All practice questions

976 questions

All types976 Multiple choice502 Multiple select450 Ordering24

A SysOps administrator is managing an AWS CloudFormation template that deploys a web application hosted on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer. The ASG has a desired capacity of $4$ instances. The administrator is preparing to deploy an application update by updating the Amazon Machine Image (AMI) reference in the ASG's Launch Template.

The deployment must satisfy the following operational requirements:
- The update must be zero-downtime and maintain at least the desired capacity of $4$ healthy instances in service throughout the entire update process.
- Each new instance must be verified as fully initialized and running the application successfully before any existing instance is terminated.
- If any new instance fails to initialize within a specified timeframe, the deployment must automatically roll back to the original Launch Template version without administrative intervention.

Which configuration should the administrator implement to meet these requirements?

Set the CloudFormation UpdatePolicy for the ASG to use AutoScalingReplacingUpdate. Configure WaitOnResourceSignals to false, and rely on the Application Load Balancer's target group health checks to automatically trigger a rollback of the CloudFormation stack if any new instance is marked unhealthy.

Use AWS Systems Manager Run Command to perform an in-place update of the application code on the existing EC2 instances. Configure an AWS Config rule to monitor the instance compliance status and trigger a rollback if any instance reports a non-compliant state.

Set the CloudFormation UpdatePolicy for the ASG to use AutoScalingRollingUpdate. Configure MinInstancesInService to

4

, MaxBatchSize to

2

, and WaitOnResourceSignals to true. In the Launch Template UserData, execute the cfn-signal helper script after the application starts and passes health checks.

Set the CloudFormation UpdatePolicy for the ASG to use AutoScalingRollingUpdate. Configure MinInstancesInService to

4

and WaitOnResourceSignals to true. Configure the EC2 instance profile to allow the instances to assume an IAM role with stack update permissions so they can update the CloudFormation stack status directly via the AWS CLI.

Show answer & explanation

Answer: Set the CloudFormation UpdatePolicy for the ASG to use AutoScalingRollingUpdate. Configure MinInstancesInService to $4$ , MaxBatchSize to $2$ , and WaitOnResourceSignals to true. In the Launch Template UserData, execute the cfn-signal helper script after the application starts and passes health checks.

Answer

Set the CloudFormation UpdatePolicy for the ASG to use AutoScalingRollingUpdate, configure MinInstancesInService to 4, MaxBatchSize to 2, and WaitOnResourceSignals to true, and execute the cfn-signal helper script in the UserData after the application starts and passes health checks.

To perform a rolling update that maintains the desired capacity of

4

instances, you must use the AutoScalingRollingUpdate update policy with MinInstancesInService set to

4

. Because the desired capacity is

4

, CloudFormation will launch new instances first (up to the MaxBatchSize of

2

) before terminating any old instances, temporarily expanding the Auto Scaling group size to

6

. Setting WaitOnResourceSignals to true forces CloudFormation to wait for the cfn-signal script to be executed from within the instances' UserData before considering them healthy and proceeding with the update. If the signals are not received within the timeout period, CloudFormation aborts the update and rolls back the Auto Scaling group to its original launch template configuration, preventing downtime.

Step-by-Step Solution

Determine the rolling update policy and capacity constraint.

Select AutoScalingRollingUpdate and set MinInstancesInService to

4

This guarantees that the active instance count does not fall below the desired capacity of

4

during the deployment.

Configure the update batch size and temporary capacity expansion.

Set MaxBatchSize to

2

This allows CloudFormation to temporarily launch

2

new instances (bringing the total to

6

) before terminating any old instances, since the minimum in-service capacity of

4

must be maintained.

Implement health verification and rollback triggers.

Set WaitOnResourceSignals to true and add cfn-signal to UserData.

This forces CloudFormation to pause the update until the new instances signal that the application is running successfully. If a signal is not received within the timeout, CloudFormation automatically rolls back the stack.

Key Concept

AWS CloudFormation Auto Scaling Group Rolling Updates with Resource Signals

Estimated Time:2m 0s

Question 762Question →

A company runs a critical web application on a fleet of Amazon EC2 instances managed by an Amazon EC2 Auto Scaling group behind an Application Load Balancer. A SysOps Administrator is setting up a deployment pipeline using AWS CodeDeploy. The deployment process must satisfy the following requirements:
- The application must not experience any downtime during updates.
- If the update fails, the application must be rolled back to the previous version immediately without requiring the redeployment of code or launching of new instances during the rollback process.
- The deployment process must minimize the temporary increase in running instance costs.

Which deployment strategy and configuration should the Administrator choose to meet these requirements?

Configure an in-place deployment with a custom deployment configuration of 75% minimum healthy hosts, and rely on automatic rollbacks to redirect traffic to the previous version without redeployment.

Configure an AWS CloudFormation rolling update with rollback alarms, assuming that CloudFormation will keep the failed EC2 instances running in their current state to avoid launching new instances during rollback.

Configure a blue/green deployment that deploys to a replacement Auto Scaling group, routes traffic using a canary configuration, and terminates the original instances immediately after the deployment succeeds.

Configure a blue/green deployment, but omit the IAM execution service role from the deployment configuration to allow CodeDeploy to default to the EC2 instance profile.

Show answer & explanation

Answer: Configure a blue/green deployment that deploys to a replacement Auto Scaling group, routes traffic using a canary configuration, and terminates the original instances immediately after the deployment succeeds.

Answer

The correct answer is to configure a blue/green deployment that deploys to a replacement Auto Scaling group, routes traffic using a canary configuration, and terminates the original instances immediately after the deployment succeeds. This setup ensures zero downtime by verifying the new code on a separate fleet, provides near-instantaneous rollback by redirecting the load balancer back to the original fleet without redeploying code or launching new instances during the rollback, and minimizes extra costs by immediately cleaning up the original fleet once success is confirmed.

Step-by-Step Solution

Analyze the zero-downtime and immediate rollback requirements.

Identify that a blue/green deployment is necessary because the original instances remain untouched during the update, allowing traffic to be immediately routed back if a failure occurs.

In-place updates overwrite the running instance code, meaning rollbacks require a complete redeployment cycle, which is not immediate.

Address the requirement to minimize the temporary increase in running instance costs.

Configure the deployment to terminate the original instances immediately after the deployment successfully completes and traffic is fully shifted.

This limits the duration that two parallel sets of EC2 instances are running, keeping temporary costs to a minimum.

Ensure CodeDeploy has the necessary permissions to execute the deployment.

Provide CodeDeploy with a service role that has permissions to manage Auto Scaling groups and load balancers.

Omitting the service role or lacking the PassRole permission prevents CodeDeploy from performing the necessary actions on AWS resources.

Key Concept

AWS CodeDeploy deployment strategies and rollback mechanics

Question 763Question →

A SysOps administrator needs to automatically stop any Amazon EC2 instance that transitions to the running state in a development AWS account. Which configuration will achieve this with the least operational overhead?

Configure an Amazon EventBridge rule that filters for EC2 Instance State-change Notification events, and configure the target to be an AWS Config custom compliance rule that triggers an instance shutdown.

