Examkin

Deployment

376 questions

All types376Multiple choice191Multiple select171Ordering14
Question 161Question →

A developer is managing a batch processing system deployed via an AWS CloudFormation stack. During an update of the stack, the deployment fails because of a resource configuration error, and CloudFormation automatically initiates a rollback. However, the rollback fails because an Amazon S3 bucket that was created by the stack has been manually deleted outside of CloudFormation. The stack is now stuck in the `UPDATE_ROLLBACK_FAILED` state. Which two actions must the developer take to resolve this issue and update the stack? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Perform a `ContinueUpdateRollback` operation using the AWS CLI or CloudFormation console, specifying the logical ID of the deleted Amazon S3 bucket in the resources to skip parameter.; Wait for the stack to transition to the `UPDATE_ROLLBACK_COMPLETE` state, then perform a standard stack update using the corrected template.

Answer

Perform a `ContinueUpdateRollback` operation specifying the logical ID of the deleted S3 bucket to be skipped, and then perform a standard stack update using the corrected template after the stack transitions to the `UPDATE_ROLLBACK_COMPLETE` state.
To recover a stack in the UPDATE_ROLLBACK_FAILED state, you must use ContinueUpdateRollback and skip the resources that are causing the rollback to fail (such as the manually deleted S3 bucket). This allows the rollback operation to complete and the stack to transition to the UPDATE_ROLLBACK_COMPLETE state, which is a stable state. Once the stack is stable, you can perform a normal update with the corrected template to align it with the desired configuration.

Step-by-Step Solution

1
Initiate ContinueUpdateRollback
The stack skips the deleted S3 bucket resource during rollback.
This bypasses the rollback failure caused by the missing bucket.
2
Wait for UPDATE_ROLLBACK_COMPLETE state
The stack status transitions to UPDATE_ROLLBACK_COMPLETE.
The stack must be in a stable state before it can accept new update commands.
3
Run stack update with corrected template
The stack is updated with the corrected configuration.
This updates the resources and template definition to the desired state.

Key Concept

Handling AWS CloudFormation rollback failures and recovering from UPDATE_ROLLBACK_FAILED state by skipping deleted resources.
Question 162Question →

A company is deploying a containerized microservice to Amazon ECS on AWS Fargate using a blue/green deployment managed by AWS CodeDeploy. The deployment must run a database schema migration script before production traffic is routed to the new task set, and it must execute post-deployment integration tests once the traffic routing is complete. Additionally, the deployment process must have the necessary permissions to interact with ECS and Lambda. Which TWO options represent the correct configuration steps required for this deployment?

Select all that apply

Show answer & explanation

Answer: Configure the AppSpec file with a BeforeAllowTraffic lifecycle hook pointing to a Lambda function that runs the database migration, and an AfterAllowTraffic hook pointing to a Lambda function that executes the post-deployment tests.; Configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

Configure the AppSpec file with a BeforeAllowTraffic hook pointing to a Lambda function to run the database migration and an AfterAllowTraffic hook pointing to a Lambda function for post-deployment tests, and configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct configurations involve using ECS-compatible AppSpec hooks (BeforeAllowTraffic and AfterAllowTraffic invoking Lambda functions) and establishing the correct trust relationship on the CodeDeploy service role (trusting codedeploy.amazonaws.com to perform sts:AssumeRole).

Step-by-Step Solution

1
Analyze the target compute platform and the required hooks.
Since the target platform is Amazon ECS, CodeDeploy lifecycle hooks must invoke AWS Lambda functions rather than executing local shell scripts.
ECS AppSpec syntax specifies Lambda functions for hooks, whereas EC2 AppSpec supports shell script execution.
2
Determine the correct sequencing for database migrations and post-deployment validation.
Migrations must happen before production traffic shifts (BeforeAllowTraffic), and integration tests must run after traffic shifts completely (AfterAllowTraffic).
Running migrations after traffic shifts would cause errors on the new task set, and tests must validate the live production traffic state.
3
Establish the necessary IAM authorization for CodeDeploy.
Configure a trust policy (trust relationship) on the CodeDeploy service role to allow the service principal codedeploy.amazonaws.com to assume it.
A trust policy is required for AWS services to assume a role and perform actions on resources in your account.

Key Concept

AWS CodeDeploy ECS Deployment Lifecycle Hooks and IAM Service Role Configuration
Question 163Question →

A developer is configuring a test stage in AWS CodePipeline that invokes an AWS Lambda function to run integration tests against an Amazon RDS database. The Lambda function requires access to the database credentials and must inform CodePipeline of the test execution results so the pipeline can proceed or halt. Which configuration steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret.; Program the Lambda function to parse the job ID from the event payload and invoke PutJobSuccessResult or PutJobFailureResult to report the outcome to CodePipeline.

