Examkin

Deployment

376 questions

All types376Multiple choice191Multiple select171Ordering14
Question 61Question →

A developer is using AWS SAM to build a serverless application. The application defines a Lambda function that needs to consume messages from an Amazon SQS queue. The developer is writing the `template.yaml` file and wants to ensure that the template is parsed correctly as an AWS SAM template and that the Lambda function is granted only the minimum necessary permissions to poll the queue. Which of the following actions should the developer take in the `template.yaml` file to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Include `Transform: AWS::Serverless-2016-10-31` at the root level of the template file.; Add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.

Answer

The correct actions are to include the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file and to add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.
To successfully deploy an AWS SAM application, the template must include the `Transform` declaration at the root level so that CloudFormation can translate the serverless resources. Additionally, to grant the Lambda function the ability to read from the SQS queue with least privilege, the pre-defined `SQSPollerPolicy` template should be added directly under the function's `Policies` property.

Step-by-Step Solution

1
Identify the requirement for AWS SAM template parsing.
Confirm that the `Transform: AWS::Serverless-2016-10-31` header must be included at the top-level root of the template.
Without this declaration, AWS CloudFormation will not trigger the SAM translator, causing deployment to fail when encountering serverless resource types.
2
Determine the appropriate IAM configuration for SQS integration.
Select the `SQSPollerPolicy` SAM policy template and place it in the function's `Policies` property.
This policy template grants the exact minimum permissions (such as `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes`) required for the Lambda service to poll the SQS queue.

Key Concept

AWS SAM template structure requirements and SAM policy templates for IAM permission management.
Question 62Question →

A developer is configuring a blue/green deployment for an application on Amazon ECS using AWS CodeDeploy. The deployment must execute a validation test suite to verify the application's health using a test traffic port before the production traffic is routed to the new task set. Additionally, CodeDeploy must be configured with the necessary permissions to manage the ECS deployment. Which of the following configurations must the developer perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.; Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct options involve configuring the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke a validation Lambda function on the test port, and setting up the CodeDeploy service role's trust policy to allow the codedeploy.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Identify the correct AppSpec lifecycle hook for Amazon ECS validation tests.
Determine that the AfterAllowTestTraffic hook is executed after the test traffic port is directed to the replacement task set, which is the correct time to run validation tests.
ECS deployments use specific hooks like AfterAllowTestTraffic to validate the replacement task set using a test port before moving production traffic.
2
Establish the necessary IAM permissions for CodeDeploy to perform the deployment.
Identify that the CodeDeploy service role must have a trust policy allowing the codedeploy.amazonaws.com service principal to assume the role.
Without this trust policy, CodeDeploy will fail to assume the role and will not be able to interact with Amazon ECS to manage the deployment.

Key Concept

AWS CodeDeploy ECS Deployment Configuration
Question 63Question →

A developer is setting up a deployment pipeline to update a serverless application. The developer is configuring AWS CodeDeploy to perform a Canary deployment of an AWS Lambda function. The deployment process must execute a test Lambda function to validate the deployment before any production traffic is shifted to the new version. Additionally, the CodeDeploy service must be granted the minimal permissions required to orchestrate the deployment on behalf of the developer.

Which configuration steps must the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the appspec.yaml file, define the validation function name under the BeforeAllowTraffic hook within the Hooks section.; Attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume the role.

Answer

To configure the deployment, the developer must define the validation function under the BeforeAllowTraffic hook in the appspec.yaml file, and attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume it.
The correct configurations involve using the BeforeAllowTraffic lifecycle hook in the appspec.yaml file to run a validation Lambda function before traffic shifting begins, and setting up an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role. This permits CodeDeploy to invoke the validation function and orchestrate the deployment.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec lifecycle hook for Lambda deployments.
The BeforeAllowTraffic lifecycle hook is identified as the correct place to run a validation Lambda function before traffic is shifted.
For Lambda deployments, CodeDeploy only supports BeforeAllowTraffic and AfterAllowTraffic hooks, and they must point to validation Lambda functions.
2
Identify the required IAM configuration for the CodeDeploy service role.
A service role with a trust policy allowing codedeploy.amazonaws.com to assume the role is required.
CodeDeploy needs permissions to perform actions (like shifting traffic and invoking validation functions) on your behalf, which is accomplished by assuming the service role.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks and IAM service roles for Lambda deployments.
Estimated Time:2m 0s
Question 64Question →

A developer is using AWS CodeDeploy to manage deployments for a containerized application running on Amazon ECS (Fargate) behind an Application Load Balancer (ALB). The application requires zero downtime during updates. The developer needs to implement a deployment strategy where a new version is validated with exactly 10%10\% of production traffic for 15 minutes before shifting the remaining 90%90\% of traffic. Additionally, a database migration script must be executed automatically after the new task set is created but before it receives any production traffic. The deployment must automatically roll back immediately if the load balancer target group's HTTP 5xx errors spike during the validation window.