Create an Amazon EventBridge rule that filters for EC2 Instance State-change Notification events where the state is running, and configure the target to execute the AWS-StopEC2Instance Systems Manager Automation runbook.

Create an Amazon EventBridge rule that targets the Systems Manager Automation runbook, configuring an IAM service role for EventBridge but omitting the iam:PassRole permission from the administrator's policy.

Enable detailed monitoring on the EC2 instances to reduce the state-change metric latency to 1 minute, and configure a CloudWatch alarm to trigger an Auto Scaling policy that stops the instance.

Show answer & explanation

Answer: Create an Amazon EventBridge rule that filters for EC2 Instance State-change Notification events where the state is running, and configure the target to execute the AWS-StopEC2Instance Systems Manager Automation runbook.

Answer

The correct answer is to use an Amazon EventBridge rule that filters for EC2 Instance State-change Notification events and targets the AWS-StopEC2Instance runbook. EventBridge provides a direct, native, and near-real-time integration with Systems Manager Automation without requiring additional monitoring configurations or custom code, making it the option with the least operational overhead.

Step-by-Step Solution

Identify the event source and event type for EC2 instance state changes.

The event source is 'aws.ec2' and the detail-type is 'EC2 Instance State-change Notification' with the state set to 'running'.

This allows Amazon EventBridge to detect the state change immediately when the instance starts.

Select a remediation target that requires the least development and operational overhead.

The AWS-StopEC2Instance runbook provided by Systems Manager Automation can stop the instance without writing custom code.

Using an out-of-the-box Systems Manager runbook is more efficient than writing a custom AWS Lambda function.

Configure an EventBridge rule that connects the event source to the target runbook with the necessary IAM execution permissions.

An EventBridge rule is created to capture the running state event and trigger the Systems Manager Automation target.

This establishes the complete event-driven automation loop.

Key Concept

Using Amazon EventBridge rules to target AWS Systems Manager Automation runbooks for automated event-driven remediation of resource states.

Estimated Time:1m 0s

Question 764Question →

A SysOps Administrator is setting up an Amazon CloudWatch metric filter to parse JSON logs from an application. The logs contain the following structure:

{ "request_id": "req-102", "service": "billing", "response_time_ms": 350, "status": "FAIL" }

The administrator wants to create a custom metric to track the number of failed billing requests that exceed a response time of $300$ ms. The administrator needs to record these occurrences at a $1$ -minute resolution in CloudWatch. Which configuration should the administrator use?

Define a metric filter with the pattern `{

.service = "billing" &&

.status = "FAIL" &&

.response_time_ms > 300 }` with a metric value of `

`, and enable Detailed Monitoring on the underlying log group to ensure a

1$-minute resolution.

Define a metric filter with the pattern `{

.service = "billing" &&

.status = "FAIL" &&

.response_time_ms > 300 }` with a metric value of `

`, and configure the log group retention period to

1$ day to enforce the metric reporting interval.

Define a metric filter with the pattern `{

.service = "billing" &&

.status = "FAIL" &&

.response_time_ms > 300 }` and a metric value of `

`. The metric filter will automatically publish data points to the custom metric at a

1$-minute resolution as matching events occur.

Define a metric filter with the pattern `{

.service = "billing" &&

.status = "FAIL" &&

.response_time_ms > 300 }` and set the filter destination directly to an AWS Systems Manager Automation document to run at a

1$-minute interval.

Show answer & explanation

Answer: Define a metric filter with the pattern `{ $.service = "billing" &&$ .status = "FAIL" && $.response_time_ms > 300 }` and a metric value of `$ 1 $`. The metric filter will automatically publish data points to the custom metric at a$ 1$-minute resolution as matching events occur.

Answer

Define a metric filter with the pattern `{

.service = "billing" &&

.status = "FAIL" &&

.response_time_ms > 300 }` and a metric value of `

`. The metric filter will automatically publish data points to the custom metric at a

1$-minute resolution as matching events occur.

The correct configuration uses the JSON query syntax `{

.service = "billing" &&

.status = "FAIL" &&

.response_time_ms > 300 }` to select the target logs, incrementing the custom metric by `

` for each match. By default, custom metrics published via metric filters report data points at a

1$-minute resolution without requiring additional setups.

Step-by-Step Solution

Construct the JSON filter pattern using standard CloudWatch Logs syntax.

The pattern `{

.service = "billing" &&

.status = "FAIL" &&

.response_time_ms > 300 }` matches log entries where the service is billing, status is FAIL, and latency exceeds

300$ ms.

CloudWatch Logs parses JSON properties using the `$.property_name` notation.

Assign the metric value for counting occurrences.

Setting the metric value to `

1

` increments the count by `

1

` every time a matching log line is parsed.

This measures the count of events matching the error state.

Evaluate metric resolution and destination routing features.

CloudWatch metric filters write custom metrics at a standard

1

-minute resolution by default.

No additional configuration (like Detailed Monitoring or retention adjustment) is required or valid for altering metric filter reporting frequency.

Key Concept

CloudWatch Logs Metric Filters for structured JSON logs

Question 765Question →

An operations team manages a containerized service on Amazon ECS with a desired task count of $4$ . Due to strict resource limits on the hosting infrastructure, the deployment of a new task definition version must not run more than $4$ tasks concurrently. The service must remain online and accept traffic throughout the deployment, even if at a temporarily reduced capacity.

Which two deployment parameters must a SysOps administrator configure in the ECS service definition to meet these requirements? (Choose two.)

Select all that apply

Set the `minimumHealthyPercent` parameter to

50

Set the `maximumPercent` parameter to

100

Set the `minimumHealthyPercent` parameter to

100

Set the `maximumPercent` parameter to

150

Configure the deployment controller type to use AWS CodeDeploy for a blue/green deployment

Show answer & explanation

Answer: Set the `minimumHealthyPercent` parameter to $50$ ; Set the `maximumPercent` parameter to $100$

Answer

The correct parameters to configure are setting the minimum healthy percent parameter to 50 and setting the maximum percent parameter to 100.

To satisfy the constraint of never exceeding

4

concurrent tasks, the `maximumPercent` parameter must be set to

100

. This prevents Amazon ECS from starting new tasks before stopping older versions. To ensure the service remains online during the rolling update, the `minimumHealthyPercent` must be set to a value less than

100

, such as

50

, which allows ECS to stop half of the tasks (

2

tasks) to make room for new tasks while the remaining

2

tasks continue to serve traffic.

Step-by-Step Solution

Analyze the maximum capacity constraint.

The total tasks running concurrently must not exceed

4

, which is the desired count. Therefore, the `maximumPercent` must be set to

100

Setting `maximumPercent` to

100

prevents Amazon ECS from launching new tasks until existing tasks are stopped.

Analyze the service availability constraint.

The service must remain online and accept traffic, which means some tasks must remain healthy. Since `maximumPercent` is

100

, ECS must stop tasks before launching new ones. Setting `minimumHealthyPercent` to

50

allows ECS to stop

2

tasks, keeping

2

active to serve traffic.

