely stored in AWS Secrets Manager. During the build, CodeBuild fails to locate the build configuration, and the application cannot retrieve the API key. Which two steps must be performed to resolve these failures? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the buildspec path in the CodeBuild project settings to point directly to services/payment/buildspec-payment.yml.; Define the API key variable under the secrets-manager block in the env phase of the buildspec, and grant the CodeBuild service role the secretsmanager:GetSecretValue permission.

Answer

To resolve the build failures, the buildspec path in the CodeBuild project settings must be updated to services/payment/buildspec-payment.yml, and the API key must be retrieved using the secrets-manager block under the env section of the buildspec, with the service role granted the secretsmanager:GetSecretValue permission.
Updating the project settings with the exact custom path allows CodeBuild to find the buildspec. Referencing the secret in the secrets-manager block in the env phase, combined with the secretsmanager:GetSecretValue API permissions in the execution role, allows CodeBuild to retrieve the API key.

Step-by-Step Solution

1
Configure the custom buildspec location
CodeBuild will correctly read the buildspec-payment.yml file located in the subdirectory during the initialization phase.
By default, CodeBuild only scans the root folder for buildspec.yml. A path override is required for subdirectories or custom file names.
2
Update the buildspec environment section
CodeBuild natively parses the API key from AWS Secrets Manager and sets it as an environment variable.
Specifying the secrets-manager block under the env phase allows CodeBuild to automatically fetch the secret during the build run.
3
Grant the necessary IAM permissions to the CodeBuild service role
The API key is successfully decrypted and made available to the build script.
Without secretsmanager:GetSecretValue permissions, CodeBuild cannot decrypt the secret, causing the build to fail.

Key Concept

AWS CodeBuild project configurations for custom buildspec paths and integration with AWS Secrets Manager
Question 42Question →

A developer is creating an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application needs to pull its container image from a private Amazon ECR repository in the same AWS account. Additionally, the application code itself must make calls to the Amazon Translate API to translate user reviews at runtime. Which configuration of IAM roles will allow the task to pull the image and run successfully with the least privilege?

Show answer & explanation

Answer: Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.

Answer

Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.
The correct configuration uses the Task Execution Role (taskExecutionRoleArn) to grant the Amazon ECS agent permissions to pull the image from Amazon ECR, and uses the Task Role (taskRoleArn) to grant the application running inside the container permission to call the Amazon Translate API. This respects the least-privilege model and aligns with how ECS handles agent-level versus container-level permissions.

Step-by-Step Solution

1
Determine the resource access required by the ECS agent versus the application container.
The Amazon ECS agent requires access to Amazon ECR to pull the image. The application code inside the container requires access to Amazon Translate.
The container infrastructure must pull the container image before startup. Once the container is running, the application code makes outgoing calls to other AWS APIs.
2
Map the access requirements to the correct ECS task definition role parameters.
Assign ECR access to the Task Execution Role (taskExecutionRoleArn) and Translate access to the Task Role (taskRoleArn).
The Task Execution Role is for ECS agent infrastructure activities (ECR pull, CloudWatch log streams). The Task Role is for the containerized application's own SDK calls.
3
Verify that the trust relationships are configured correctly and that credentials are secure.
Ensure both roles trust the 'ecs-tasks.amazonaws.com' service principal, avoiding the use of hardcoded IAM user keys.
ECS tasks must be allowed to assume these roles. Utilizing the Task Role provides automated credential rotation, ensuring security.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role
Question 43Question →

A development team has configured an AWS CodeBuild project to run inside a private subnet of a VPC. During the build execution, the project fails because it cannot download external package dependencies from the internet. Additionally, subsequent runs are taking a long time because the dependencies are fully downloaded from scratch each time. Which two actions should the developer take to resolve the internet connectivity issue and speed up the builds? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route 0.0.0.0/00.0.0.0/0 traffic through the NAT gateway.; Enable local dependency caching in the CodeBuild project settings, and specify the package manager's cache directory in the `cache` section of the `buildspec.yml` file.

Answer

Configure a NAT gateway in a public subnet of the VPC, update the private subnet's route table to route traffic through the NAT gateway, enable local dependency caching in CodeBuild, and define the cache directories in the cache section of the buildspec file.
To resolve the issues, the developer must configure a NAT gateway in a public subnet and route outbound traffic from the private subnet to it. This provides the necessary internet access for CodeBuild to download external dependencies. Additionally, the developer must enable local caching in CodeBuild and define the target cache paths in the buildspec file. This ensures that dependencies are reused across builds instead of being downloaded from scratch.

Step-by-Step Solution

1
Address the outbound internet connectivity problem for resources inside the private subnet of the VPC.
Create a NAT gateway in a public subnet, and configure a route pointing 0.0.0.0/00.0.0.0/0 traffic to it in the private subnet's route table.
CodeBuild containers inside a private subnet cannot directly reach the internet to download external dependencies without a NAT gateway.
2
Implement a caching mechanism to avoid downloading dependencies from scratch on every run.
Configure local caching in CodeBuild project properties and add the cache directories (such as package manager cache folders) to the cache phase of the buildspec file.
This allows CodeBuild to persist downloaded files between build runs, significantly speeding up execution times.