Which TWO actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.; Define an AWS Lambda function under the AfterInstall hook in the AppSpec file to execute the database migration script.

Answer

Use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration and define an AWS Lambda function under the AfterInstall hook in the AppSpec file to execute the database migration script.
The correct options are the strategy to use CodeDeployDefault.ECSCanary10Percent15Minutes and using the AfterInstall hook. The deployment configuration Canary10Percent15Minutes routes 10% of traffic to the new task set, waits for 15 minutes, and then routes the remaining 90%. The AfterInstall lifecycle hook in an ECS deployment runs immediately after the replacement task set is created but before it receives any traffic, making it the perfect stage to execute database migrations or pre-traffic checks.

Step-by-Step Solution

1
Analyze the traffic shifting pattern requirements.
The requirement states that 10% of traffic must be routed to the new version for a 15-minute validation period, after which the remaining 90% is shifted. This corresponds directly to a Canary strategy: CodeDeployDefault.ECSCanary10Percent15Minutes.
This establishes the traffic routing configuration for CodeDeploy.
2
Determine the correct lifecycle hook for running database migrations in an ECS deployment.
Identify that the migration must run after the task set is created but before any traffic is routed. In ECS deployments, this matches the AfterInstall hook. EC2 hooks like ApplicationStart are invalid.
This ensures the migration script executes at the correct stage of the deployment sequence without failing due to unsupported platform hooks.
3
Evaluate the rollback trigger configurations.
To roll back immediately within a 15-minute window, the associated CloudWatch Alarm must use a short evaluation period (such as 1 minute or 60 seconds). A 15-minute period would delay the rollback response.
This rules out the incorrect CloudWatch Alarm configuration.

Key Concept

AWS CodeDeploy deployment strategies and AppSpec lifecycle hooks for ECS deployments
Estimated Time:3m 0s
Question 65Question →

A developer is preparing a deployment strategy for a high-traffic HTTP API hosted on AWS Elastic Beanstalk. The deployment must satisfy the following constraints:

1. The API must maintain 100%100\% of its serving capacity throughout the entire deployment process to prevent performance degradation.
2. A small, configurable percentage of live production traffic (e.g., 10%10\%) must be routed to the new version for a 15-minute evaluation period.
3. If any CloudWatch alarms are triggered or health checks fail during this evaluation period, the deployment must automatically roll back by routing all traffic back to the old version and terminating the new instances.
4. The deployment process must be managed entirely within the existing Elastic Beanstalk environment to minimize configuration overhead.

Which deployment policy should the developer configure to meet these requirements?

Show answer & explanation

Answer: Traffic splitting deployment

Answer

Traffic splitting deployment
The correct option is traffic splitting deployment. This deployment policy allows developers to perform canary testing within a single Elastic Beanstalk environment. It launches a temporary Auto Scaling group with the new version, routes a small percentage of production traffic to it, and monitors its health. If any alarms are triggered or health checks fail, Elastic Beanstalk automatically routes all traffic back to the old version and terminates the temporary instances, achieving zero-downtime and 100%100\% capacity maintenance with automated rollback capabilities.

Step-by-Step Solution

1
Analyze the capacity requirement.
The deployment must maintain 100%100\% capacity, which rules out standard Rolling or All-at-once deployments (both temporarily reduce capacity).
To maintain 100%100\% capacity, we need a policy that provisions additional instances before replacing old ones, such as Rolling with additional batch, Immutable, Traffic splitting, or Blue/green.
2
Analyze the traffic routing and testing requirement.
A small, configurable percentage of traffic (e.g., 10%10\%) must be routed to the new version for evaluation, ruling out standard Immutable and Rolling with additional batch policies.
Immutable and Rolling with additional batch immediately serve traffic to the new instances at full scale or in batch increments, without isolating a specific percentage of overall traffic for canary testing.
3
Analyze the environment boundary constraint.
The deployment must occur within a single Elastic Beanstalk environment, ruling out Blue/green deployment.
Blue/green deployment in Elastic Beanstalk requires creating a separate clone environment and swapping CNAMEs, which violates the requirement to avoid multi-environment overhead.
4
Select the policy that meets all criteria.
Traffic splitting deployment meets all constraints: 100%100\% capacity (via temporary Auto Scaling group), configurable canary percentage routing, automated rollback via CloudWatch alarms, and execution within a single environment.
Elastic Beanstalk native traffic splitting is designed specifically for canary testing within a single environment while maintaining 100%100\% capacity.