Setting `minimumHealthyPercent` to

50

ensures that at least

50\%

of the desired count (

2

tasks) are always running and healthy during the rolling update.

Key Concept

Amazon ECS rolling update deployment parameters

Question 766Question →

A SysOps administrator is managing an Amazon EC2 Auto Scaling group (ASG) that hosts a batch processing application. To accommodate a predictable surge in workload, the administrator configured a scheduled scaling action to increase the desired capacity of the ASG from $2$ to $10$ instances daily at 06:00 UTC. However, the administrator notices that the desired capacity remains at $2$ at 06:00 UTC, and no scaling occurs. The administrator verifies that dynamic scaling policies triggered by CloudWatch alarms are still scaling the group successfully. What is the most likely cause of this issue?

The ScheduledActions scaling process of the Auto Scaling group has been suspended.

The cooldown period of the Auto Scaling group is currently active, preventing any changes to the desired capacity.

The CloudWatch alarm associated with the scheduled scaling action has been disabled or deleted.

The Auto Scaling group's service-linked role lacks the iam:PassRole permission to execute scheduled tasks.

Show answer & explanation

Answer: The ScheduledActions scaling process of the Auto Scaling group has been suspended.

Answer

The ScheduledActions scaling process of the Auto Scaling group has been suspended.

The correct answer is that the ScheduledActions scaling process of the Auto Scaling group has been suspended. Amazon EC2 Auto Scaling allows you to suspend and resume individual scaling processes. If ScheduledActions is suspended, the Auto Scaling group will not execute any scheduled scaling actions. However, since processes like Launch and AlarmNotification are still active, dynamic scaling policies triggered by CloudWatch alarms will continue to work.

Step-by-Step Solution

Identify the symptoms of the scaling failure.

Scheduled scaling actions are not executing, but dynamic scaling via CloudWatch alarms is functioning properly.

This indicates that resource launching, terminating, and alarm notification processes are active, pointing to a process-specific suspension.

Analyze the impact of Auto Scaling suspended processes.

Suspending the ScheduledActions process specifically halts scheduled scaling actions without impacting other activities.

Auto Scaling allows administrators to suspend and resume individual processes to troubleshoot or manage the group.

Eliminate other potential causes.

Cooldown periods do not affect scheduled scaling. Scheduled actions do not use CloudWatch alarms. Service-linked roles have built-in permissions.

These alternate explanations are inconsistent with AWS Auto Scaling architecture and functionality.

Key Concept

Auto Scaling Suspended Processes

Question 767Question →

A SysOps Administrator is designing a deployment process for a stateless web application hosted on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The update process must meet the following operational requirements:

1. The application's total serving capacity must not decrease during the deployment.
2. A small, controlled percentage ( $10\%$ ) of live production traffic must be routed to the new version to perform canary testing.
3. If target group $5\text{XX}$ errors or latency metrics exceed predefined Amazon CloudWatch thresholds, the deployment must automatically roll back within minutes.
4. Active user sessions on the stable version must not be disconnected, terminated, or disrupted during the rollback process.

Which two deployment actions or configurations should the SysOps Administrator implement to achieve these requirements? (Select two.)

Select all that apply

Deploy the new version of the application to a new, separate Auto Scaling group registered to a new ALB target group, and configure the ALB listener rules to use weighted target groups to route

10\%

of traffic to the new target group and

90\%

to the original target group.

Create a CloudWatch alarm for the new target group's HTTP

5\text{XX}

metric that triggers an AWS Lambda function to update the ALB listener rule weights, shifting

100\%

of traffic back to the original target group if thresholds are exceeded.

Use AWS CodeDeploy with a Blue/Green deployment type, and select a canary deployment configuration (such as CodeDeployDefault.EC2.Canary10Percent10Minutes) to gradually shift traffic to the new Auto Scaling group.

Configure an Amazon Route 53 weighted routing policy with a TTL of

0

seconds pointing to two separate ALBs (one for each application version), and configure Route 53 DNS failover to automatically route traffic away from the new version if health checks fail.

Use AWS CloudFormation with a rolling update policy (AutoScalingRollingUpdate) on the existing Auto Scaling group, setting MinInstancesInService to match the desired capacity, and configuring AutoScalingRollbackRecommendation to revert the stack if CloudWatch alarms are triggered.

Show answer & explanation

Answer: Deploy the new version of the application to a new, separate Auto Scaling group registered to a new ALB target group, and configure the ALB listener rules to use weighted target groups to route $10\%$ of traffic to the new target group and $90\%$ to the original target group.; Create a CloudWatch alarm for the new target group's HTTP $5\text{XX}$ metric that triggers an AWS Lambda function to update the ALB listener rule weights, shifting $100\%$ of traffic back to the original target group if thresholds are exceeded.

Answer

Deploy the new version of the application to a new, separate Auto Scaling group registered to a new ALB target group, configure the ALB listener rules to route

10\%

of traffic to the new target group and

90\%

to the original target group, and configure a CloudWatch alarm for the new target group's HTTP

5\text{XX}

metric to trigger an AWS Lambda function that shifts

100\%

of traffic back to the original target group if thresholds are exceeded.

The correct approach uses ALB weighted target groups to route

10\%

of live traffic to a new, separate Auto Scaling group representing the green version, while the remaining

90\%

continues to flow to the stable blue version. A CloudWatch alarm monitoring HTTP

5\text{XX}

errors on the new target group triggers an AWS Lambda function to immediately modify the listener rule weights, restoring

100\%

of the traffic to the original target group. This ensures rapid rollback within minutes, maintains full capacity, and preserves active sessions on the stable version.

Step-by-Step Solution

Isolate the deployment environment by creating a new Auto Scaling group and registering its instances to a separate ALB target group.

The original Auto Scaling group continues running at full capacity, ensuring no performance degradation during the update.

This guarantees that the original stable environment remains fully operational and untouched.

Modify the ALB listener rule to distribute traffic using weights, routing

10\%

to the new target group and

90\%

to the original target group.

A controlled subset (

10\%

) of live traffic is directed to the new version for canary testing.

ALB weighted target groups allow precise, instantaneous traffic routing control without relying on DNS-based shifting.

Set up an Amazon CloudWatch alarm on the HTTP

5\text{XX}

metric for the new target group with a short evaluation period (e.g.,

1

minute).

The system monitors the health of the canary version in real-time.

Immediate detection of application errors is required to satisfy the rapid rollback timeline.

Configure the CloudWatch alarm to trigger an AWS Lambda function that updates the ALB listener rule to set the weight of the new target group to

0\%

and the original target group to

100\%

If errors spike, all traffic is redirected back to the stable version immediately, and active sessions on the stable version remain undisturbed.

This automates the rollback and completes the operation within minutes of the alarm triggering.

Key Concept

Application Load Balancer (ALB) Weighted Target Groups and CodeDeploy EC2 Limitations

Question 768Question →

A SysOps administrator needs to deploy a custom application update to a fleet of $20$ Amazon EC2 instances by using AWS Systems Manager Run Command. The administrator wants to execute the deployment in a rolling manner to maintain application availability, ensuring that at least $15$ instances remain online and healthy during the process. Additionally, the deployment must stop immediately if more than $2$ instances fail the installation to prevent further errors across the fleet.