Key Concept

AWS CodeBuild VPC network routing and local dependency caching configurations
Question 44Question →

A developer is managing a production web application deployed via an AWS CloudFormation stack. The stack consists of an Amazon RDS DB instance, an Amazon EC2 Auto Scaling group, and an IAM role associated with the EC2 instances. To troubleshoot a connection issue, an administrator manually modified the EC2 security group rules and deleted the IAM role directly in the AWS Management Console. During a subsequent stack update to upgrade the database instance class, the update failed and the stack is now in the UPDATE_ROLLBACK_FAILED state. Which two actions should the developer take to resolve the stack status and reconcile the resource configurations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Manually recreate the deleted IAM role using the exact name and configuration it had prior to deletion, and then initiate the continue-update-rollback action.; Execute the continue-update-rollback command and specify the logical ID of the deleted IAM role in the resources-to-skip parameter.

Answer

To resolve the UPDATE_ROLLBACK_FAILED state, the developer should either manually recreate the deleted IAM role and continue the rollback, or execute continue-update-rollback while skipping the deleted IAM role.
The correct options identify the two supported methods for resolving a stack stuck in the UPDATE_ROLLBACK_FAILED state. Recreating the deleted IAM role allows CloudFormation to find and delete/modify it during the rollback phase, which enables the rollback to complete successfully. Alternatively, calling the continue-update-rollback command and choosing to skip the deleted IAM role permits the rollback operation to skip that specific resource and successfully transition the stack to the UPDATE_ROLLBACK_COMPLETE state.

Step-by-Step Solution

1
Analyze the stack status and event logs to identify the exact resource causing the rollback failure.
The logs indicate that the rollback failed because the IAM role referenced in the stack template was not found.
Before resolving the rollback failure, the root cause of the failure must be identified.
2
Choose to either restore the missing dependency or skip the resource during rollback.
Recreating the role allows the rollback to clean it up or update it normally. Alternatively, skipping the role allows the rollback to finish while leaving the resource state as-is.
CloudFormation requires either finding the resource to modify or delete it, or being explicitly told to skip it to complete the rollback sequence.
3
Perform a drift detection after the stack reaches a stable state to identify the out-of-band security group changes.
The drift detection report details the exact differences between the template and the actual security group rules.
This identifies all manual out-of-band changes that need to be reconciled manually or by updating the template.

Key Concept

CloudFormation Stack Rollback Failure Resolution
Question 45Question →

A developer is managing a web application deployed using an AWS CloudFormation stack. The stack includes an Amazon ECS task definition, an IAM execution role, and an Amazon DynamoDB table. During a troubleshooting session, an administrator manually deleted the IAM execution role directly from the IAM Console. Subsequently, the developer attempted to update the CloudFormation stack to adjust the CPU allocation for the ECS tasks. The update failed, and the stack is now stuck in the UPDATE_ROLLBACK_FAILED state. The developer needs to resolve the rollback failure and successfully apply the new CPU allocation. Which two actions should the developer take to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template.; Invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.

Answer

Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template, and then invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.
When a resource is deleted manually out-of-band and a subsequent stack update fails and rolls back, the rollback itself fails because CloudFormation expects the deleted resource to exist. To resolve the UPDATE_ROLLBACK_FAILED state, the developer must first manually recreate the deleted resource with the exact name and configuration specified in the template. After resolving the underlying cause, the developer must call continue-update-rollback to resume the rollback process and return the stack to a stable state, allowing future updates.

Step-by-Step Solution

1
Identify the cause of the failed rollback by reviewing the stack events in the CloudFormation console or using the CLI.
The log events show that the IAM execution role is missing (deleted out-of-band), causing the rollback to fail because CloudFormation cannot update or delete resources depending on the role.
Before resolving the rollback state, you must identify which resource is missing or failed during the rollback process.
2
Manually recreate the deleted IAM execution role with the exact name, path, and configuration expected by the stack.
The IAM role exists again with the identical ARN and properties.
CloudFormation rollback actions reference the deleted resource by its physical ID/ARN; recreating it allows the cleanup or rollback operations to run successfully.
3
Run the continue-update-rollback command or use the AWS Console to continue rollback.
The stack successfully rolls back to the UPDATE_ROLLBACK_COMPLETE state.
This transitions the stack out of the blocked UPDATE_ROLLBACK_FAILED state into a stable state.
4
Initiate a new stack update with the updated template to modify the ECS task definition CPU limits.
The update finishes successfully, and the stack reaches the UPDATE_COMPLETE state.
Once the stack is in a stable UPDATE_ROLLBACK_COMPLETE state, regular updates can be performed safely.

Key Concept

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED due to manual out-of-band resource deletion.
Question 46Question →

A developer is configuring a cross-account deployment pipeline in AWS CodePipeline. The pipeline is located in Account A (the tooling account) and must deploy a containerized application to Amazon ECS in Account B (the target account). The pipeline's artifact store is an Amazon S3 bucket in Account A, which is encrypted with an AWS KMS Customer Managed Key (CMK) also located in Account A.

To successfully configure and run this pipeline, the developer needs to set up the necessary cross-account IAM roles, resource policies, and pipeline action settings.

What is the correct chronological sequence of steps required to successfully configure and execute this cross-account deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, create the target deployment IAM role in Account B; second, update the KMS key policy and S3 bucket policy in Account A; third, configure the deploy action in the Account A pipeline; fourth, run the pipeline execution; and fifth, decrypt the artifact and deploy to Amazon ECS in Account B.
The correct sequence begins with creating the IAM role in Account B so that its ARN is valid. Then, policies in Account A (S3 and KMS) are updated to reference this ARN. Next, the pipeline deploy action is modified to use this role. Finally, the pipeline is executed, assuming the role, downloading, and decrypting the artifact to complete the deployment.