Key Concept

AWS Elastic Beanstalk Traffic Splitting Deployment
Estimated Time:3m 0s
Question 66Question →

A developer is managing an application infrastructure deployed using AWS CloudFormation. During a stack update, the update fails, and the stack enters the UPDATE_ROLLBACK_FAILED state because an IAM role resource defined in the template was manually deleted from the AWS account out-of-band. Which two actions should the developer take to resolve this issue and return the stack to a usable state? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Manually recreate the IAM role with the exact same name and configuration that existed prior to the deletion, and then continue the update rollback; Perform the ContinueUpdateRollback operation and list the deleted IAM role in the ResourcesToSkip parameter

Answer

To resolve the UPDATE_ROLLBACK_FAILED state caused by an out-of-band deletion, the developer must either manually recreate the IAM role with the same name and config before continuing the rollback, or execute the ContinueUpdateRollback operation while specifying the deleted IAM role in the ResourcesToSkip parameter.
The correct actions are to either recreate the deleted resource manually with the same name to allow the rollback process to interact with it, or skip the resource entirely using the ContinueUpdateRollback operation. Both approaches allow the stack to exit the UPDATE_ROLLBACK_FAILED state.

Step-by-Step Solution

1
Identify the root cause of the rollback failure by inspecting the CloudFormation stack events.
The stack is confirmed to be in the UPDATE_ROLLBACK_FAILED state due to a missing IAM role resource that was deleted out-of-band.
Understanding why the rollback failed is necessary to choose the appropriate recovery strategy.
2
Resolve the rollback blockage by either manually recreating the deleted resource with the matching name or using ContinueUpdateRollback with the ResourcesToSkip parameter.
The stack successfully rolls back to the UPDATE_ROLLBACK_COMPLETE state.
The stack must be brought to a stable completed rollback state before any new update operations can be initiated.
3
Perform a stack update to synchronize any desired configuration changes or recreate resources within the template.
The stack is updated successfully to the UPDATE_COMPLETE state.
This ensures that all resources are correctly aligned with the CloudFormation template.

Key Concept

Handling CloudFormation stack update rollback failures caused by out-of-band resource deletion.
Question 67Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to deploy a containerized application to Amazon ECS. The application requires access to a database password that must be rotated automatically every 30 days. The pipeline must deploy the new version to ECS with zero downtime, using a secure method to supply the database password to the container without exposing it in plaintext in the pipeline artifacts or source code.

Which configuration should the developer implement?

Show answer & explanation

Answer: Store the password in AWS Secrets Manager with automatic rotation enabled. In the Amazon ECS task definition, reference the secret using its ARN in the secrets section. Use AWS CodeDeploy within CodePipeline to perform a Blue/Green deployment for the ECS service.

Answer

Store the password in AWS Secrets Manager with automatic rotation enabled. In the Amazon ECS task definition, reference the secret using its ARN in the secrets section. Use AWS CodeDeploy within CodePipeline to perform a Blue/Green deployment for the ECS service.
The correct answer correctly identifies AWS Secrets Manager as the appropriate service for credentials requiring automatic rotation. It correctly uses the ECS task definition 'secrets' section to securely inject the secret into the container at runtime, and uses AWS CodeDeploy Blue/Green deployment to ensure a zero-downtime deployment.

Step-by-Step Solution

1
Store and secure the secret
The database password is saved in AWS Secrets Manager, and automatic rotation is configured for every 30 days.
Secrets Manager natively supports automatic rotation, meeting the requirement, while Systems Manager Parameter Store does not.
2
Configure ECS task definition integration
The ECS task definition references the Secrets Manager ARN in the 'secrets' parameter, rather than placing it in plaintext environment variables.
This enables the ECS agent to securely retrieve the password and inject it into the container at launch time without exposing it in the pipeline definition.
3
Define the deployment strategy in CodePipeline
A Blue/Green deployment is set up using AWS CodeDeploy as a deploy action in CodePipeline.
A Blue/Green deployment provisions a new task set and routes traffic traffic incrementally or all-at-once to the new tasks, ensuring zero downtime and providing an automated rollback path if the deployment fails.

Key Concept

AWS CodePipeline integration with ECS and AWS Secrets Manager for secure container deployment.
Question 68Question →

A developer is configuring an Amazon ECS task definition to deploy a backend service to AWS Fargate. The service requires sensitive database credentials stored in AWS Systems Manager Parameter Store to be injected as environment variables when the container starts. Additionally, the service logs must be sent directly to Amazon CloudWatch Logs. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Add the ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role.; In the task definition, define the secrets parameter inside the container definition referencing the Parameter Store parameter ARNs, and configure the logConfiguration parameter to use the awslogs log driver.

Answer

The correct configurations are: adding ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role, and defining the secrets parameter referencing the Parameter Store ARNs along with the awslogs log driver in the container definition.
The correct configuration requires adding the necessary permissions to the ECS Task Execution Role, as this is the IAM role used by the ECS container agent to call AWS APIs (like SSM to pull parameters and CloudWatch to write logs) before the containerized application runs. Additionally, the task definition must use the 'secrets' parameter to declare the environment variables mapped to SSM parameters, and configure 'logConfiguration' with the 'awslogs' driver to natively forward standard output and standard error stream logs.