Answer

Store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret. Program the Lambda function to parse the job ID from the event payload and invoke PutJobSuccessResult or PutJobFailureResult to report the outcome to CodePipeline.
The correct steps involve securely managing credentials and properly signaling CodePipeline. Storing database credentials in AWS Secrets Manager is secure and supports automatic rotation. Additionally, AWS CodePipeline expects any invoked Lambda action to notify it of success or failure by calling PutJobSuccessResult or PutJobFailureResult using the job ID extracted from the event payload.

Step-by-Step Solution

1
Analyze how AWS CodePipeline interacts with custom Lambda actions.
The Lambda function receives a job details payload from CodePipeline containing a unique job ID.
This job ID is required to notify CodePipeline of the action's success or failure using the appropriate API calls.
2
Implement the completion signaling logic inside the Lambda function.
The Lambda code calls PutJobSuccessResult on success or PutJobFailureResult on failure, passing the job ID.
If the Lambda function does not send this signal, CodePipeline will remain in the 'InProgress' state until the action times out.
3
Evaluate options for secure credential retrieval.
Database credentials should be stored in AWS Secrets Manager, and the Lambda execution role must be granted permissions to retrieve them.
This ensures the credentials are encrypted, not hardcoded in the codebase, and can be rotated automatically.

Key Concept

AWS CodePipeline integration with AWS Lambda requires the Lambda function to explicitly return status using the PutJobSuccessResult or PutJobFailureResult API, and secrets should be managed securely using AWS Secrets Manager.
Estimated Time:2m 0s
Question 164Question →

A developer is configuring an in-place deployment in AWS CodeDeploy for an application running on a fleet of 1212 Amazon EC2 instances. To prevent performance degradation during peak hours, the application must maintain at least 75%75\% of its serving capacity online and healthy at all times during the update. The developer wants to configure the deployment to update the maximum number of instances simultaneously while strictly adhering to this availability constraint. Which configuration should the developer use?

Show answer & explanation

Answer: Create a custom deployment configuration with Minimum Healthy Hosts defined as a type of FLEET_PERCENT with a value of 7575.

Answer

Create a custom deployment configuration with Minimum Healthy Hosts defined as a type of FLEET_PERCENT with a value of 7575.
The correct option ensures that 75%75\% of the instance capacity (99 instances) remains healthy and online during the deployment. This allows CodeDeploy to update the remaining 33 instances (25%25\%) in parallel, completing the deployment as quickly as possible without violating the availability threshold.

Step-by-Step Solution

1
Calculate the minimum number of healthy instances required.
At least 99 instances must remain online (12×0.75=912 \times 0.75 = 9).
This establishes the target capacity baseline that cannot be breached during the rolling update.
2
Evaluate the maximum number of instances that can be updated simultaneously.
A maximum of 33 instances can be updated at any given time (12−9=312 - 9 = 3).
To complete the deployment as fast as possible, CodeDeploy should update the maximum allowable instances (33) in each batch.
3
Determine the type and value for the Minimum Healthy Hosts parameter.
Set Minimum Healthy Hosts to a type of FLEET_PERCENT with a value of 7575 (or HOST_COUNT with a value of 99).
Using FLEET_PERCENT with 75%75\% ensures that 99 instances remain online. The predefined configurations (such as HalfAtATime) or setting HOST_COUNT to 33 would violate the constraint or deploy slower than necessary.

Key Concept

Custom deployment configurations in AWS CodeDeploy allow developers to define availability requirements using the Minimum Healthy Hosts parameter, specified as either a percentage or absolute host count.
Estimated Time:2m 0s
Question 165Question →

A developer is attempting to update an AWS CloudFormation stack that manages a microservices application. During a previous update attempt, a custom resource failed to stabilize, triggering a rollback. During the rollback, the stack became stuck in the `UPDATE_ROLLBACK_FAILED` state because an IAM role resource defined in the template had been manually deleted from the AWS account. The developer has created a new IAM role and needs to update the stack to use this new role.

How should the developer resolve this issue and successfully apply the update to the stack?

Show answer & explanation

Answer: Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.

Answer

Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.
The correct option outlines the required operational procedure for recovering a stack from the UPDATE_ROLLBACK_FAILED state when a resource (the IAM role) has been deleted out-of-band. The developer must use the ContinueUpdateRollback operation and opt to skip the deleted resource. This allows CloudFormation to bypass the missing resource and complete the rollback sequence, shifting the stack status to UPDATE_ROLLBACK_COMPLETE. From there, a regular stack update can be initiated using the corrected template that points to the new IAM role.