Step-by-Step Solution

1
Create the IAM role in Account B with a trust policy for Account A's CodePipeline service role.
The target deployment role exists, establishing a valid ARN for resource policy references.
AWS API validates principal ARNs in resource policies; the role must exist before it can be referenced elsewhere.
2
Update the KMS key policy and S3 bucket policy in Account A.
The Account B role is granted permissions to read from the artifact bucket and decrypt using the CMK.
Allows the cross-account deployment role to access the pipeline's encrypted artifacts.
3
Update the pipeline definition in Account A to specify the deploy action's roleArn.
The deploy action is configured to assume the Account B role during execution.
Tells CodePipeline which role to assume when running the deployment phase.
4
Trigger the pipeline execution.
CodePipeline assumes the Account B role and retrieves the artifact from S3.
Initiates the cross-account action execution workflow.
5
Decrypt the artifact and update the Amazon ECS service.
The application is successfully deployed to Account B.
Executes the final deployment step using the assumed role permissions and decrypted content.

Key Concept

Cross-account pipeline deployments with AWS KMS-encrypted artifact stores require strict ordering of IAM role creation, resource policy configuration (KMS and S3), and pipeline definition updates.
Estimated Time:3m 0s
Question 47Question →

A developer is configuring a CI/CD pipeline using AWS CodeDeploy for a serverless API hosted on AWS Lambda and integrated with Amazon API Gateway. The deployment process must adhere to the following requirements:

* Production traffic must be shifted in two stages: an initial 10%10\% of traffic is routed to the new version, followed by the remaining 90%90\% after a 1515-minute evaluation period.
* Prior to routing any production traffic to the new version, a test function must run to verify that the new version can successfully write to an Amazon DynamoDB table.
* If the test function fails, or if a CloudWatch alarm for 5xx5\text{xx} errors on the new version is triggered during the evaluation period, the deployment must immediately roll back.

Which TWO actions must the developer perform to configure the deployment?

Select all that apply

Show answer & explanation

Answer: Set the deployment configuration in AWS CodeDeploy to CodeDeployDefault.LambdaCanary10Percent15Minutes; Specify a validation Lambda function under the BeforeAllowTraffic hook in the AppSpec file to verify database connectivity

Answer

Configure the deployment in AWS CodeDeploy to use the CodeDeployDefault.LambdaCanary10Percent15Minutes configuration, and specify a validation Lambda function under the BeforeAllowTraffic hook in the AppSpec file to verify database connectivity.
To satisfy the deployment requirements, the developer must configure the traffic shifting behavior and implement the pre-traffic validation test. The 'CodeDeployDefault.LambdaCanary10Percent15Minutes' configuration routes 10%10\% of the traffic to the new version of the Lambda function initially, holds it for 1515 minutes to allow for monitoring, and then routes the remaining 90%90\% of traffic. Additionally, CodeDeploy uses the AppSpec file to define deployment lifecycle hooks. For Lambda deployments, the validation test must be executed during the 'BeforeAllowTraffic' hook, which runs before traffic routing begins. If the validation function fails, CodeDeploy automatically stops the deployment and rolls back the traffic.

Step-by-Step Solution

1
Analyze the traffic shifting requirement.
The requirements dictate shifting 10%10\% of traffic initially and the remaining 90%90\% after a 1515-minute evaluation period. This matches a canary deployment configuration, specifically 'CodeDeployDefault.LambdaCanary10Percent15Minutes'.
Identifying the correct built-in configuration ensures the traffic shifting logic adheres to the specifications.
2
Determine the appropriate lifecycle hook for pre-traffic verification.
The verification must run before any production traffic shifts. The correct hook for this in Lambda deployments is 'BeforeAllowTraffic'.
Running the validation code in 'BeforeAllowTraffic' ensures that if the validation fails, traffic is never shifted, preventing service disruption.
3
Verify hook support for AWS Lambda deployments in CodeDeploy.
AWS Lambda deployments only support the 'BeforeAllowTraffic' and 'AfterAllowTraffic' hooks. EC2 hooks like 'BeforeInstall' are unsupported and will cause deployment failures.
Understanding Lambda-specific lifecycle hooks prevents configuration errors in the AppSpec file.

Key Concept

AWS CodeDeploy deployment configurations and AppSpec lifecycle hooks for AWS Lambda.
Question 48Question →

A developer is configuring a build in AWS CodeBuild that must retrieve an encrypted database password from the Systems Manager Parameter Store. The developer places a custom build specification file named build-config.yml inside a subdirectory named config in the source repository. When the build is triggered, CodeBuild fails with an error indicating that the buildspec file cannot be found. Additionally, once the buildspec is resolved, the build needs to be able to fetch and decrypt the password from Parameter Store.

Which TWO actions should the developer take to resolve these issues and ensure the build completes successfully?

Select all that apply

Show answer & explanation

Answer: Update the CodeBuild project settings to specify the buildspec path as config/build-config.yml.; Add the ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.