Step-by-Step Solution

1
Determine which role requires permissions for startup operations.
The ECS Task Execution Role is identified because the ECS container agent (not the application code) is responsible for pulling secrets at startup and routing logs.
Understanding the division of responsibilities between the Task Execution Role (agent permissions) and the Task Role (application permissions) is key.
2
Identify the proper configuration syntax in the task definition for secrets and logging.
The 'secrets' parameter is used to map Parameter Store values to environment variables, and the 'logConfiguration' with 'awslogs' driver is used for CloudWatch Logs.
This matches the native ECS integration requirements for secure environment variables and log routing.
3
Grant the necessary IAM permissions to the correct role.
Attach an IAM policy with ssm:GetParameters and logs:PutLogEvents (along with logs:CreateLogStream) to the Task Execution Role.
The ECS agent requires these specific permissions to retrieve the parameters and write log data to CloudWatch.

Key Concept

ECS Task Role vs. Task Execution Role & ECS Secret Injection
Estimated Time:2m 0s
Question 69Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation test against the newly deployed tasks (the green task set) before any production traffic is shifted. If the validation test fails, the deployment must automatically roll back. The developer is defining the AppSpec file in YAML format and configuring the IAM permissions. Which of the following configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the validation Lambda function ARN under the BeforeAllowTraffic hook in the hooks section of the AppSpec file.; Grant the CodeDeploy service role the lambda:InvokeFunction permission for the validation Lambda function.

Answer

Defining the validation Lambda function ARN under the BeforeAllowTraffic hook and granting the CodeDeploy service role the lambda:InvokeFunction permission.
The correct configurations involve using the BeforeAllowTraffic lifecycle hook inside the ECS AppSpec file to point to the validation Lambda function, and ensuring the CodeDeploy service role has the lambda:InvokeFunction permission to run it. The BeforeAllowTraffic hook executes after the green task set is provisioned but before production traffic shifts, enabling testing and automatic rollback on failure.

Step-by-Step Solution

1
Identify the target compute platform and the required validation timing.
The target platform is Amazon ECS and the validation must run before production traffic is shifted.
This establishes that we must use ECS-compatible AppSpec lifecycle hooks.
2
Determine the correct AppSpec hook and execution format for ECS.
For ECS, AppSpec lifecycle hooks can only target AWS Lambda functions, and the BeforeAllowTraffic hook runs before the production traffic shifts.
This rules out using shell scripts (which are EC2-only) and EC2-specific hooks like ValidateService.
3
Determine the required IAM permissions.
CodeDeploy executes the lifecycle hook, so the CodeDeploy service role requires permission to invoke the validation Lambda function.
This distinguishes it from ECS Task Execution permissions, as the task is not the caller of the validation function.

Key Concept

AWS CodeDeploy ECS Blue/Green lifecycle hooks and IAM permissions
Question 70Question →

A developer deployed an infrastructure stack using AWS CloudFormation. Later, a system administrator manually modified the port settings of an Amazon EC2 Security Group directly in the Amazon VPC Console to troubleshoot a connection issue. The developer needs to identify which specific configurations in the deployed stack no longer match the CloudFormation template definition. Which CloudFormation feature should the developer use to achieve this?

Show answer & explanation

Answer: Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.

Answer

Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.
Drift detection is a native CloudFormation feature designed to identify stack resources that have been modified outside of CloudFormation management (out-of-band). It compares the actual state of the resource properties with the expected state defined in the template.

Step-by-Step Solution

1
Analyze the scenario to identify that an out-of-band manual modification has been made to a CloudFormation-managed resource.
The Security Group state has diverged from the template definition.
This establishes that the core issue is configuration drift.
2
Select the CloudFormation feature that inspects and reports on manual deviations.
CloudFormation drift detection is identified as the correct tool.
Drift detection compares stack resource property values against the expected template values to detect differences.

Key Concept

CloudFormation Drift Detection
Estimated Time:45s
Question 71Question →

A developer is packaging a Python application for deployment to AWS Elastic Beanstalk. The application requires a custom Unix user to be created on the host Amazon EC2 instances during environment provisioning. To automate this, the developer creates a configuration file named `01_user.config` containing the user definition. However, after deploying the application source bundle to the Elastic Beanstalk environment, the user is not created and the configuration is ignored.

The layout of the deployed application zip file is as follows:

/
├── application.py
├── requirements.txt
└── config/
└── .ebextensions/
└── 01_user.config

Which action must the developer take to ensure Elastic Beanstalk applies the configuration?

Show answer & explanation

Answer: Move the `.ebextensions` directory to the root of the application source bundle.

Answer

Move the `.ebextensions` directory to the root of the application source bundle.
For AWS Elastic Beanstalk to apply customization settings defined in `.config` files, the `.ebextensions` directory must be at the root of the application source bundle. Placing it inside a folder such as `config/` will cause Elastic Beanstalk to ignore the configurations.