Which two configurations should the administrator specify when executing the Run Command? (Select TWO.)

Select all that apply

Set the Max Concurrency rate control parameter to

5

25\%

Set the Max Errors rate control parameter to

2

10\%

Set the Max Concurrency rate control parameter to

15

75\%

Configure a target patch group with the tag key 'PatchGroup' and associate it with a custom patch baseline.

Configure an IAM role with the 'iam:AssumeRole' permission for the Systems Manager service role instead of 'iam:PassRole' permissions.

Show answer & explanation

Answer: Set the Max Concurrency rate control parameter to $5$ or $25\%$ .; Set the Max Errors rate control parameter to $2$ or $10\%$ .

Answer

To configure the rolling deployment correctly using AWS Systems Manager Run Command, the administrator must set the Max Concurrency rate control parameter to

5

25\%

and the Max Errors rate control parameter to

2

10\%

The correct configurations are setting the Max Concurrency rate control parameter to

5

25\%

and the Max Errors rate control parameter to

2

10\%

. Setting Max Concurrency to

5

limits the active deployment target count to

5

instances at any time, leaving

15

instances (

75\%

) active to serve traffic. Setting Max Errors to

2

halts the execution of the Run Command across the remaining fleet as soon as

2

instances report a failure, minimizing the impact of a faulty deployment.

Step-by-Step Solution

Calculate the allowed concurrency for the deployment fleet.

With a total of

20

instances and a requirement that at least

15

instances must remain online, the maximum number of instances that can be updated concurrently is

20 - 15 = 5

instances (which is

25\%

of the fleet).

This ensures that the update is applied in a rolling manner without violating the minimum capacity requirement.

Determine the error threshold to stop the execution.

To stop the deployment immediately if more than

2

instances fail, set the failure limit to

2

instances (which is

10\%

of the fleet).

Setting this limit prevents the command from being sent to the rest of the fleet once the threshold is met.

Apply these values to the Systems Manager Run Command rate control settings.

Specify a Max Concurrency of

5

(or

25\%

) and Max Errors of

2

(or

10\%

) in the Run Command configuration.

These parameters directly govern the execution rate and halt behavior of the deployment task.

Key Concept

AWS Systems Manager Run Command rate controls (Max Concurrency and Max Errors) allow SysOps administrators to manage rolling deployments and control fault tolerance across large fleets of instances.

Question 769Question →

A SysOps Administrator is configuring a blue/green deployment strategy using AWS CodeDeploy for an application running on Amazon EC2 instances. The deployment must meet the following requirements:
- The deployment must automatically roll back if any of the replacement instances exceed a specific memory utilization threshold during the deployment.
- The original EC2 instances must remain active for 2 hours after traffic has successfully shifted to the replacement instances to allow for final validation.

Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon CloudWatch alarm based on memory metrics collected by the CloudWatch agent on the replacement instances, and add this alarm to the deployment group's auto-rollback configuration.

Configure the deployment group to terminate the original instances after a successful deployment, setting the wait time before termination to 2 hours.

Configure the deployment group to keep the original instances running indefinitely, and configure a scheduled AWS Systems Manager runbook to terminate the replacement instances after 2 hours.

Enable detailed monitoring on the EC2 instances to collect standard memory utilization metrics at 1-minute intervals, and associate this metric with the rollback alarm.

Add the `iam:PassRole` permission to the EC2 instances' IAM role to allow the Amazon CloudWatch agent to delegate permissions to AWS CodeDeploy.

Show answer & explanation

Answer: Create an Amazon CloudWatch alarm based on memory metrics collected by the CloudWatch agent on the replacement instances, and add this alarm to the deployment group's auto-rollback configuration.; Configure the deployment group to terminate the original instances after a successful deployment, setting the wait time before termination to 2 hours.

Answer

Create an Amazon CloudWatch alarm based on memory metrics collected by the CloudWatch agent on the replacement instances, and add this alarm to the deployment group's auto-rollback configuration. In addition, configure the deployment group to terminate the original instances after a successful deployment, setting the wait time before termination to 2 hours.

To monitor memory utilization, which is an operating system-level metric not captured by default EC2 metrics, the CloudWatch agent must be installed to send custom metrics. A CloudWatch alarm is then created and integrated with the CodeDeploy deployment group to trigger an automatic rollback when memory usage exceeds the defined threshold. Additionally, to keep the original instances for validation and ensure they are terminated automatically after 2 hours, the deployment group's success action must be configured to terminate the original instances with a 2-hour delay.

Step-by-Step Solution

Identify the requirement for tracking memory utilization and triggering a rollback.

Realize that memory utilization is an operating system-level metric and not part of the standard CloudWatch hypervisor metrics. Therefore, the CloudWatch agent must be installed on the replacement instances to send custom memory metrics.

Default and detailed EC2 monitoring do not include memory usage. The resulting custom metric must be used to create a CloudWatch alarm that CodeDeploy can monitor for automatic rollbacks.

Identify the requirement to retain the original instances for 2 hours before cleanup.

Set the deployment group's action on deployment success to terminate the original instances after a specified time, and configure the duration to 2 hours (120 minutes).

This automatically retains the old fleet during the verification window, allowing for manual checks or automatic rollbacks, and then terminates them to stop charges.

Key Concept

Integrating custom operating system metrics with CodeDeploy rollback triggers and managing instance lifecycle termination delays in blue/green deployments.

Estimated Time:2m 30s

Question 770Question →

An organization wants to automatically send a notification to an Amazon SNS topic whenever an Amazon EC2 instance changes its state to 'stopped'. Which event-driven solution should a SysOps administrator implement to meet this requirement with the least operational overhead?

Configure an AWS Config rule to monitor the EC2 instance state, and configure an AWS Systems Manager Automation document as a remediation action to publish a message to the SNS topic.

Enable detailed monitoring on all EC2 instances to capture state changes, and configure a CloudWatch metric filter to trigger the Amazon SNS notification.

Create an Amazon EventBridge rule that filters for EC2 Instance State-change Notification events with a state of stopped, and set the target to the Amazon SNS topic.

Create an IAM role with the iam:PassRole permission to allow the EC2 instances to directly notify the Amazon SNS topic upon transition to the stopped state.

Show answer & explanation

Answer: Create an Amazon EventBridge rule that filters for EC2 Instance State-change Notification events with a state of stopped, and set the target to the Amazon SNS topic.

Answer

Create an Amazon EventBridge rule that filters for EC2 Instance State-change Notification events with a state of stopped, and set the target to the Amazon SNS topic.

Amazon EventBridge natively monitors EC2 instance state changes as events. A rule filtering for the 'stopped' state can target an Amazon SNS topic directly, providing a simple, serverless, and low-overhead event-driven solution.

Step-by-Step Solution

Identify the event source and trigger mechanism for EC2 state changes.

Amazon EC2 natively emits state-change events to Amazon EventBridge when instances transition between states (such as running, stopping, and stopped).