Answer

To resolve the issues, the developer must configure the custom buildspec path as config/build-config.yml in the CodeBuild project settings, and add both ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.
Specifying the custom buildspec path config/build-config.yml in the project settings tells CodeBuild where to locate the configuration file. Granting ssm:GetParameters and kms:Decrypt to the CodeBuild service role provides the necessary permissions to read and decrypt the secure parameter.

Step-by-Step Solution

1
Address the missing buildspec file issue.
Configured the project to look at config/build-config.yml instead of the default root path.
CodeBuild defaults to looking for buildspec.yml at the root directory. Subdirectories require explicit path mapping.
2
Configure Systems Manager Parameter Store permissions.
Added ssm:GetParameters to the CodeBuild service role.
Allows CodeBuild to retrieve the parameter value from Systems Manager Parameter Store.
3
Configure AWS Key Management Service (KMS) permissions.
Added kms:Decrypt to the CodeBuild service role.
Since the parameter is stored as a SecureString, CodeBuild needs decrypt permissions for the KMS key that encrypts it.

Key Concept

AWS CodeBuild buildspec configuration and IAM permissions for Systems Manager integration.
Question 49Question →

An application developer is deploying an updated version of a microservice REST API using Amazon API Gateway. To minimize blast radius, the developer wants to test the update under production conditions by routing 5%5\% of incoming API traffic to the new deployment. The developer also needs to monitor separate Amazon CloudWatch metrics for the test traffic and the production traffic. Once the new deployment is verified, the developer must promote it to receive 100%100\% of the traffic with minimum administrative overhead and without managing additional API Gateway stages. Which deployment strategy should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure a canary release on the active API Gateway stage, set the canary traffic percentage to 5%5\%, and then promote the canary to the stage after verification.

Answer

Configure a canary release on the active API Gateway stage, set the canary traffic percentage to 5%5\%, and then promote the canary to the stage after verification.
Configuring a canary release on the active API Gateway stage allows the developer to route a specific percentage of traffic (such as 5%5\%) to a new deployment on the same stage. API Gateway automatically generates separate Amazon CloudWatch metrics for the canary traffic, which can be monitored. When verification is complete, promoting the canary updates the stage deployment to the new version and deletes the canary, meeting all requirements with the lowest administrative overhead and without managing multiple stages.

Step-by-Step Solution

1
Evaluate the requirement for splitting traffic at the API Gateway level with separate metrics and no additional stages.
Identify that API Gateway canary releases support splitting traffic on a single stage and provide separate CloudWatch metrics.
This aligns with minimizing stage management and administrative overhead.
2
Set up the canary release on the active stage with 5%5\% traffic.
5%5\% of incoming requests are routed to the new API deployment, and API Gateway automatically publishes separate CloudWatch metrics for the canary stage.
This allows safe verification of the new version under production load.
3
Promote the canary release.
The new deployment becomes the active deployment for the stage, and the canary is disabled.
This completes the promotion to 100%100\% traffic with zero downtime and no additional stages to delete or manage.

Key Concept

API Gateway Canary Deployments
Estimated Time:2m 30s
Question 50Question →

A developer is using AWS Serverless Application Model (SAM) to deploy a Lambda function that processes incoming orders via Amazon API Gateway. The developer wants to configure the deployment pipeline to perform a canary deployment, shifting 10% of the traffic to the new version for a 5-minute evaluation period before routing the remaining traffic.

The current `template.yaml` is defined below:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Deployment template for order processing service

Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
PostOrder:
Type: Api
Properties:
Path: /orders
Method: post

Which of the following modifications must the developer make to the template to enable this gradual deployment strategy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add the AutoPublishAlias property under the Properties section of ProcessOrderFunction and assign it an alias name.; Add the DeploymentPreference property under the Properties section of ProcessOrderFunction and set the Type to Canary10Percent5Minutes.

Answer

Add the AutoPublishAlias property under the Properties section of ProcessOrderFunction and assign it an alias name; and add the DeploymentPreference property under the Properties section of ProcessOrderFunction and set the Type to Canary10Percent5Minutes.
To configure a canary deployment for an AWS::Serverless::Function, the template must define both the AutoPublishAlias property (to create a Lambda alias pointing to the newly published version) and the DeploymentPreference property (to define the routing policy such as Canary10Percent5Minutes). AWS SAM uses these properties to automatically generate the underlying CodeDeploy resources and configurations needed to route traffic gradually.

Step-by-Step Solution

1
Identify the requirement for AWS CodeDeploy in gradual serverless deployments.
Recognize that AWS SAM relies on AWS CodeDeploy to perform canary or linear traffic shifting.
Enabling gradual traffic shifting requires configuring properties that AWS SAM uses to provision the necessary CodeDeploy resources.
2
Configure function versioning and aliasing in the SAM template.
Identify that AutoPublishAlias must be added to the function properties.
Traffic shifting can only happen between distinct, immutable Lambda function versions referenced by a Lambda alias.
3
Define the traffic shifting strategy details.
Add the DeploymentPreference object under the function properties, specifying the Type as Canary10Percent5Minutes.
This configuration maps directly to the CodeDeploy deployment configuration that manages the 10% traffic routing and 5-minute evaluation window.