Step-by-Step Solution

1
Analyze the zip file structure of the deployed application.
The `.ebextensions` directory is located inside a `config/` subdirectory.
AWS Elastic Beanstalk scans the root directory of the application source bundle for a folder specifically named `.ebextensions`.
2
Determine the correct directory path and name requirements for configuration files.
The folder must be named `.ebextensions` (with a leading dot) and must be at the root level.
If the folder is placed in a subdirectory or does not have the leading dot, the Elastic Beanstalk platform engine will skip parsing any `.config` files inside it.
3
Move the directory to the root level and deploy the application.
The configuration file will be parsed and the custom user will be successfully created.
Placing the folder at the root matches the expected path pattern that the Elastic Beanstalk host agent searches for during provisioning.

Key Concept

AWS Elastic Beanstalk requires configuration files to be placed in a directory named `.ebextensions` at the root of the application source bundle.
Estimated Time:1m 30s
Question 72Question →

A developer is configuring a blue/green deployment for an Amazon Elastic Container Service (Amazon ECS) service using AWS CodeDeploy and an Application Load Balancer (ALB). The service runs 44 tasks under normal operation. The developer must run automated integration tests against the new version of the application (the replacement task set) in the production environment before routing any live production traffic to it.

Which configuration should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure a test listener on the ALB that points to the replacement target group, specify this listener in the CodeDeploy deployment group, and run the integration tests during the AfterAllowTestTraffic lifecycle hook.

Answer

Configure a test listener on the ALB that points to the replacement target group, specify this listener in the CodeDeploy deployment group, and run the integration tests during the AfterAllowTestTraffic lifecycle hook.
The correct configuration utilizes a dedicated test listener on the Application Load Balancer (ALB) to route traffic specifically to the replacement target group hosting the Green task set. By specifying this test listener in AWS CodeDeploy, developers can target the new deployment for testing. The AfterAllowTestTraffic lifecycle hook runs immediately after the test listener starts directing traffic to the replacement task set, providing the ideal phase to execute automated validation tests before any live production traffic is shifted.

Step-by-Step Solution

1
Identify the mechanism for routing test traffic in AWS CodeDeploy ECS blue/green deployments.
A dedicated test listener must be configured on the Application Load Balancer to direct traffic to the replacement (Green) target group.
This isolates test traffic from production traffic, preventing real users from hitting the unverified deployment.
2
Determine the appropriate lifecycle hook in the AppSpec file to execute the automated integration tests.
The AfterAllowTestTraffic hook is selected.
This hook runs after the test listener starts directing traffic to the replacement task set, allowing test traffic to reach the new version for validation.
3
Verify that the selected hook and listener combination meets all constraints without exposing the new version to production traffic.
The configuration successfully validates the Green task set using the test listener, and only starts shifting production traffic after tests complete successfully.
This satisfies the zero-downtime and pre-traffic validation requirements.

Key Concept

ECS Blue/Green Deployment Validation with CodeDeploy
Question 73Question →

A developer is packaging a web application to be deployed on AWS Elastic Beanstalk. The application requires custom environment configurations and package installations during deployment. To achieve this, which directory at the root of the application source bundle must contain the custom configuration files?

Show answer & explanation

Answer: .ebextensions

Answer

The directory named '.ebextensions' must be placed at the root of the application source bundle to store Elastic Beanstalk configuration files.
The correct option is '.ebextensions'. AWS Elastic Beanstalk searches for configuration files (which must end in '.config') in a directory named '.ebextensions' located at the root of the application source bundle. This allows developers to configure environment options, install packages, and create files on the EC2 instances.

Step-by-Step Solution

1
Identify the purpose of Elastic Beanstalk configuration files.
The files (ending in '.config') are used to customize the software, packages, and environment properties of the EC2 instances in the Elastic Beanstalk environment.
This is a standard way to manage configuration as code in Elastic Beanstalk.
2
Determine the required directory name and location in the application zip/source bundle.
The directory must be named '.ebextensions' (with a leading dot) and positioned at the root level of the source bundle.
Elastic Beanstalk agent runs scripts to parse this specific directory during deployment; any other location or misspelled directory name is ignored.

Key Concept

AWS Elastic Beanstalk configuration files must be stored in the '.ebextensions' folder at the root of the application source bundle.
Question 74Question →

A developer needs to configure a deployment strategy for an application running on AWS Elastic Beanstalk. The application must maintain 100%100\% of its capacity to handle traffic during the deployment process. Due to budget constraints, the developer must minimize the cost of temporary resources launched during the deployment, ruling out a complete duplicate environment or a double-capacity deployment. Which deployment policy should the developer configure?