Step-by-Step Solution

1
Acknowledge the current stack state.
The stack is stuck in the UPDATE_ROLLBACK_FAILED state, which blocks any direct update actions.
CloudFormation prevents updates on stacks that are not in a clean, stable state (such as UPDATE_ROLLBACK_COMPLETE or CREATE_COMPLETE).
2
Trigger the ContinueUpdateRollback process.
The rollback resumes, but normally it would fail again because the IAM role is missing.
Initiating ContinueUpdateRollback is the only way to move the stack out of the failed rollback state.
3
Skip the deleted IAM role resource during the ContinueUpdateRollback operation.
CloudFormation marks the rollback of the missing IAM role as complete without attempting to modify it, allowing the rest of the stack rollback to finish successfully.
Skipping resources that cannot be rolled back (due to manual deletion) prevents the rollback from failing again.
4
Verify stack state and perform the update.
The stack reaches the UPDATE_ROLLBACK_COMPLETE state, and the developer successfully deploys the new template pointing to the new IAM role.
Once the stack is stable, it can process standard update requests normally.

Key Concept

CloudFormation Rollback Troubleshooting and Recovery
Question 166Question →

A developer needs to update an Amazon ECS service that runs behind an Application Load Balancer. To prevent any service degradation, the service must maintain 100% of its desired task capacity at all times during the update. Additionally, the service is allowed to provision up to double its desired capacity temporarily to perform the rolling update. Which configuration of deployment parameters should the developer apply to the ECS service?

Show answer & explanation

Answer: Set the minimum healthy percent to 100% and the maximum percent to 200%

Answer

Set the minimum healthy percent to 100% and the maximum percent to 200%
Setting the minimum healthy percent to 100% ensures that the desired capacity is maintained at all times, preventing any service degradation. Setting the maximum percent to 200% allows ECS to launch the new version of tasks up to double the desired count before stopping any of the existing tasks, enabling a smooth rolling update with zero downtime.

Step-by-Step Solution

1
Identify the minimum capacity requirement from the scenario.
The minimum healthy percent must be set to 100% to ensure that the service capacity never drops below 100% of the desired task count at any point.
To prevent service degradation, the application must maintain full capacity during the update.
2
Identify the maximum allowable capacity during the update.
The maximum percent must be set to 200% to allow the service to temporarily scale up to double its desired task count.
Provisioning up to double the capacity allows Amazon ECS to start new version tasks before draining and terminating the old version tasks.

Key Concept

Amazon ECS service rolling update parameters (minimum healthy percent and maximum percent)
Question 167Question →

A developer is designing an AWS CloudFormation template to deploy an application that connects to an Amazon RDS database. The developer needs to store the database credentials securely and prevent the database from being accidentally deleted if the CloudFormation stack is deleted or updated. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and retrieve them in the template using dynamic references.; Configure the DeletionPolicy attribute with a value of Retain on the database resource in the template.

Answer

To securely manage the credentials and protect the database, the developer should store the database credentials in AWS Secrets Manager and retrieve them using dynamic references, and also configure the DeletionPolicy attribute with a value of Retain on the RDS database resource in the template.
Storing credentials in AWS Secrets Manager and referencing them using dynamic references keeps sensitive values encrypted and out of the template code. Setting the DeletionPolicy to Retain on the RDS resource prevents CloudFormation from deleting the database when the stack is deleted or the resource is updated out of the stack.

Step-by-Step Solution

1
Select a secure storage mechanism for the database credentials.
Determine that AWS Secrets Manager is the correct service for storing database credentials, and referencing it via CloudFormation dynamic references keeps them secure.
Hardcoding secrets or using unencrypted parameter types exposes sensitive information, violating security best practices.
2
Select a policy to prevent accidental resource deletion.
Determine that the DeletionPolicy attribute should be set to Retain on the RDS resource definition.
The Retain policy ensures that CloudFormation keeps the physical resource even if its stack is deleted or if the resource is removed during a stack update.
3
Eliminate incorrect options based on common AWS misconfigurations.
Discard options suggesting plaintext Parameter Store parameters, out-of-band console changes (which cause drift), or updating a stack that is currently in a rollback state.
These choices introduce security vulnerabilities, drift issues, or violate CloudFormation state machine rules.

Key Concept

AWS CloudFormation Resource Lifecycle and Credential Management
Question 168Question →

An application team wants to automate the deployment of an AWS Serverless Application Model (SAM) project. The workflow requires compiling code, performing security tests, getting manual sign-off from a release manager, and updating a staging stack. The team sets up AWS CodePipeline to coordinate these actions. Arrange the sequence of operations in the correct order that occurs during a single execution of this pipeline, from the detection of a commit to the completion of the stack deployment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, detecting the commit and archiving the source to the S3 artifact bucket; second, running CodeBuild to package the application and upload the output template; third, pausing for manual approval and notifying via SNS; fourth, creating the CloudFormation change set; and fifth, executing the change set to update the staging resources.
The correct execution flow starts with the source step where code is archived in S3. Next, CodeBuild generates the packaged template. Then, the execution pauses for manual approval. Finally, CloudFormation deploys the updates by first creating the change set and then executing it.

Step-by-Step Solution

1
Source detection and storage
The source code is retrieved and uploaded to the Amazon S3 artifact store.
AWS CodePipeline is an artifact-driven service; any pipeline execution must start by fetching the code from the source stage and making it available as an input artifact.
2
Package the application using AWS CodeBuild
A packaged CloudFormation template is written back to the Amazon S3 artifact bucket.
The build stage uses the source input artifact to compile code and package resources, producing a new output artifact for deployment.
3
Halt execution for manual approval
The execution stops, and an Amazon SNS message is published to alert the team.
Manual approval must be placed before deployment actions to prevent unverified artifacts from modifying target environments.
4
Create a CloudFormation change set
CloudFormation processes the packaged template artifact and generates a change set.
A two-step CloudFormation deployment requires creating a change set first to define the differences between the current and proposed stack state.
5
Execute the CloudFormation change set
The stack is updated, deploying the new resource configurations.
Once the change set is generated, it must be executed to apply the actual modifications to the staging environment.

Key Concept

AWS CodePipeline execution lifecycle, stage sequencing, and the separation of CloudFormation deployment steps into creating and executing change sets.
Question 169Question →

A web application is deployed as a Docker container on Amazon ECS using the AWS Fargate launch type. The application's Go code utilizes the AWS SDK to retrieve configuration files from an Amazon S3 bucket. Which IAM role must be configured with Amazon S3 read permissions to allow the application code to access the bucket?

Show answer & explanation

Answer: The ECS Task Role

Answer

The ECS Task Role
The ECS Task Role is the IAM role assumed by the container itself. AWS SDKs running inside the container retrieve credentials from this role automatically, allowing the application code to interact with AWS services like Amazon S3.

Step-by-Step Solution

1
Identify the entity requiring access to the Amazon S3 bucket.
The application code running inside the container requires access to read S3 objects.
This determines whether we need a role for the application code or a role for the ECS infrastructure agent.
2
Select the ECS task parameter designed for application-level AWS API permissions.
The ECS Task Role (taskRoleArn) provides temporary credentials directly to the containerized application.
The Task Execution Role is for ECS agent tasks (like image pulls and logging), whereas the Task Role is for application code tasks.

Key Concept

ECS Task Role vs Task Execution Role
Estimated Time:45s
Question 170Question →

A developer is deploying a Go application to AWS Elastic Beanstalk running on Amazon Linux 2023. The deployment must satisfy two requirements: set custom environment properties that the application reads at runtime, and run a bash script to install a monitoring agent after the application files are extracted but before the application process is started. Which two steps should the developer take to configure the application source bundle? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a configuration file with a .config extension inside a directory named .ebextensions at the root of the source bundle, defining the properties under the aws:elasticbeanstalk:application:environment namespace.; Place the bash script in the .platform/hooks/predeploy directory at the root of the source bundle and ensure the script has execute permissions.

Answer

To deploy the Go application with the given requirements, the developer must create a configuration file inside the .ebextensions directory at the root of the application source bundle to set the environment properties under the application environment namespace, and place the startup script inside the .platform/hooks/predeploy directory at the root of the source bundle.
To configure environment properties via configuration files, the properties must be defined in a .config file inside the .ebextensions directory at the root of the source bundle under the aws:elasticbeanstalk:application:environment namespace. To run scripts during deployment on Amazon Linux 2023, you must use platform hooks placed in the .platform/hooks/predeploy directory to execute after staging but before the application starts.

Step-by-Step Solution

1
Configure environment properties in the source bundle.
Create a directory named .ebextensions at the root of the project, add a file ending in .config, and define option_settings under the aws:elasticbeanstalk:application:environment namespace.
This is the default mechanism for declaring custom application properties/environment variables within the Elastic Beanstalk source bundle.
2
Configure the deployment script execution stage.
Create the path .platform/hooks/predeploy at the root of the project, place the script inside it, and make it executable.
On Amazon Linux 2023 platforms, platform hooks located in .platform/hooks/predeploy automatically execute after staging the application but before launching the web server/process.

Key Concept

Elastic Beanstalk environment configuration via .ebextensions and custom scripts using .platform hooks
Estimated Time:2m 0s
Question 171Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline that deploys a serverless application using AWS CloudFormation. The pipeline needs to pass a database password to the CloudFormation deploy stage. The database password must be rotated automatically every 30 days to comply with company security policies. Additionally, the CloudFormation action in CodePipeline must assume a specific deployment IAM role in the production account to create and update resources. Which configuration should the developer implement to meet these requirements securely and with the least operational overhead?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.

Answer

Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.
The correct configuration uses AWS Secrets Manager for secret storage because it offers built-in automatic rotation. In addition, to allow AWS CodePipeline to assume the deployment IAM role, the trust policy of the deployment role must be updated to allow the CodePipeline service principal to assume it. This satisfies all requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify the database password rotation requirement.
Determine that AWS Secrets Manager is the correct service because it natively supports automatic rotation, unlike Systems Manager Parameter Store.
Parameter Store lacks native, automated rotation, which would require custom Lambda scripts, adding operational overhead.
2
Determine the required trust relationship for the deployment role.
Identify that the CloudFormation deployment IAM role needs to trust the CodePipeline service principal (codepipeline.amazonaws.com).
The deployment role must allow CodePipeline to assume it via a trust policy, which is distinct from a permissions policy.
3
Combine both configurations.
Choose the configuration that stores the secret in Secrets Manager and correctly modifies the trust policy of the deployment role.
This ensures both security compliance for secret rotation and correct delegation of IAM permissions.

Key Concept

Integrating AWS CodePipeline with AWS Secrets Manager and cross-account or cross-action IAM roles.
Question 172Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application requires a database connection string that is stored as a secure string in Systems Manager Parameter Store. The developer wants the connection string to be automatically injected as a container environment variable at startup without modifying the application code to retrieve it. Which configuration will meet these requirements?

Show answer & explanation

Answer: Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.

Answer

Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.
Referencing the Systems Manager Parameter Store parameter ARN in the `secrets` section of the container definition tells the ECS agent to retrieve the parameter and inject it as an environment variable at container startup. Because this action is performed by the ECS container agent before the containerized application is running, the ECS Task Execution Role must contain the `ssm:GetParameters` permission.

Step-by-Step Solution

1
Identify the component responsible for retrieving the secret at container startup.
The Amazon ECS container agent is responsible for fetching the secret and injecting it as an environment variable before the application starts.
Since the application code itself is not retrieving the secret via the SDK, the ECS agent needs the direct permission.
2
Select the correct IAM role for the ECS container agent permissions.
The Task Execution Role must be used.
The Task Execution Role is utilized by the ECS agent to perform actions on behalf of the task (such as pulling container images, writing logs, and retrieving secrets), whereas the Task Role is for the application container itself.
3
Configure the task definition container definition.
Map the environment variable in the `secrets` array pointing to the SSM Parameter Store parameter ARN, and ensure the trust policy of the Task Execution Role allows the `ecs-tasks.amazonaws.com` service to assume it.
This binds the parameter to the environment variable securely and allows the ECS service to successfully assume the execution role.

Key Concept

Delineation between ECS Task Role and ECS Task Execution Role for secret management
Estimated Time:1m 30s
Question 173Question →

A developer is configuring a multi-stage release pipeline in AWS CodePipeline. The first stage contains a Source action that retrieves code from an AWS CodeCommit repository, and the developer has assigned the namespace `SourceVariables` to this action. In a downstream Deploy stage, the developer wants to reference the specific commit ID that triggered the pipeline execution to dynamic-tag the deployment resources. Which of the following is the correct method to pass this commit ID variable from the Source stage to the Deploy stage?

Show answer & explanation

Answer: Configure the Deploy action to reference the variable using the syntax `#{SourceVariables.CommitId}` in its configuration parameters.

Answer

Configure the Deploy action to reference the variable using the syntax `#{SourceVariables.CommitId}` in its configuration parameters.
AWS CodePipeline supports namespaces and variables to share execution-state data between different actions. By setting a namespace (like 'SourceVariables') on an action, any of its output variables, such as 'CommitId', can be referenced in downstream action configurations using the syntax '#{Namespace.VariableName}'. Therefore, configuring the Deploy action with '#{SourceVariables.CommitId}' is the correct method.

Step-by-Step Solution

1
Identify the requirement to pass runtime metadata (Commit ID) from an upstream Source stage to a downstream Deploy stage.
The developer needs to utilize AWS CodePipeline's native variable sharing capability.
Native variables are the most efficient way to share dynamic data between pipeline actions without external dependencies.
2
Locate the namespace configured on the upstream action.
The source action namespace is defined as 'SourceVariables'.
Variables are grouped under a namespace to avoid collision and to reference them uniquely.
3
Reference the variable in the downstream action configuration using the syntax: `#{Namespace.VariableName}`.
The dynamic reference is formatted as `#{SourceVariables.CommitId}`.
This is the syntax recognized by CodePipeline to resolve variables at runtime.