Key Concept

Configuring gradual deployments (canary/linear) in AWS SAM using AutoPublishAlias and DeploymentPreference properties.
Question 51Question →

A developer is performing an in-place deployment of a new application revision to a fleet of Amazon EC2 instances using AWS CodeDeploy. The developer updated a cleanup script named 'stop-server.sh' in the new revision and referenced it in the 'ApplicationStop' lifecycle hook of the 'appspec.yml' file. However, the deployment fails during the 'ApplicationStop' phase. Investigation reveals that the 'stop-server.sh' script currently residing on the instances (from the previous deployment) has a syntax error that causes it to exit with a non-zero status, whereas the updated script in the new deployment bundle has this error fixed. Which of the following explains why the deployment failed and how the developer can successfully deploy the new application revision?

Show answer & explanation

Answer: CodeDeploy executes the 'ApplicationStop' hook using the script from the previously deployed revision on the instances. The developer can bypass this failure by redeploying the new revision with the ignore application stop failures option enabled.

Answer

CodeDeploy executes the ApplicationStop hook using the script from the previously deployed revision on the instances. The developer can bypass this failure by redeploying the new revision with the ignore application stop failures option enabled.
The correct option is correct because during an in-place deployment, CodeDeploy runs the ApplicationStop lifecycle hook using the scripts and appspec.yml from the previous successful deployment revision. Since the script on the instances has a bug, the hook fails and prevents the deployment from proceeding. Enabling the ignore application stop failures option allows CodeDeploy to bypass this hook's failure and successfully deploy the new version.

Step-by-Step Solution

1
Analyze the execution context of lifecycle hooks in an in-place CodeDeploy deployment.
Identify that the ApplicationStop hook occurs before the new revision bundle is downloaded and runs using the appspec.yml and scripts from the previously successful deployment revision.
This explains why the syntax error in the old version of the script causes the new deployment to fail, even though the script is fixed in the new revision bundle.
2
Evaluate recovery mechanisms for failing ApplicationStop scripts in CodeDeploy.
Determine that CodeDeploy allows bypassing ApplicationStop script failures using the '--ignore-application-stop-failures' flag in the AWS CLI or by checking the equivalent option in the AWS Management Console.
Since the local script on the EC2 instances is broken and cannot exit successfully, bypassing the hook is the only automated way to allow the new, fixed bundle to be downloaded and installed.

Key Concept

AWS CodeDeploy EC2 in-place deployment lifecycle hook execution and failure handling
Estimated Time:2m 0s
Question 52Question →

A developer uses AWS Serverless Application Model (SAM) to deploy a Lambda function that retrieves database credentials from AWS Secrets Manager. The secret is encrypted using a customer managed AWS KMS key. In the SAM template, the developer configures the function's `Policies` property with the `AWSSecretsManagerGetSecretValuePolicy` template, referencing the secret's ARN. The deployment completes successfully. However, when the function runs, it fails with an `AccessDeniedException` during the `GetSecretValue` API call. What is the reason for this runtime failure?

Show answer & explanation

Answer: The `AWSSecretsManagerGetSecretValuePolicy` policy template only grants permissions for the `secretsmanager:GetSecretValue` action, meaning the function execution role still lacks permissions to decrypt the secret using the customer managed KMS key.

Answer

The Lambda function's execution role lacks explicit decrypt permissions on the customer managed KMS key, as the pre-defined `AWSSecretsManagerGetSecretValuePolicy` SAM policy template only grants permission for the `secretsmanager:GetSecretValue` action.
The correct answer is correct because the built-in AWS SAM policy template `AWSSecretsManagerGetSecretValuePolicy` only grants the Lambda function permission to call `secretsmanager:GetSecretValue` on the specified resource. If the secret is encrypted with a customer managed KMS key (rather than the default AWS-managed key `aws/secretsmanager`), the function's IAM execution role must also be granted explicit `kms:Decrypt` permissions on that KMS key to successfully read the decrypted payload.

Step-by-Step Solution

1
Analyze the IAM policy generated by the `AWSSecretsManagerGetSecretValuePolicy` template.
The generated policy grants access to `secretsmanager:GetSecretValue` for the target secret resource.
To verify the scope of the permissions granted to the Lambda function's execution role by default.
2
Identify the encryption mechanism of the secret.
The secret is encrypted using a customer managed KMS key.
Secrets encrypted with customer managed keys require explicit KMS decrypt permissions for any identity attempting to read them.
3
Determine why the call fails with AccessDeniedException at runtime.
While the function can access Secrets Manager, the decryption fails because the execution role does not possess the `kms:Decrypt` permission on the customer managed key.
Both Secrets Manager and KMS permissions must be present in the execution role for successful retrieval of KMS-encrypted secrets.

Key Concept

AWS SAM Policy Templates and KMS Decrypt Permissions
Estimated Time:2m 0s
Question 53Question →

A developer is configuring the deployment policy for a high-traffic web application hosted on AWS Elastic Beanstalk. The application runs on multiple Amazon EC2 instances. The deployment policy must satisfy the following requirements:

1. The application must maintain 100%100\% of its instance capacity to handle incoming traffic at all times during the deployment.
2. If a deployment failure occurs, the rollback process must be rapid and must not perform any updates or modifications on the original, healthy instances.

Which two deployment strategies should the developer select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Immutable; Traffic splitting

Answer

The correct strategies are Immutable and Traffic splitting.
The correct strategies are Immutable and Traffic splitting. Both of these strategies maintain 100%100\% instance capacity during deployment by launching a separate, temporary Auto Scaling group for the new version. Furthermore, if a deployment failure occurs, the rollback is rapid and clean because it only requires terminating the temporary Auto Scaling group and redirecting traffic, leaving the original, healthy instances completely untouched.