Show answer & explanation

Answer: Rolling with additional batch

Answer

Rolling with additional batch
The Rolling with additional batch deployment policy launches a new batch of instances with the updated application version first. Once the new batch passes health checks, Elastic Beanstalk updates a batch of the old instances. This process continues until all instances are updated. Because the additional batch is created first, the environment's capacity never drops below 100%100\%, and the additional cost is limited only to the size of the temporary batch rather than a full duplicate environment.

Step-by-Step Solution

1
Analyze capacity requirements.
The application must maintain 100%100\% capacity during deployment, which rules out policies that reduce instance count or take instances offline (such as All at once or standard Rolling).
Ensuring capacity requirements are prioritized first helps filter out policies that cause downtime or reduced capacity.
2
Analyze budget constraints and temporary resource usage.
The requirement to minimize the cost of temporary resources rules out the Immutable policy, which doubles the instance footprint by creating a full replica Auto Scaling group.
Evaluating cost constraints separates policies that maintain capacity using small incremental batches from those using full environment duplication.
3
Select the optimal Elastic Beanstalk deployment policy.
Rolling with additional batch is selected because it keeps full capacity by launching a small extra batch of instances first, avoiding the high cost of duplicating the entire environment.
This strategy satisfies both the 100%100\% capacity constraint and the cost-efficiency constraint.

Key Concept

AWS Elastic Beanstalk Deployment Policies
Estimated Time:1m 30s
Question 75Question →

An application running on Amazon ECS (Fargate) is configured to use AWS CodeDeploy for blue/green deployments. The application resides behind an Application Load Balancer (ALB). The developer needs to configure the deployment pipeline to meet the following requirements:

* The deployment must begin by routing exactly 10%10\% of production traffic to the new task set (replacement task set), and then route the remaining 90%90\% of traffic after exactly 1010 minutes if the deployment remains stable.
* Before any production traffic is routed to the new task set, an automated test suite must run via an AWS Lambda function to validate the deployment's health.
* The deployment must automatically roll back if a specified Amazon CloudWatch alarm is triggered during the 1010-minute baking period.

Which TWO configurations must the developer implement to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Set the deployment configuration in the CodeDeploy deployment group to CodeDeployDefault.ECSCanary10Min10Percent.; In the AppSpec file, define the validation Lambda function under the BeforeAllowTraffic lifecycle hook.

Answer

The developer must configure the deployment group to use the CodeDeployDefault.ECSCanary10Min10Percent strategy and define the validation Lambda function under the BeforeAllowTraffic hook in the AppSpec file.
The correct configurations specify using the CodeDeployDefault.ECSCanary10Min10Percent strategy to route the initial 10%10\% of traffic and wait 1010 minutes before routing the rest. Additionally, specifying the BeforeAllowTraffic hook in the AppSpec file ensures the validation Lambda function runs after the new task set is initialized but before production traffic is directed to it.

Step-by-Step Solution

1
Determine the traffic routing requirements.
Initial 10%10\% routing followed by the remaining 90%90\% after a 1010-minute baking period is a Canary pattern (specifically Canary 10% 10Min). Linear routing is ruled out.
Linear configurations shift traffic incrementally at each interval, whereas Canary configurations shift traffic in two distinct phases.
2
Identify the correct lifecycle hook for running validation tests.
The validation tests must run before any production traffic shifts. The BeforeAllowTraffic hook is the correct ECS deployment hook.
In ECS blue/green deployments, BeforeAllowTraffic executes after tasks are provisioned but before production traffic starts shifting. Other hooks like ValidateService are not supported on ECS, and AfterAllowTraffic runs too late.

Key Concept

ECS Blue/Green deployment traffic routing and lifecycle hook orchestration in AWS CodeDeploy
Question 76Question →

A company runs a high-traffic web application on AWS Elastic Beanstalk. The development team has created a new version of the application that requires custom environment properties and packages a shell script that must run on the underlying EC2 instances during deployment. The deployment must satisfy the following requirements:
- The application must maintain 100% of its serving capacity during the deployment to prevent latency spikes.
- In the event of a deployment failure (such as a health check timeout on the new version), the environment must automatically revert to the previous version with zero downtime and no manual intervention.
- The custom shell script must execute successfully during the deployment before the new version starts receiving production traffic.

Which deployment strategy and configuration action should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure the deployment policy to Immutable. Place the configuration file for the shell script inside a directory named .ebextensions at the root of the application source bundle.

Answer

Configure the deployment policy to Immutable and place the configuration file inside a directory named .ebextensions at the root of the application source bundle.
The Immutable deployment policy fulfills the requirement of maintaining 100% capacity by launching a temporary Auto Scaling group alongside the original one. It also satisfies the automatic rollback requirement because if the health checks fail on the new instances, Elastic Beanstalk automatically deletes the temporary Auto Scaling group, leaving the original instances untouched. Additionally, placing the configuration files in a directory named exactly .ebextensions at the root of the application source bundle ensures that Elastic Beanstalk parses and executes the custom scripts.