EventBridge is the standard AWS service for capturing and responding to resource state changes in real time.

Configure the Amazon EventBridge rule target.

Define the target of the EventBridge rule as the designated Amazon SNS topic.

EventBridge integrates directly with Amazon SNS, allowing it to send event payloads to the topic without requiring intermediary compute resources such as AWS Lambda or Systems Manager Automation.

Key Concept

Utilizing Amazon EventBridge to route native EC2 state-change events directly to Amazon SNS for low-overhead notifications.

Estimated Time:45s

Question 771Question →

A company hosts a high-traffic web application on AWS Elastic Beanstalk. A SysOps Administrator must configure a deployment strategy for an upcoming application update that satisfies the following operational requirements:

1. The application must maintain $100\%$ of its serving capacity throughout the deployment process.
2. The rollback process must be immediate and automated if the new version fails post-deployment health checks.
3. The strategy must not rely on DNS routing changes or CNAME swaps, as downstream client applications cache DNS records with long Time to Live (TTL) values.

Which deployment strategy should the SysOps Administrator select to meet these requirements?

Immutable deployment

Rolling with additional batch deployment

Blue/Green deployment

Rolling deployment

Show answer & explanation

Answer: Immutable deployment

Answer

Immutable deployment

The correct option is the one specifying an Immutable deployment. An Immutable deployment launches a temporary Auto Scaling group with the new version alongside the existing one. This satisfies the

100\%

capacity requirement because the old instances remain fully operational. Traffic is shifted to the new instances within the same environment, avoiding any DNS or CNAME modifications. If post-deployment health checks fail, Elastic Beanstalk terminates the temporary Auto Scaling group, immediately returning the environment to its original state.

Step-by-Step Solution

Evaluate the capacity requirement.

Standard rolling deployments are eliminated because they reduce active instance capacity during updates. Rolling with additional batch, Immutable, and Blue/Green deployments all preserve capacity.

The scenario requires maintaining

100\%

serving capacity at all times.

Evaluate the rollback and DNS requirements.

Blue/Green deployments are eliminated because they rely on DNS CNAME swaps, which violate the constraint against DNS routing changes due to long client-side TTL caching.

DNS-based switchovers are slow to propagate if clients cache old records.

Compare the remaining strategies (Immutable vs. Rolling with additional batch) on rollback performance.

Immutable deployments are selected. Rolling with additional batch updates existing instances in-place, which requires a slow batch-by-batch redeployment of the old version to roll back. Immutable deployments run on a temporary Auto Scaling group that can be instantly terminated if health checks fail, resulting in an immediate rollback.

Only Immutable deployments offer clean, immediate rollbacks without in-place modification of existing resources.

Key Concept

Selecting and configuring AWS Elastic Beanstalk deployment policies to meet capacity, rollback speed, and DNS routing constraints.

Estimated Time:2m 0s

Question 772Question →

A SysOps Administrator is managing a production web application deployed on AWS Elastic Beanstalk. The application must maintain its full capacity of $8$ running instances at all times to handle peak traffic. The administrator needs to deploy a new application version with zero downtime. The deployment strategy must also support a rapid, automatic rollback to the previous version without requiring a full redeployment of the older application version package if any post-deployment health checks fail. Which deployment strategy should the administrator implement to meet these requirements?

Configure the Elastic Beanstalk environment to use the Immutable deployment policy.

Configure the Elastic Beanstalk environment to use the Rolling with additional batch deployment policy.

Configure the Elastic Beanstalk environment to use the Rolling deployment policy.

Configure a Blue/Green deployment by cloning the environment and performing a CNAME swap, without pre-warming the instances in the new environment.

Show answer & explanation

Answer: Configure the Elastic Beanstalk environment to use the Immutable deployment policy.

Answer

Configure the Elastic Beanstalk environment to use the Immutable deployment policy.

The Immutable deployment policy is correct because it launches a parallel, temporary Auto Scaling group with the new application version. It ensures that the original

8

instances continue to serve traffic at full capacity. If health checks fail on the new instances, Elastic Beanstalk terminates the temporary Auto Scaling group immediately. This provides a rapid, one-step rollback without any downtime or the need to redeploy the previous version package.

Step-by-Step Solution

Analyze the capacity requirement.

The application must maintain its full capacity of

8

running instances at all times. In-place strategies that reduce capacity during the update (like Rolling) are eliminated.

Maintaining full capacity prevents performance degradation during the deployment process.

Evaluate the rollback and downtime requirements.

The deployment must support zero downtime and a rapid, automated rollback that does not require redeploying the previous version. This requires a strategy where the original instances remain untouched until the new version is verified.

In-place rollbacks require redeploying the old application version, which takes time and affects performance.

Compare the remaining strategies (Immutable vs. Rolling with additional batch vs. Blue/Green).

Immutable deployments launch a temporary Auto Scaling group to test the new version. If health checks fail, the temporary group is terminated immediately, achieving a rapid, one-step rollback. Rolling with additional batch performs in-place updates on subsequent batches, requiring redeployment to roll back. Blue/Green requires DNS swapping and manually matching capacity, which is prone to capacity mismatch if not configured carefully.

Immutable deployments provide the cleanest rollback mechanism because the original application instances are never modified during the deployment.

Key Concept

AWS Elastic Beanstalk Immutable deployments provide zero-downtime updates and rapid rollbacks by launching a temporary Auto Scaling group alongside the existing one and verifying the new version before terminating the old instances.

Estimated Time:1m 30s

Question 773Question →

An operations team uses an AWS CloudFormation stack to manage a multi-tier application. The stack was created using a custom IAM service role to restrict CloudFormation's execution permissions. During a recent stack update, a resource modification failed, initiating an automatic rollback. During the rollback process, the stack transitioned to the UPDATE_ROLLBACK_FAILED state because the custom IAM service role had its permissions modified during the update, removing the authorization to delete EC2 security groups. Which sequence of steps should a SysOps administrator perform to successfully complete the rollback to a stable state while minimizing privileges?

Execute the aws cloudformation continue-update-rollback command specifying the Amazon Resource Name (ARN) of a new IAM role with the correct permissions, relying on the new role's trust policy allowing the sts:AssumeRole action for the administrator's identity.

Manually delete the blocking EC2 security group from the Amazon VPC console, and then run the aws cloudformation update-stack command using the previous successful template version to restore stack consistency.

Grant the administrator iam:PassRole permissions for a new IAM role that possesses the necessary permissions to delete security groups, then execute the aws cloudformation continue-update-rollback command specifying this new role's Amazon Resource Name (ARN).

Delete the failed CloudFormation stack to clean up the existing resources, adjust the permissions of the custom IAM service role, and then redeploy the application stack using the original template.

Show answer & explanation

Answer: Grant the administrator iam:PassRole permissions for a new IAM role that possesses the necessary permissions to delete security groups, then execute the aws cloudformation continue-update-rollback command specifying this new role's Amazon Resource Name (ARN).

Answer

Grant the administrator iam:PassRole permissions for a new, correctly configured IAM role, and then run the continue-update-rollback command specifying that role's ARN.