Step-by-Step Solution

1
Analyze capacity requirements during deployment.
To maintain 100%100\% capacity without reducing instance count, any strategy that takes existing instances offline (All-at-once, Rolling) is eliminated. Strategies that launch new instances (Rolling with additional batch, Immutable, Traffic splitting) are kept.
Eliminating options that reduce capacity ensures the application can handle peak traffic during the update.
2
Analyze rollback requirements in case of failure.
Rolling with additional batch modifies the existing instances. If it fails, rolling back requires redeploying the old version back onto the instances, which takes time and modifies active instances. Immutable and Traffic splitting launch a separate, temporary Auto Scaling group. If they fail, they immediately redirect traffic and terminate the temporary resources, leaving the original instances untouched.
This identifies the strategies that provide the fastest and cleanest rollback without performing out-of-band updates on original instances.

Key Concept

AWS Elastic Beanstalk deployment policies and their impact on capacity, rollback speed, and resource modification.
Question 54Question →

A developer is deploying a database-backed web application using an AWS CloudFormation template. The application requires a database password that must be automatically rotated every 30 days, and a database port setting that is non-sensitive and static. Which of the following approaches represent best practices for managing these configurations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager, enable automatic rotation, and retrieve the password in the CloudFormation template using a dynamic reference.; Store the database port in AWS Systems Manager Parameter Store as a standard parameter, and retrieve it in the CloudFormation template using a dynamic reference.

Answer

Store the database password in AWS Secrets Manager with automatic rotation, and store the database port in AWS Systems Manager Parameter Store, referencing both via dynamic references.
The correct approach is to store the database password in AWS Secrets Manager because it is sensitive and requires automatic rotation, and store the database port in AWS Systems Manager Parameter Store because it is static and non-sensitive. Both values should be retrieved using dynamic references in the CloudFormation template to avoid hardcoding sensitive data and to ensure secure, automated retrieval at deployment time.

Step-by-Step Solution

1
Determine the security and lifecycle needs of each configuration item.
The database password is sensitive and requires automatic rotation; the database port is non-sensitive and static.
Identifying these traits ensures that resources are configured using the most secure and cost-efficient AWS services.
2
Select the correct storage service for the sensitive password.
AWS Secrets Manager is selected.
Secrets Manager natively supports automatic rotation and secure encryption, which are required for the database password.
3
Select the correct storage service for the non-sensitive port.
AWS Systems Manager Parameter Store is selected.
Parameter Store standard parameters are free and ideal for static, non-sensitive parameters, avoiding the cost of Secrets Manager.
4
Reference both values dynamically inside the CloudFormation template.
Dynamic references are added to the template parameters.
Dynamic references allow the stack to fetch the values at deploy time without storing sensitive data in the template definition.

Key Concept

AWS CloudFormation templates should integrate with AWS Systems Manager Parameter Store and AWS Secrets Manager using dynamic references to securely and cost-effectively inject parameters based on their sensitivity and rotation requirements.
Question 55Question →

A developer is deploying a serverless application using AWS SAM. The template file (`template.yaml`) defines several `AWS::Serverless::Function` resources with the `CodeUri` property pointing to local directories (e.g., `./src`). The developer attempts to deploy the template directly using the command `aws cloudformation deploy --template-file template.yaml --stack-name my-stack`. The deployment fails with errors indicating that the template format is invalid because the `AWS::Serverless` resources are not recognized, and the local paths for `CodeUri` cannot be resolved. Which TWO actions must the developer take to resolve these issues and successfully deploy the application?

Select all that apply

Show answer & explanation

Answer: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file.; Run the `sam package` command to upload the local artifacts to an Amazon S3 bucket and generate a new template file with S3 URIs.

Answer

To deploy a SAM application successfully, the developer must add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file to enable SAM syntax translation, and run the `sam package` command to upload local assets to Amazon S3 and produce a packaged template referencing those S3 locations.
The correct options involve adding the `Transform: AWS::Serverless-2016-10-31` declaration to enable the CloudFormation SAM parser, and running the `sam package` command to process local paths and upload code artifacts to Amazon S3. These two steps resolve the validation errors and local file path reference limitations in CloudFormation.

Step-by-Step Solution

1
Add the required serverless transform header to the SAM template.
The template now includes `Transform: AWS::Serverless-2016-10-31` at the root level.
Without this declaration, AWS CloudFormation does not recognize SAM resource types like `AWS::Serverless::Function` and fails during parsing.
2
Run the `sam package` command specifying an Amazon S3 bucket for code storage.
The local artifacts are zipped and uploaded to the specified S3 bucket, and a new template file is generated where the `CodeUri` properties point to the S3 objects.
CloudFormation cannot upload local directory contents directly from the deployment command; packaging resolves local paths to S3 URIs.
3
Deploy the application using the packaged template file.
The stack is created or updated successfully in AWS CloudFormation.
The packaged template contains standard S3 locations and valid SAM syntax that CloudFormation can translate and execute.