Step-by-Step Solution

1
Analyze the capacity requirement during deployment.
The requirement is to maintain 100% serving capacity. This rules out 'All at once' and standard 'Rolling' policies (which take instances out of service), leaving 'Rolling with additional batch' and 'Immutable' as candidates.
Maintaining capacity avoids performance degradation during updates.
2
Analyze the rollback requirement.
The environment must automatically and immediately revert on failure with no manual intervention. 'Rolling with additional batch' does not support automated rollback (it halts and requires a manual rollback deployment). Only 'Immutable' automatically terminates the new temporary Auto Scaling group on failure, achieving instant rollback with zero impact on the active group.
An Immutable deployment isolates the new version in a separate Auto Scaling group during validation, allowing safe and automatic cleanup if it fails.
3
Determine the correct folder path for Elastic Beanstalk configuration files.
Elastic Beanstalk configuration files must reside in the .ebextensions/ folder at the root of the application source bundle. A directory named ebextensions (without the leading dot) will be ignored by Elastic Beanstalk.
Elastic Beanstalk's platform agent specifically looks for the hidden .ebextensions directory to execute configuration scripts.

Key Concept

AWS Elastic Beanstalk deployment policies and .ebextensions configuration
Question 77Question →

A developer is migrating a Node.js web application to an AWS Elastic Beanstalk environment running on an Amazon Linux 2023 platform. The application requires two specific configurations:
1. It must execute a custom shell script named `configure-auth.sh` to download and configure an SSL certificate *after* the application files are extracted and staged on the host, but *before* the application process is launched.
2. It must configure a system environment variable named `DB_MAX_CONN` with a value of `100` across all instances.

Which two actions should the developer take to successfully deploy these customizations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Place the script `configure-auth.sh` in the `.platform/hooks/predeploy/` directory of the application source bundle and ensure it has execute permissions.; Create a configuration file named `db.config` containing the option settings for the `aws:elasticbeanstalk:application:environment` namespace and place it in the `.ebextensions/` directory at the root of the source bundle.

Answer

The developer must place the script in the `.platform/hooks/predeploy/` directory with execution permissions, and place the environment variable configuration file in the `.ebextensions/` directory.
The correct options state that the hook script must be located in `.platform/hooks/predeploy/` with execution permissions, and the configuration file for the environment variable must be located in `.ebextensions/` at the root of the source bundle. Under Amazon Linux 2 and Amazon Linux 2023 platforms, Elastic Beanstalk uses `.platform/hooks/predeploy/` to run custom scripts after the source bundle has been extracted and staged but before the application process is executed. The `.ebextensions/` directory containing configuration files is the standard mechanism to set environment variables through the `aws:elasticbeanstalk:application:environment` namespace.

Step-by-Step Solution

1
Determine the platform hook structure for Amazon Linux 2023.
Identify that script files must be placed in the `.platform/hooks/` subdirectories to execute during lifecycle stages (specifically `predeploy` for actions after staging but before running).
Elastic Beanstalk's Amazon Linux 2 and Amazon Linux 2023 platforms use `.platform/hooks/` instead of older platform hooks methods.
2
Ensure script execution permission.
Add execution permission (`chmod +x`) to `configure-auth.sh` before archiving the bundle.
Scripts in platform hooks must be executable to run successfully.
3
Determine environment variable configuration location.
Identify that the standard configuration directory is `.ebextensions/` (with a leading dot).
Elastic Beanstalk reads configuration files matching `*.config` in the `.ebextensions/` directory at the root of the source bundle.
4
Specify namespace and variable value.
Use `aws:elasticbeanstalk:application:environment` configuration namespace to set `DB_MAX_CONN` to `100`.
This is the correct namespace to inject system environment variables into the application runtime.

Key Concept

AWS Elastic Beanstalk Amazon Linux 2/2023 Platform Customization via .platform and .ebextensions
Estimated Time:3m 0s
Question 78Question →

A developer needs to deploy a new version of a high-traffic web application to an AWS Elastic Beanstalk environment. The deployment must satisfy the following requirements:
- The environment must maintain 100%100\% of its current instance capacity during the deployment to prevent performance degradation.
- In the event of a deployment failure, the rollback process must be quick and have zero impact on the active, healthy instances currently serving production traffic.
- Custom environment properties and configuration files must be applied automatically as part of the application source bundle.

Which deployment strategy and configuration approach should the developer use?

Show answer & explanation

Answer: Use the Immutable deployment policy, and place the configuration files in a .ebextensions folder at the root of the source bundle.