To recover a CloudFormation stack from the UPDATE_ROLLBACK_FAILED state, the administrator must trigger the continue-update-rollback workflow. Since the original IAM service role lost the necessary permissions to delete the security group, the administrator can specify a new, properly permissioned role. To pass this new role to CloudFormation, the administrator's identity must possess the iam:PassRole permission. This allows the rollback to proceed securely under the new role's authority without granting excessive permissions to the administrator's account or tearing down the stack.

Step-by-Step Solution

Identify the cause of the rollback failure by inspecting the CloudFormation stack events, which indicates that the associated IAM service role lacks permissions to delete the EC2 security group.

The root cause is confirmed as a permissions issue on the current execution role.

Understanding why the rollback is blocked is necessary before attempting remediation.

Create a new IAM role containing permissions to perform the required clean-up action (deleting the security group) and configure its trust policy to allow CloudFormation to assume it.

A new target IAM role is available for the stack operation.

A role with the proper permissions is needed to execute the cleanup tasks during rollback.

Attach an IAM policy to the administrator's identity that grants the iam:PassRole permission for the newly created IAM role.

The administrator is authorized to delegate the new role to CloudFormation.

CloudFormation requires the user initiating the command to have PassRole permissions to prevent unauthorized privilege escalation.

Run the continue-update-rollback CLI command, specifying the stack name and the ARN of the new IAM role.

CloudFormation resumes the rollback process using the new role and successfully completes the rollback.

The continue-update-rollback action bypasses the update failure block and processes the rollback to return the stack to a stable state.

Key Concept

Recovering a CloudFormation stack from UPDATE_ROLLBACK_FAILED by using a new service role and the continue-update-rollback API.

Estimated Time:3m 0s

Question 774Question →

A company runs a production web application on Amazon EC2 instances within an Auto Scaling Group (ASG) managed by AWS CloudFormation. The ASG is configured with a DesiredCapacity of 6 and a MinSize of 6. A SysOps administrator is updating the CloudFormation stack to deploy a new version of the application using an AutoScalingRollingUpdate policy. The application is highly sensitive to capacity reductions, and the administrator must ensure that at least 6 healthy instances remain in service at all times during the update, which should proceed in batches of 2. Which configuration will successfully complete this deployment while meeting the application's availability requirements?

Configure the AutoScalingRollingUpdate policy with MaxBatchSize set to 2 and MinInstancesInService set to 6, and increase the Auto Scaling Group's MaxSize to at least 8.

Configure the AutoScalingRollingUpdate policy with MaxBatchSize set to 2 and MinInstancesInService set to 6, while keeping the Auto Scaling Group's MaxSize at 6.

Configure the AutoScalingRollingUpdate policy with MaxBatchSize set to 2 and MinInstancesInService set to 4, while keeping the Auto Scaling Group's MaxSize at 6.

Configure an AWS Systems Manager Run Command script to execute the update across all instances simultaneously, relying on default patch baseline target tags to roll back the instances if the update fails.

Show answer & explanation

Answer: Configure the AutoScalingRollingUpdate policy with MaxBatchSize set to 2 and MinInstancesInService set to 6, and increase the Auto Scaling Group's MaxSize to at least 8.

Answer

Configure the AutoScalingRollingUpdate policy with MaxBatchSize set to 2 and MinInstancesInService set to 6, and increase the Auto Scaling Group's MaxSize to at least 8.

The correct answer is to configure the AutoScalingRollingUpdate policy with MaxBatchSize set to 2 and MinInstancesInService set to 6, and increase the Auto Scaling Group's MaxSize to at least 8. During a rolling update, if the minimum instances in service is equal to the desired capacity, CloudFormation must launch new instances before terminating old ones. Since the batch size is 2, CloudFormation needs to launch 2 new instances first, raising the total instance count to 8. If the Auto Scaling Group's MaxSize is not increased to at least 8, the Auto Scaling service will block the launch of these new instances, causing the CloudFormation stack update to stall and eventually roll back.

Step-by-Step Solution

Analyze the availability requirement during the update.

The application requires at least 6 healthy instances in service at all times, with updates happening in batches of 2.

This establishes the minimum capacity constraint (

MinInstancesInService = 6

) and the batch size (

MaxBatchSize = 2

Calculate the required temporary capacity during rolling updates.

To update 2 instances while keeping 6 in service, CloudFormation must launch 2 new instances first (totaling 8 instances) before terminating 2 old instances.

If it terminated the old instances first, the active capacity would drop to 4, violating the availability threshold.

Evaluate the Auto Scaling Group size limitations.

The Auto Scaling Group's MaxSize must be at least 8 to allow scaling out to the required temporary capacity.

If MaxSize remains at 6, CloudFormation cannot launch the new instances and the update will hang or rollback.

Key Concept

Auto Scaling Group Rolling Updates via CloudFormation

Question 775Question →

A SysOps Administrator is configuring AWS CodeDeploy to deploy a new version of a critical web application hosted on a fleet of Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer. The deployment must minimize application downtime, automatically revert to the previous version if the deployment fails or if application errors spike, and allow manual verification on the original instances for a period before they are terminated. Which two configurations should the SysOps administrator apply to meet these requirements? (Select TWO.)

Select all that apply

Configure the deployment group to use a Blue/Green deployment type and select the option to copy the existing Auto Scaling group.

Configure the deployment group's automatic rollback options to roll back the deployment when a deployment fails or when a specified CloudWatch alarm is triggered.

Configure the deployment group to perform an In-place deployment using the CodeDeployDefault.AllAtOnce deployment configuration.

Configure a CloudFormation stack update policy using AutoScalingRollingUpdate and set the RollbackConfiguration to disable rollback on failure to allow manual troubleshooting of instances.

Configure AWS Systems Manager Patch Manager with a custom Patch Baseline and use Patch Groups to manage application rollbacks on the instances.

Show answer & explanation

Answer: Configure the deployment group to use a Blue/Green deployment type and select the option to copy the existing Auto Scaling group.; Configure the deployment group's automatic rollback options to roll back the deployment when a deployment fails or when a specified CloudWatch alarm is triggered.

Answer

To meet the requirements, the SysOps administrator should configure the deployment group to use a Blue/Green deployment type by copying the existing Auto Scaling group, and configure the automatic rollback options to revert the deployment if it fails or if specified CloudWatch alarms are triggered.

A Blue/Green deployment type using the 'Copy Auto Scaling group' option creates a replacement environment and shifts traffic to it, ensuring zero downtime and keeping the original instances active for verification. Setting automatic rollback options to trigger on deployment failure or CloudWatch alarm thresholds ensures that the application is immediately reverted to the previous version when issues are detected.

Step-by-Step Solution

Determine the deployment strategy that supports zero-downtime, preserves original instances for verification, and allows rapid traffic shifts.

Identify that a Blue/Green deployment (copying the Auto Scaling group) satisfies these requirements.

Blue/Green deployment creates a new environment, deploys the new version there, routes traffic to it, and keeps the original instances intact for a specified duration.