Key Concept

AWS SAM templates must define the Transform header to be processed, and local files must be packaged and uploaded to Amazon S3 before deploying via CloudFormation.
Question 56Question →

A developer uses the AWS Serverless Application Model (SAM) to deploy a serverless application. The template defines an AWS::Serverless::Function resource with an Api event source, as shown in the following snippet:

yaml
Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
CreateOrder:
Type: Api
Properties:
Path: /orders
Method: post

The application deploys successfully. However, when clients send a POST request to /orders, the API Gateway returns a 502 Bad Gateway status code, and the Lambda function execution logs show that the function ran and completed successfully without errors.

Which of the following describes the cause of this issue and the correct resolution?

Show answer & explanation

Answer: The default integration type for the SAM Api event is a Lambda proxy integration. The Lambda function returned a plain text string instead of a structured JSON response containing the statusCode and body fields, which API Gateway requires. To resolve this, modify the Lambda function return value to match the expected JSON structure.

Answer

The default integration type for the SAM Api event is a Lambda proxy integration. The Lambda function returned a plain text string instead of a structured JSON response containing the statusCode and body fields, which API Gateway requires. To resolve this, modify the Lambda function return value to match the expected JSON structure.
The default integration type configured by AWS SAM when using the Api event source is the Lambda proxy integration. Under this model, API Gateway passes the raw request directly to the Lambda function, and expects the Lambda function to return a response matching a specific JSON format (specifically containing 'statusCode' and 'body' fields). If the function returns a raw string or an unsupported format, API Gateway cannot map the response, resulting in a 502 Bad Gateway error. Modifying the Lambda function to return the correct JSON structure resolves the issue.

Step-by-Step Solution

1
Analyze the error symptoms and deployment state.
The application deployed successfully, but requests result in a 502 Bad Gateway error, and Lambda logs show successful execution with no runtime exceptions.
This rules out deployment-time issues like missing transforms, and rules out internal Lambda execution errors or timeouts.
2
Identify the integration type defined by the AWS SAM Api event source.
By default, defining an Api event source under AWS::Serverless::Function sets up an Amazon API Gateway REST API with Lambda Proxy Integration.
Understanding the defaults of AWS SAM configurations helps pinpoint the expectations of the API Gateway integration.
3
Verify response formatting requirements for Lambda Proxy Integration.
API Gateway Proxy Integration expects the Lambda function output to be a JSON object with at least a 'statusCode' and a 'body' property.
Returning a plain string instead of the structured JSON payload causes API Gateway to fail parsing, leading to a 502 Bad Gateway response.

Key Concept

AWS SAM defaults to configuring API Gateway Lambda Proxy Integrations for Api events, which requires backend Lambda functions to return a specific JSON response format containing 'statusCode' and 'body'.
Question 57Question →

A developer is deploying a serverless backend using AWS SAM. The configuration file `template.yaml` contains the following definition:

yaml
Resources:
ProcessDataFunction:
Type: AWS::Serverless::Function
Properties:
Handler: app.handler
Runtime: python3.12
CodeUri: src/
Events:
GetData:
Type: HttpApi
Properties:
Path: /data
Method: GET

During the deployment process, the CloudFormation stack creation fails with the message `Template format error: Unrecognized resource type: AWS::Serverless::Function`. Additionally, the developer notes that the python handler code currently returns a plain text string `'Success'`, which will cause integration failure when invoked through the API Gateway endpoint.

Which two actions must the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Add `Transform: AWS::Serverless-2016-10-31` at the root of the template file.; Modify the python handler to return a dictionary with `statusCode` and `body` keys, where `body` is a JSON-formatted string.

Answer

The correct actions are to add the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template file, and to update the python handler to return a dictionary with `statusCode` and `body` keys.
Adding the Transform declaration allows the AWS CloudFormation service to parse the serverless resources. Returning a dictionary with the status code and JSON body conforms to the Lambda Proxy integration format required by the API Gateway HTTP API configuration.

Step-by-Step Solution

1
Diagnose the CloudFormation parsing failure.
The `Unrecognized resource type: AWS::Serverless::Function` error occurs because CloudFormation does not natively understand the `AWS::Serverless` namespace without the SAM translator. Adding `Transform: AWS::Serverless-2016-10-31` at the template root resolves this.
The Transform declaration instructs CloudFormation to invoke the SAM translator to convert the simplified SAM syntax into standard CloudFormation resources.
2
Diagnose the API Gateway integration failure.
By default, API Gateway event sources declared on SAM Functions use Lambda Proxy Integration, which expects the Lambda function to return a structured JSON response containing `statusCode` and a string `body`.
If the function returns a raw string, API Gateway cannot map it to an HTTP response, resulting in an integration error (HTTP 502).

Key Concept

AWS SAM templates must include the Transform declaration to allow CloudFormation to interpret serverless resources, and Lambda functions integrated with API Gateway HTTP APIs must adhere to the Lambda Proxy Integration response format.
Question 58Question →

A developer is planning a deployment strategy for a high-traffic production application hosted on AWS Elastic Beanstalk. The application must maintain its full provisioned instance capacity during the deployment to avoid performance degradation. Additionally, if the new application version fails initial health checks, the environment must immediately roll back to the previous version without performing a secondary deployment process.

Which two Elastic Beanstalk deployment strategies will meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Immutable; Traffic splitting

Answer

The Immutable and Traffic splitting deployment strategies satisfy both the capacity and rollback requirements.
The Immutable and Traffic splitting deployment strategies both deploy the new application version to a separate, temporary Auto Scaling group while keeping the original instances fully operational. This satisfies the requirement to maintain 100% capacity. If the update fails health checks, both strategies achieve an immediate rollback by redirecting traffic away from the new instances and terminating the temporary Auto Scaling group, without needing a secondary rolling update.

Step-by-Step Solution

1
Analyze capacity constraints during the deployment process.
The application must maintain 100% of its provisioned instance capacity. This rules out strategies like Rolling, which temporarily take active instances out of service, and All-at-once, which takes all instances offline.
Maintaining capacity prevents performance degradation under high traffic.
2
Analyze rollback constraints on health check failure.
The rollback must be immediate and not require another deployment process. This rules out Rolling with additional batch, because reverting requires performing another rolling update deployment to push the old code back to the instances.
An immediate rollback minimizes the duration of any potential user impact.
3
Identify strategies that launch a temporary Auto Scaling group.
Immutable and Traffic splitting both launch a parallel Auto Scaling group to test the new version while keeping the original group untouched. This maintains capacity and allows instant rollback by redirecting traffic or terminating the temporary group.
These strategies isolate the new deployment from the existing running instances until verification succeeds.

Key Concept

Elastic Beanstalk Deployment Strategies
Question 59Question →

A developer is writing an appspec.yml file for an in-place deployment to Amazon EC2 instances using AWS CodeDeploy. The developer needs to execute a shell script to gracefully stop the running web server application before the new deployment bundle is downloaded. Additionally, the script requires retrieving database credentials that must undergo automatic rotation. How should the developer configure the deployment to meet these requirements?

Show answer & explanation

Answer: Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.

Answer

Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.
The correct configuration is to target the ApplicationStop lifecycle hook. In an EC2 in-place deployment, ApplicationStop is the first hook to execute and runs before the new deployment bundle is downloaded (DownloadBundle phase). Additionally, AWS Secrets Manager is the correct service for retrieving the rotated database credentials, as it natively supports automatic rotation of secrets, unlike Systems Manager Parameter Store.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook for EC2 that runs before downloading files.
The ApplicationStop hook is identified as the first lifecycle event in an EC2 deployment, executing prior to the DownloadBundle event.
Running the shutdown script during ApplicationStop ensures the web server is stopped before the new package is downloaded or copied.
2
Select the appropriate secrets service that supports automatic rotation.
AWS Secrets Manager is chosen instead of Systems Manager Parameter Store.
AWS Secrets Manager provides built-in, automated credential rotation, meeting the security rotation requirement directly.
3
Configure the script to retrieve the secret at runtime.
The shell script uses the AWS CLI to fetch the secrets from Secrets Manager dynamically using the permissions assigned to the EC2 instance profile.
This avoids hardcoding credentials in the appspec.yml or deployment bundle, maintaining compliance with security best practices.

Key Concept

CodeDeploy EC2 Deployment Lifecycle Hooks and Secrets Management
Estimated Time:1m 30s
Question 60Question →

A developer is configuring an AWS CodeDeploy blue/green deployment for a microservice on Amazon ECS. The deployment must execute a validation Lambda function named `run-integration-tests` immediately after the load balancer routes test traffic to the replacement task set, but before production traffic is shifted. Additionally, the Lambda function needs to retrieve a database credential that must be rotated automatically every 30 days.

Here is a snippet of the AppSpec file being used:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/api-service:2"
LoadBalancerInfo:
ContainerName: "api"
ContainerPort: 8080
Hooks:
- <HOOK_NAME>: "arn:aws:lambda:us-east-1:123456789012:function:run-integration-tests"

Which combination of CodeDeploy lifecycle hook and AWS service configuration will satisfy these requirements?

Show answer & explanation

Answer: Hook: AfterAllowTestTraffic; Service: AWS Secrets Manager

Answer

Hook: AfterAllowTestTraffic; Service: AWS Secrets Manager
The correct configuration uses the AfterAllowTestTraffic hook to trigger the validation Lambda function. In an Amazon ECS deployment, AfterAllowTestTraffic runs after the test listener starts routing traffic to the replacement task set, allowing validation tests to execute before production traffic is shifted. Storing the database password in AWS Secrets Manager is correct because Secrets Manager natively supports automatic rotation of secrets (such as database credentials), whereas Systems Manager Parameter Store does not provide built-in automatic rotation.

Step-by-Step Solution

1
Identify the target deployment platform and the phase where validation tests must run.
The target platform is Amazon ECS. To validate the replacement tasks using test traffic before production traffic is routed, the AfterAllowTestTraffic hook must be used.
AfterAllowTestTraffic executes immediately after test traffic begins routing to the replacement task set, providing the correct window for integration tests.
2
Determine the service to store the database credential based on the security requirements.
AWS Secrets Manager is selected because the database credential requires automatic rotation.
AWS Secrets Manager supports built-in automatic rotation for database credentials, while Systems Manager Parameter Store is primarily for configuration management and does not support native automatic rotation.
3
Validate the IAM service role trust policy requirements for CodeDeploy.
The CodeDeploy service role must allow the 'codedeploy.amazonaws.com' service principal to assume the role.
Configuring the trust policy for 'ecs.amazonaws.com' instead of 'codedeploy.amazonaws.com' will prevent CodeDeploy from assuming the role to perform the deployment.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for Amazon ECS and credential rotation using AWS Secrets Manager.
Estimated Time:1m 30s
PreviousPage 3 / 19Next