Answer

Use the Immutable deployment policy, and place the configuration files in a .ebextensions folder at the root of the source bundle.
The Immutable deployment policy ensures that a completely new set of instances (in a temporary Auto Scaling group) is created to deploy the new version alongside the existing instances. This maintains 100%100\% capacity of the original environment during the deployment. If the deployment fails, Elastic Beanstalk terminates the new Auto Scaling group, causing zero impact to the original, running instances and allowing an instant rollback. Custom configuration files must be located in a folder named .ebextensions (with a leading dot) at the root of the application source bundle to be processed by Elastic Beanstalk.

Step-by-Step Solution

1
Analyze the capacity requirement during deployment
The requirement specifies that the application must maintain 100%100\% capacity during deployment. This rules out the Rolling policy, which reduces instance capacity as it updates batches.
To maintain 100%100\% capacity, the deployment policy must provision additional instances before taking existing ones out of service or updating them.
2
Analyze the rollback and failure recovery requirement
The rollback must be instant and have zero impact on the existing running instances. Rolling with additional batch requires a rolling rollback to redeploy the previous version, whereas Immutable creates a parallel Auto Scaling group that can be instantly terminated upon failure without touching the original instances.
Immutable deployment offers the cleanest and fastest rollback mechanism because the original production environment remains untouched until the new version passes health checks.
3
Verify the configuration file directory naming convention
Elastic Beanstalk requires configuration files to be placed in a folder named .ebextensions (with a leading dot) at the root of the source bundle. Misnaming it as ebextensions causes the configuration to be ignored.
Elastic Beanstalk specifically scans for the .ebextensions directory at the root level of the application zip archive during provisioning.

Key Concept

AWS Elastic Beanstalk Deployment Policies and Configuration Files
Question 79Question →

A developer needs to configure an update strategy for an application running on AWS Elastic Beanstalk. The application must maintain 100%100\% of its provisioned capacity throughout the deployment process to avoid performance degradation. Which two Elastic Beanstalk deployment policies will ensure that capacity is never reduced during the update? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Immutable; Rolling with additional batch

Answer

The Immutable and Rolling with additional batch deployment policies both ensure that capacity is never reduced during the update.
The Immutable and Rolling with additional batch deployment policies both maintain 100%100\% of the environment's provisioned capacity during an update. Immutable launches a temporary Auto Scaling group to deploy the new version, while Rolling with additional batch launches an extra batch of instances before updating existing ones. In both cases, the existing healthy capacity is never reduced.

Step-by-Step Solution

1
Analyze the capacity requirement during deployment
The application requires 100%100\% of its provisioned capacity to be active at all times.
To prevent performance degradation during the update process.
2
Evaluate in-environment Elastic Beanstalk deployment policies
Immutable deployment deploys to a new temporary Auto Scaling group before switching, and Rolling with additional batch launches an extra batch of instances before updating existing ones. Both keep existing instances fully operational.
To select the strategies that do not take existing capacity offline without replacement.

Key Concept

AWS Elastic Beanstalk deployment policies and their impact on environment capacity.
Question 80Question →

A development team is preparing to update an application hosted on AWS Elastic Beanstalk. The new version requires the installation of an OS-level utility (xml2) on the underlying EC2 instances. Additionally, to guarantee clean system states, the team requires that the update is only applied to newly provisioned instances rather than modifying the existing ones in-place. The update must maintain the application's full serving capacity throughout the deployment process, but the team wants to avoid performing a manual DNS redirection or CNAME swap. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a configuration file inside a directory named .ebextensions at the root level of the application source bundle to install the package.; Configure the deployment policy for the environment to use Immutable updates.

Answer

To meet the requirements, the developer must create a configuration file inside a directory named .ebextensions at the root level of the application source bundle, and configure the environment's deployment policy to use Immutable updates.
To satisfy the requirement of installing custom OS-level packages, the configuration file must be placed inside the .ebextensions directory at the root level of the source bundle. To satisfy the deployment requirements (clean instances, full serving capacity, and no manual CNAME swap), the Immutable deployment policy must be used. This policy provisions a secondary Auto Scaling group with the new version, merges it with the existing group once healthy, and then terminates all the old instances, ensuring no configuration residue exists.

Step-by-Step Solution

1
Determine the correct directory structure for Elastic Beanstalk customization files.
Identify that custom packages must be defined under a .ebextensions folder at the root level of the application source bundle.
Elastic Beanstalk ignores configuration folders that lack the leading dot, such as ebextensions.
2
Evaluate the deployment strategies against the zero-downtime, no CNAME-swap, and clean-instance constraints.
Identify that Immutable deployment provisions a temporary Auto Scaling group with new instances, validates health, and then merges them, terminating the old instances.
Rolling and Rolling with additional batch strategies update existing instances in-place, which leaves configuration residue. A CNAME swap requires manual environment creation and DNS redirection, which is forbidden by the scenario constraints.

Key Concept

AWS Elastic Beanstalk configuration files (.ebextensions) and environment deployment policies.
PreviousPage 4 / 19Next
Deployment Practice Questions — AWS Certified Developer - Associate — Page 4 | Examkin