Configure the rollback mechanism to handle both deployment failures and operational metrics (application error spikes).

Enable automatic rollback on deployment failures and configure CloudWatch alarms for error spikes to trigger CodeDeploy rollbacks.

This configuration automates the reversion process without manual intervention, minimizing the duration of any application degradation.

Key Concept

AWS CodeDeploy Blue/Green deployment configurations and automatic rollback triggers.

Question 776Question →

A company runs a critical microservice on Amazon ECS using the AWS Fargate launch type. A SysOps administrator is configuring a blue/green deployment strategy using AWS CodeDeploy to update the ECS service.

The deployment must satisfy the following operational requirements:
- Route a small fraction of test traffic to the new task set (green environment) using a test listener on port $8080$ to perform integration tests.
- Automatically roll back to the original task set (blue environment) if the integration tests fail or if the Application Load Balancer (ALB) green target group's `HTTPCode_Target_5XX_Count` metric exceeds a threshold during the deployment.
- The rollback must occur automatically without manual intervention.

Which two configurations must the SysOps administrator implement to meet these requirements? (Select two.)

Select all that apply

Specify an AWS Lambda function under the AfterAllowTestTraffic hook in the AppSpec file to execute the validation tests.

Create a CloudWatch alarm for the HTTPCode_Target_5XX_Count metric of the green target group, and associate it with the CodeDeploy deployment group's rollback configuration.

Specify the validation tests under the BeforeInstall hook in the AppSpec file to ensure the new container image functions before task set creation.

Configure the CodeDeploy service role trust policy to allow sts:AssumeRole for the Amazon ECS task execution role to grant task deployment permissions.

Create a CloudWatch alarm for the HTTPCode_Target_5XX_Count metric of the blue target group, and configure an Amazon EventBridge rule to invoke a custom rollback function.

Show answer & explanation

Answer: Specify an AWS Lambda function under the AfterAllowTestTraffic hook in the AppSpec file to execute the validation tests.; Create a CloudWatch alarm for the HTTPCode_Target_5XX_Count metric of the green target group, and associate it with the CodeDeploy deployment group's rollback configuration.

Answer

The configurations that specify an AWS Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and create a CloudWatch alarm for the HTTPCode_Target_5XX_Count metric of the green target group associated with the CodeDeploy rollback settings are correct.

Executing integration tests under the AfterAllowTestTraffic hook in the AppSpec file ensures the tests run against the replacement task set while it is receiving test traffic through the test listener port. Associating a CloudWatch alarm that monitors the 5XX error count of the green target group with the CodeDeploy deployment group's rollback configuration ensures that any errors generated during testing trigger an automatic rollback to the original task set.

Step-by-Step Solution

Determine the correct CodeDeploy lifecycle hook for running integration tests against the new task set via the test port.

The AfterAllowTestTraffic hook is identified because it runs after the test listener starts routing traffic to the replacement (green) task set.

This allows validation tests to run against the new version before any production traffic is shifted.

Identify the target group to monitor for deployment quality.

The green target group must be monitored because it receives the test traffic for the new version during the validation phase.

Monitoring the blue target group would only detect errors on the old version, failing to capture deployment issues.

Configure automatic rollback integration in AWS CodeDeploy.

A CloudWatch alarm is created on the green target group's 5XX metrics and added to the CodeDeploy deployment group rollback settings.

This enables native, automatic rollbacks without needing custom automation scripts or manual intervention.

Key Concept

AWS CodeDeploy blue/green deployments for Amazon ECS utilize lifecycle hooks (specifically AfterAllowTestTraffic) for running validation tests and native CloudWatch alarm integration to trigger automatic, zero-downtime rollbacks when errors are detected on the replacement task set.

Question 777Question →

A SysOps Administrator needs to distribute and execute a custom administrative task across multiple AWS accounts using AWS Systems Manager Run Command. The task requires a custom command document. The administrator has already configured the necessary IAM roles. What is the correct sequence of steps to deploy and run this custom task?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: draft the document content in YAML or JSON format, create the custom SSM Command document in the primary AWS account, modify the permissions of the custom document to share it with the target AWS accounts, and invoke Systems Manager Run Command in the target accounts referencing the shared document.

The correct order follows the natural lifecycle of a custom Systems Manager document. First, the administrator must draft the document schema (YAML or JSON). Second, the administrator creates the document in the primary AWS account. Third, the administrator shares the document with the other AWS accounts. Finally, the administrators in the target accounts execute the shared document using Run Command.

Step-by-Step Solution

Draft the document content in YAML or JSON format.

A structured configuration template defining parameters and commands is ready.

You must define what the document does before you can create it.

Create the custom Systems Manager Command document in the primary AWS account.

The document exists as an active resource within the primary account.

A document must exist locally before it can be shared with other accounts.

Modify the permissions of the custom document to share it with target AWS accounts.

The document is now visible and accessible to the target accounts.

Sharing is required before target accounts can access or execute the document.

Invoke Systems Manager Run Command in the target accounts referencing the shared document.

The command is executed on target instances in the shared accounts.

Execution can only be initiated once the shared resource is accessible in the target accounts.

Key Concept

Systems Manager Document lifecycle: authoring, creating, sharing, and cross-account execution.

Question 778Question →

An Amazon RDS for PostgreSQL DB instance configured in a Multi-AZ deployment undergoes an automated failover during a maintenance window. Following the failover event, a Java-based application server experiencing high traffic is unable to reconnect to the database for several minutes, whereas other client services reconnect almost immediately. Which actions should a SysOps Administrator take to resolve this issue and minimize connection downtime during future failovers? (Select TWO.)

Select all that apply

Modify the Java Virtual Machine (JVM) configuration on the application server to set the DNS time-to-live (TTL) to a low value, such as 30 seconds.

Ensure that the application server is configured to connect to the database using the Amazon RDS DB instance endpoint DNS name rather than a resolved IP address.

Manually promote an Amazon RDS read replica in the standby Availability Zone to restore database write capabilities.

Configure an Amazon Route 53 Active-Passive failover routing policy with health checks pointing to the private IP addresses of the primary and standby RDS instances.

Convert the Amazon RDS DB instance to a Single-AZ deployment and configure an Amazon Route 53 CNAME record pointing to the database.

Show answer & explanation

Answer: Modify the Java Virtual Machine (JVM) configuration on the application server to set the DNS time-to-live (TTL) to a low value, such as 30 seconds.; Ensure that the application server is configured to connect to the database using the Amazon RDS DB instance endpoint DNS name rather than a resolved IP address.

Answer

To resolve the connection issues, the SysOps Administrator should modify the Java Virtual Machine (JVM) configuration on the application server to set the DNS time-to-live (TTL) to a low value, and ensure the application server connects using the Amazon RDS DB instance endpoint DNS name instead of a resolved IP address.

The correct actions are to adjust the DNS caching behavior of the application client (specifically the JVM TTL settings) and to ensure that the client connects using the RDS DB instance endpoint. Amazon RDS Multi-AZ failovers work by modifying the DNS record of the database endpoint to point to the newly promoted standby instance. If an application caches the DNS resolution indefinitely or connects using the direct IP address of the old primary instance, it will fail to connect after a failover occurs, even if the database is available.