Key Concept

AWS CodePipeline Action Variables and Namespaces
Question 174Question →

An operations team writes a CloudFormation template containing an AWS::Serverless::Function resource. When they attempt to deploy this template using the AWS CLI, CloudFormation returns an error stating that the resource type is invalid or unsupported. What is the root cause of this deployment failure?

Show answer & explanation

Answer: The template does not include the required Transform declaration to invoke the AWS Serverless Application Model parser.

Answer

The template does not include the required Transform declaration to invoke the AWS Serverless Application Model parser.
The correct answer is correct because AWS CloudFormation requires the Transform declaration (specifically Transform: AWS::Serverless-2016-10-31) at the root of the template. Without this declaration, CloudFormation does not recognize or parse custom resource types like AWS::Serverless::Function, resulting in an invalid resource type error.

Step-by-Step Solution

1
Identify the resource types declared in the template.
The template contains the resource type AWS::Serverless::Function.
AWS::Serverless::Function is a custom resource type defined by the AWS Serverless Application Model (SAM).
2
Determine how CloudFormation processes SAM resource types.
CloudFormation requires the Transform: AWS::Serverless-2016-10-31 declaration to translate these resource types.
Without the Transform declaration, CloudFormation treats the template as standard CloudFormation and does not recognize the AWS::Serverless namespace.
3
Diagnose the error message indicating the resource type is invalid.
The lack of the Transform header causes CloudFormation to reject AWS::Serverless::Function.
Adding the Transform declaration resolves this issue by invoking the SAM translator before processing the resources.

Key Concept

AWS SAM templates require a Transform declaration (Transform: AWS::Serverless-2016-10-31) at the root level so that CloudFormation can translate serverless resources into standard CloudFormation resources.
Question 175Question →

A developer is setting up a build process in AWS CodeBuild that requires a database password and a software license key. The database password must be rotated automatically on a regular schedule, whereas the license key is a static configuration parameter that does not require rotation. The developer wants to retrieve these values securely during the build phase.

Which combination of steps will meet these requirements in the most secure and cost-effective manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it in the env/secrets-manager section of the buildspec file.; Store the license key in AWS Systems Manager Parameter Store and reference it in the env/parameter-store section of the buildspec file.

Answer

Store the database password in AWS Secrets Manager and reference it in the env/secrets-manager section of the buildspec file, and store the license key in AWS Systems Manager Parameter Store and reference it in the env/parameter-store section of the buildspec file.
Storing the database password in AWS Secrets Manager enables native, automatic rotation of the credential, which can be securely fetched at build time by referencing it in the env/secrets-manager section of the buildspec file. For the static license key, AWS Systems Manager Parameter Store is a cost-effective and secure solution that does not require rotation, and can be retrieved using the env/parameter-store section of the buildspec file.

Step-by-Step Solution

1
Analyze rotation requirements for the sensitive data.
The database password requires automatic rotation, making AWS Secrets Manager the ideal service. The software license key is static and does not require rotation, making AWS Systems Manager Parameter Store a more cost-effective option.
Choosing the correct storage service based on rotation needs optimizes security and cost.
2
Identify how AWS CodeBuild references these external configurations in the buildspec file.
Secrets Manager secrets are referenced in the env/secrets-manager section, and Parameter Store parameters are referenced in the env/parameter-store section.
Using the native CodeBuild buildspec environment syntax ensures the secrets are fetched securely at runtime during the build.

Key Concept

AWS CodeBuild environment variable retrieval from Secrets Manager and Systems Manager Parameter Store
Estimated Time:50s
Question 176Question →

A developer is updating a critical production web application deployed on AWS Elastic Beanstalk. The deployment process must ensure zero downtime and support an immediate rollback to the previous version if the new version fails health checks. Which two Elastic Beanstalk deployment strategies or options meet these requirements?

Select all that apply

Show answer & explanation

Answer: Blue/Green deployment using a CNAME swap; Immutable deployment

Answer

The correct options are Blue/Green deployment using a CNAME swap and Immutable deployment.
Blue/Green deployment using a CNAME swap and Immutable deployment both satisfy the requirements. A Blue/Green deployment routes traffic to a completely separate environment, allowing an immediate rollback by swapping CNAME records back if the new version fails. An Immutable deployment deploys the new version to a temporary Auto Scaling group alongside the original one. If health checks fail, the temporary group is deleted immediately, leaving the original instances unaffected.

Step-by-Step Solution

1
Analyze the application requirements.
The application requires zero downtime and a method to roll back immediately if the update fails.
This filters out deployment strategies that cause downtime or have slow rollback mechanisms.
2
Evaluate the downtime characteristics of the deployment strategies.
All-at-once causes downtime, and Rolling reduces serving capacity. Immutable, Rolling with additional batch, and Blue/Green deployments do not cause downtime.
To maintain zero downtime and full capacity, we must look at strategies that avoid in-place service degradation.
3
Evaluate the rollback speed of the zero-downtime strategies.
Rolling with additional batch requires a slow, sequential redeployment to roll back. Immutable and Blue/Green deployments allow for an immediate rollback because they maintain the old version on separate, untouched instances.
Selecting strategies that support immediate rollback satisfies the final constraint.

Key Concept

AWS Elastic Beanstalk deployment strategies and their trade-offs regarding downtime, capacity, and rollback speed.
Question 177Question →

A developer is configuring a continuous integration and continuous delivery (CI/CD) pipeline in AWS CodePipeline. The pipeline includes a test stage that invokes an AWS Lambda function to run integration tests against a database. The Lambda function requires database credentials to connect to the database and must notify CodePipeline of the success or failure of the tests. Which of the following actions should the developer perform to configure this setup securely and correctly? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and grant the Lambda function's IAM execution role permission to retrieve the secret.; Grant the Lambda function's IAM execution role permission to perform the codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult API operations.

Answer

To configure this setup securely and correctly, the developer should store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret. Additionally, the Lambda execution role must be granted permissions to call the codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult API operations to report the job status back to CodePipeline.
Storing database credentials in AWS Secrets Manager allows secure storage and automatic rotation of secrets. The Lambda execution role must be granted permissions to retrieve this secret to connect to the database. Additionally, when CodePipeline invokes a Lambda function, the function runs asynchronously and must report the outcome back to CodePipeline. The Lambda function's execution role requires permission to call codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult to update the pipeline stage status.

Step-by-Step Solution

1
Determine the secure method for storing and retrieving database credentials.
Identify AWS Secrets Manager as the appropriate service because it supports built-in rotation and secure runtime retrieval, unlike Systems Manager Parameter Store standard parameters.
This prevents credentials from being hardcoded in code or configuration files, adhering to security best practices.
2
Determine the required permissions for CodePipeline integration with Lambda.
Identify that the Lambda function must report its execution status back to CodePipeline to mark the stage as success or failure using the PutJobSuccessResult or PutJobFailureResult API operations.
Lambda tasks in CodePipeline run asynchronously. CodePipeline expects the function to send a success or failure token to complete the job; otherwise, the pipeline stage will remain in progress until it times out.

Key Concept

When AWS CodePipeline invokes an AWS Lambda function, the Lambda function must report back success or failure using the PutJobSuccessResult or PutJobFailureResult API calls. Additionally, database credentials should be stored securely in AWS Secrets Manager rather than in Parameter Store (which lacks native rotation for standard parameters) or hardcoded.
Question 178Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The ECS task needs to pull the container image from a private Amazon ECR repository and send container logs to Amazon CloudWatch. Once running, the application code inside the container must read data files from an Amazon S3 bucket.

Which two IAM configuration steps must the developer take in the ECS task definition to grant these permissions?

Select all that apply

Show answer & explanation

Answer: Configure the Task Execution Role with permissions to pull the container image from Amazon ECR and send logs to Amazon CloudWatch.; Configure the Task Role with permissions to read objects from the Amazon S3 bucket.

Answer

Configure the Task Execution Role with permissions to pull the container image from Amazon ECR and send logs to Amazon CloudWatch, and configure the Task Role with permissions to read objects from the Amazon S3 bucket.
To deploy the application securely, the developer must use two separate IAM roles. The Task Execution Role is required by the Amazon ECS container agent to authenticate with Amazon ECR to pull the Docker image and to create log streams in Amazon CloudWatch before the container starts. The Task Role is assumed by the application code running inside the container to authorize calls to other AWS services, such as reading files from the Amazon S3 bucket.

Step-by-Step Solution

1
Identify the permissions needed by the ECS agent / container runtime vs the application code.
ECR image pulling and CloudWatch log streaming are performed by the ECS agent, while S3 reading is performed by the application code.
This separation determines which IAM roles need to be configured in the task definition.
2
Assign the ECS agent permissions to the Task Execution Role.
The Task Execution Role receives permissions for ECR and CloudWatch.
The Task Execution Role is used by the infrastructure to set up the task before application code runs.
3
Assign the application permissions to the Task Role.
The Task Role receives permissions for S3 bucket access.
The Task Role is assumed by the containerized application at runtime to make AWS SDK calls.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role
Question 179Question →

A developer is designing a deployment strategy for a containerized web application running on Amazon ECS (Fargate) behind an Application Load Balancer. The service currently runs with a desired task count of 88. The deployment must satisfy the following constraints:

* The application must maintain 100%100\% of its capacity (at least 88 healthy tasks) during the deployment process.
* The AWS account has a strict service quota that prevents running more than 1010 concurrent tasks for this service.
* If the new container version fails to launch or fails container health checks, the deployment must automatically roll back to the previous version without manual intervention or DNS changes.

Which two configurations should the developer use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS service rolling update parameters with a minimum healthy percent of 100%100\% and a maximum percent of 125%125\%.; Enable the ECS deployment circuit breaker with the rollback feature enabled on the service.

Answer

Configure the ECS service rolling update parameters with a minimum healthy percent of 100%100\% and a maximum percent of 125%125\%, and enable the ECS deployment circuit breaker with the rollback feature enabled on the service.
To maintain 100%100\% capacity during the deployment of a service with 88 desired tasks, at least 88 tasks must remain healthy, which translates to a minimum healthy percent of 100%100\%. To not exceed 1010 tasks total (which is 125%125\% of 88), the maximum percent must be set to 125%125\%. In this configuration, ECS will launch 22 new tasks, wait for them to pass health checks, and then terminate 22 old tasks, repeating the process. Enabling the ECS deployment circuit breaker with rollback ensures that if these new tasks fail to launch or fail health checks, the deployment is automatically canceled and the service rolls back to the previous stable task definition without manual effort or DNS changes.

Step-by-Step Solution

1
Calculate the capacity and task count boundaries based on the constraints.
The minimum healthy task count must be at least 88 (100%100\% of desired). The maximum concurrent tasks cannot exceed 1010, which represents 125%125\% of the desired 88 tasks (10/8=1.2510 / 8 = 1.25).
This establishes the mathematical bounds for the ECS service's minimumHealthyPercent and maximumPercent configurations.
2
Determine the correct deployment mechanism that respects the task limit.
An ECS rolling update starts a batch of new tasks (up to 22 tasks, which is 25%25\% of desired) before stopping the old ones. A CodeDeploy blue/green deployment requires launching an entire second task set (88 tasks), which violates the 1010 task limit.
This rules out blue/green deployment options in favor of an ECS rolling update.
3
Select the appropriate automated rollback mechanism that doesn't rely on DNS.
Enable the ECS deployment circuit breaker with rollback. This built-in ECS feature detects launch or health check failures and automatically rolls back the deployment to the last stable state.
This fulfills the requirement of automatic, rapid rollback without manual intervention or DNS routing updates.

Key Concept

ECS Rolling Update parameters (minimumHealthyPercent and maximumPercent) control task capacity during deployment, while ECS deployment circuit breaker provides automated rollbacks without DNS modifications.
Estimated Time:2m 30s
Question 180Question →

A developer is preparing to deploy a containerized financial API to Amazon ECS using the AWS Fargate launch type. The API application code utilizes the AWS SDK to decrypt sensitive transaction payloads at runtime using a customer managed key in AWS KMS. Additionally, the ECS agent must pull the API container image from a private Amazon ECR repository and send stdout/stderr logs to Amazon CloudWatch Logs. Which two IAM configuration steps must the developer perform to grant the necessary permissions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach a policy allowing the kms:Decrypt action to the IAM role configured as the Task Role in the task definition.; Attach a policy allowing the ecr:BatchGetImage and logs:PutLogEvents actions to the IAM role configured as the Task Execution Role in the task definition.

Answer

The developer must attach a policy allowing the kms:Decrypt action to the Task Role, and attach a policy allowing the ecr:BatchGetImage and logs:PutLogEvents actions to the Task Execution Role.
The application code uses the AWS SDK to decrypt payloads at runtime, which requires the ECS Task Role to have permissions for the kms:Decrypt action. On the other hand, pulling the image from Amazon ECR and writing logs to CloudWatch are operations executed by the ECS agent on the host, meaning the ECS Task Execution Role must have permissions for ECR image pull actions and CloudWatch Logs stream creation/log ingestion.

Step-by-Step Solution

1
Determine the role needed for application-level AWS SDK calls.
The application code running inside the container performs decryption via the AWS SDK at runtime, which requires the ECS Task Role to have kms:Decrypt permissions.
The Task Role provides AWS credentials directly to the containerized application.
2
Determine the role needed for container agent-level tasks.
The ECS container agent needs to pull the container image from ECR and send stdout/stderr logs to CloudWatch Logs, which requires the ECS Task Execution Role to have ecr:BatchGetImage and logs:PutLogEvents permissions.
The Task Execution Role provides AWS credentials to the ECS agent running on the underlying host, enabling it to perform tasks on behalf of the container before it starts.

Key Concept

Delineation between ECS Task Role and ECS Task Execution Role
PreviousPage 9 / 19Next
Deployment Practice Questions — AWS Certified Developer - Associate — Page 9 | Examkin