Step-by-Step Solution

Verify the database client connection configuration.

Confirm that the application connects using the Amazon RDS DB instance endpoint DNS name instead of a static IP address.

Using the endpoint DNS name is critical because RDS changes this DNS record during failover to point to the standby instance.

Examine DNS caching behavior on the application host.

Check if the client runtime environment (such as Java Virtual Machine) is caching DNS resolutions indefinitely.

By default, the JVM caches DNS lookups forever unless configured otherwise, which prevents it from picking up the updated DNS record after RDS fails over.

Configure JVM networkaddress.cache.ttl to a low value.

The application server will refresh its DNS cache periodically and resolve the new IP address of the promoted standby instance within seconds.

Setting a low TTL (e.g., 30 seconds) ensures the application quickly recovers from database failovers without manual intervention or restarts.

Key Concept

Amazon RDS Multi-AZ deployments use DNS endpoint modification to automate failovers. Application clients must connect using this DNS endpoint and configure client-side DNS caching (TTL) properly to ensure fast reconnection to the newly promoted standby database.

Question 779Question →

A company runs a critical microservice on Amazon ECS with an EC2 launch type. The service has a desired task count of $10$ . Due to strict budget constraints, the underlying Auto Scaling group of EC2 instances is configured to not scale out, and there is no spare capacity in the cluster to run additional tasks. The SysOps Administrator needs to update the service to a new task definition. The deployment must guarantee that at least $5$ tasks are always running and healthy to handle baseline traffic. Which combination of minimum healthy percent and maximum percent settings will achieve this deployment goal?

Minimum healthy percent:

50\%

, Maximum percent:

100\%

Minimum healthy percent:

100\%

, Maximum percent:

150\%

Minimum healthy percent:

50\%

, Maximum percent:

150\%

Minimum healthy percent:

0\%

, Maximum percent:

100\%

Show answer & explanation

Answer: Minimum healthy percent: $50\%$ , Maximum percent: $100\%$

Answer

Minimum healthy percent:

50\%

, Maximum percent:

100\%

The correct answer specifies a minimum healthy percent of

50\%

and a maximum percent of

100\%

. In Amazon ECS rolling updates, setting the minimum healthy percent to

50\%

allows ECS to stop up to

5

tasks (leaving

5

tasks, or

50\%

of the desired

10

, running and healthy). Setting the maximum percent to

100\%

ensures that the service does not attempt to launch more than

10

tasks at any point during the deployment. This prevents the need for additional EC2 host resources, ensuring the deployment succeeds within the current capacity constraints while meeting the requirement of keeping at least

5

tasks active.

Step-by-Step Solution

Determine the resource constraints of the ECS cluster.

The cluster is running at maximum capacity with no spare resources, and the underlying Auto Scaling group cannot scale out.

This constraints the maximum percent to

100\%

to ensure that the deployment does not attempt to provision additional tasks (which would require extra container instances) before stopping old ones.

Calculate the required minimum healthy percent to maintain service availability.

Since at least

5

out of

10

desired tasks must remain active, the minimum healthy percent must be

50\%

(

5 / 10 \times 100\%

This guarantees that the application retains enough active tasks during the rolling update to handle baseline traffic.

Combine the parameters and select the corresponding configuration.

Minimum healthy percent of

50\%

and maximum percent of

100\%

This combination successfully meets both the capacity constraint (no extra tasks run concurrently) and the availability constraint (at least half the tasks remain healthy).

Key Concept

Amazon ECS rolling update deployment settings (minimum healthy percent and maximum percent) control the capacity envelope during service updates.

Question 780Question →

A SysOps Administrator is designing a disaster recovery and backup compliance strategy for a critical transaction application. The requirements dictate that the MySQL database must support point-in-time recovery (PITR) to any moment within the past 14 days, fail over automatically to a standby instance in another Availability Zone with zero administrative intervention during an outage, and copy daily backup exports to an Amazon S3 bucket that is replicated to a different AWS Region for long-term retention. How should the SysOps Administrator configure this environment to meet all requirements?

Enable RDS automated backups with a 14-day retention period. Ensure the DB instance is configured as Multi-AZ. Export daily snapshots to an Amazon S3 bucket with versioning enabled, and configure S3 Cross-Region Replication (CRR) to a destination S3 bucket that also has versioning enabled.

Enable RDS automated backups with a 14-day retention period. Configure a Read Replica in another Availability Zone for automated failover. Export daily snapshots to an Amazon S3 bucket, and set up S3 Cross-Region Replication (CRR) to a destination bucket without enabling versioning on the destination bucket.

Configure RDS Read Replicas in multiple Availability Zones to handle automatic failover. Enable automated backups with a 14-day retention period. Export snapshots to an S3 bucket, and set up S3 Cross-Region Replication (CRR) to a destination bucket that has versioning enabled, while the source bucket has versioning disabled.

Enable RDS automated backups with a 14-day retention period. Ensure the DB instance is configured as Multi-AZ. Export daily snapshots to an Amazon S3 bucket, and configure S3 Cross-Region Replication (CRR) to a destination bucket, while disabling versioning on both buckets to optimize storage costs.

Show answer & explanation

Answer: Enable RDS automated backups with a 14-day retention period. Ensure the DB instance is configured as Multi-AZ. Export daily snapshots to an Amazon S3 bucket with versioning enabled, and configure S3 Cross-Region Replication (CRR) to a destination S3 bucket that also has versioning enabled.

Answer

Enable RDS automated backups with a 14-day retention period, configure the DB instance as Multi-AZ, and export daily snapshots to an S3 bucket with versioning enabled on both the source and destination buckets for Cross-Region Replication.

To support point-in-time recovery (PITR) for up to 14 days, RDS automated backups must be enabled with a retention period of at least 14 days. For automatic zero-intervention failover during an Availability Zone outage, the database must be configured as a Multi-AZ deployment. For S3 Cross-Region Replication (CRR) to function correctly, S3 versioning must be explicitly enabled on both the source S3 bucket and the destination S3 bucket in the target Region.

Step-by-Step Solution

Address the point-in-time recovery requirement.

Enable RDS automated backups with a retention period of at least 14 days.

Automated backups allow restoring a DB instance to any point in time within the retention period.

Address the high availability and zero-intervention failover requirement.

Configure the RDS DB instance as a Multi-AZ deployment.

Multi-AZ provides synchronous replication and automatic failover by updating DNS records to point to the standby replica, whereas Read Replicas require manual promotion.

Address the long-term offsite backup replication requirement.

Enable versioning on both the source S3 bucket and the destination S3 bucket in the target Region, then configure Cross-Region Replication (CRR).

S3 Cross-Region Replication strictly requires that versioning is enabled on both the source and destination buckets.

Key Concept

Synthesizing Amazon RDS Automated Backups for PITR, Multi-AZ for automated high availability failover, and the versioning prerequisites of Amazon S3 Cross-Region Replication.

Estimated Time:2m 0s

PreviousPage 39 / 49Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept