Tüm alıştırma soruları

1542 soru

Tüm türler1,542 Çoktan seçmeli782 Çoklu seçim746 Sıralama14

A developer is updating a serverless application where traffic is routed to an AWS Lambda function. The developer needs to update the function version using AWS CodeDeploy so that $10\%$ of the traffic is routed to the new version for a $10$ -minute trial period, after which all remaining traffic is routed to the new version. Which AWS CodeDeploy deployment configuration meets this requirement?

CodeDeployDefault.LambdaCanary10Percent10Minutes

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

CodeDeployDefault.LambdaAllAtOnce

CodeDeployDefault.LambdaLinear10PercentEvery1Minute

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.LambdaCanary10Percent10Minutes

Cevap

CodeDeployDefault.LambdaCanary10Percent10Minutes

The configuration CodeDeployDefault.LambdaCanary10Percent10Minutes shifts

10\%

of the traffic to the new Lambda version immediately, waits for a

10

-minute interval to monitor for errors or alarms, and then shifts the remaining

90\%

of the traffic to the new version.

Adım Adım Çözüm

Analyze the traffic routing requirements.

The requirements specify shifting a small portion (

10\%

) of traffic initially, holding it for a trial period (

10

minutes), and then shifting the remaining traffic (

90\%

) all at once.

This matches a canary deployment pattern rather than a linear or all-at-once deployment pattern.

Identify the correct AWS CodeDeploy deployment configuration prefix for AWS Lambda.

The configuration must start with the prefix 'CodeDeployDefault.Lambda'.

CodeDeploy uses specific prefixes depending on the compute platform (Lambda, ECS, or EC2/On-Premises).

Select the configuration that matches Canary

10\%

with a

10

-minute interval.

CodeDeployDefault.LambdaCanary10Percent10Minutes fits this description exactly.

The 'Canary10Percent10Minutes' suffix routes

10\%

of traffic to the new version and then routes the rest after

10

minutes.

Anahtar Kavram

AWS CodeDeploy configurations for AWS Lambda support Canary deployments (shifting a percentage of traffic for a set time before shifting the rest) and Linear deployments (shifting equal increments of traffic at regular intervals).

Soru 802Soru →

A developer needs to update a production web application hosted on AWS Elastic Beanstalk. The application runs on multiple Amazon EC2 instances behind an Application Load Balancer. The deployment must satisfy the following criteria:
- There must be zero application downtime.
- The environment must maintain $100\%$ of its provisioned capacity throughout the deployment process to handle high traffic.
- The deployment must support a fast and clean rollback mechanism with minimal impact if any issues occur.
- Double-allocation cost is acceptable for the duration of the deployment.

Which two Elastic Beanstalk deployment policies should the developer select to meet these requirements?

Geçerli olan tümünü seçin

Immutable

Rolling with additional batch

Rolling

All at once

Linear 10% every 10 minutes

Cevabı ve açıklamayı göster

Cevap: Immutable; Rolling with additional batch

Cevap

Immutable and Rolling with additional batch

The Immutable deployment policy satisfies the constraints by deploying the new version to a temporary Auto Scaling group, ensuring full capacity is maintained during health checks and allowing an instant rollback if needed. The Rolling with additional batch policy also meets the criteria by launching a new batch of instances first to maintain

100\%

capacity before updating the existing instances in batches.

Adım Adım Çözüm

Analyze the capacity requirement

The requirement specifies that

100\%

of the provisioned capacity must be maintained throughout the deployment. This rules out the standard Rolling policy, which takes instances out of service, and the All at once policy, which takes all instances out of service.

Maintaining full capacity is a strict constraint to handle high traffic without performance degradation.

Analyze the downtime and rollback requirements

The Immutable deployment policy launches a separate, temporary Auto Scaling group, meaning the existing environment runs at full capacity until the new version passes health checks. Rollback is immediate (terminating the new Auto Scaling group). The Rolling with additional batch policy launches a new batch first to maintain capacity before rolling the update through the existing instances, ensuring zero downtime.

Both policies satisfy the capacity and zero-downtime requirements by allocating additional temporary resources during the update.

Evaluate the non-native option

Linear 10% every 10 minutes is a CodeDeploy-specific configuration and cannot be selected as an Elastic Beanstalk deployment policy.

Only native Elastic Beanstalk deployment policies can be configured within the Elastic Beanstalk console or CLI.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their impact on environment capacity, downtime, and rollbacks.

Soru 803Soru →

A developer is writing a Java application that needs to encrypt a database export file of $50\text{ MB}$ before uploading it to Amazon S3. The security policy requires client-side envelope encryption using an AWS KMS customer managed key. Which AWS KMS API operation should the developer use to obtain the necessary data key to encrypt this file locally?

GenerateDataKey

Encrypt

GenerateDataKeyWithoutPlaintext

GetParametersByPath

Cevabı ve açıklamayı göster

Cevap: GenerateDataKey

Cevap

GenerateDataKey

The correct answer is the GenerateDataKey operation. In client-side envelope encryption, the application calls GenerateDataKey, which generates a unique symmetric data key under the specified customer managed key. KMS returns both the plaintext key (which the Java application uses to encrypt the

50\text{ MB}

file locally) and the encrypted version of that same data key (which is uploaded to Amazon S3 alongside the encrypted file).

Adım Adım Çözüm

Determine the encryption method based on file size.

Since the file size (

50\text{ MB}

) is much larger than the

4\text{ KB}

payload limit for direct AWS KMS encryption, the developer must use client-side envelope encryption.

AWS KMS is not designed to encrypt large datasets directly.

Identify the KMS API required to generate a local data key.

The application needs to generate a unique data key under the specified customer managed key, receiving both the plaintext version (to perform the encryption) and the ciphertext version (to package with the encrypted file).

Envelope encryption requires a local symmetric data key to perform the actual data encryption.

Select the correct KMS API operation.

The GenerateDataKey operation is the standard API designed for envelope encryption workflows to return both the plaintext and encrypted data keys.

This avoids unnecessary Decrypt calls that would be required if using GenerateDataKeyWithoutPlaintext.

Anahtar Kavram

AWS KMS Envelope Encryption and Data Key Generation

Soru 804Soru →

An organization is building a new client-side dashboard application. Users must be able to sign up and log in using their corporate email addresses. Once logged in, the dashboard must call a protected REST API hosted on Amazon API Gateway and also fetch user-specific reports directly from a private Amazon S3 bucket. Which architecture should the developer implement to provide secure authentication for the REST API and direct authorization for the S3 bucket with the least operational overhead?

Use an Amazon Cognito User Pool to authenticate users and pass the OIDC ID token to the API Gateway Cognito Authorizer, and use an Amazon Cognito Identity Pool to exchange the ID token for temporary IAM credentials that grant access to the S3 bucket.

Use an Amazon Cognito User Pool to manage user authentication, and configure the User Pool app client to directly return temporary IAM credentials to the client application for S3 bucket access.

Use an Amazon Cognito User Pool to authenticate users, configure a custom Lambda authorizer on API Gateway to validate the ID token, and use Cognito User Pool groups to authorize direct S3 bucket downloads.

Use an Amazon Cognito User Pool to authenticate users, and configure an IAM role with a trust policy that permits the Amazon S3 service to assume the role directly on behalf of the authenticated client.

Cevabı ve açıklamayı göster

Cevap: Use an Amazon Cognito User Pool to authenticate users and pass the OIDC ID token to the API Gateway Cognito Authorizer, and use an Amazon Cognito Identity Pool to exchange the ID token for temporary IAM credentials that grant access to the S3 bucket.

Cevap

The correct architecture uses an Amazon Cognito User Pool for user authentication and directory services. The OIDC ID token returned by the User Pool is verified directly by API Gateway using the built-in Cognito Authorizer. To access private S3 resources directly from the client, the application uses an Amazon Cognito Identity Pool to exchange the ID token for temporary AWS IAM credentials, which are authorized by an IAM policy attached to the authenticated role.

Adım Adım Çözüm

Configure an Amazon Cognito User Pool to act as the user directory and handle sign-up and sign-in, returning OIDC tokens (ID token and Access token) upon successful authentication.

Users can authenticate and obtain an ID token containing identity claims.

Cognito User Pools provide authentication and user directory management.

Create an API Gateway Cognito Authorizer and associate it with the REST API resources, configuring the client to pass the ID token in the authorization header.

API Gateway automatically validates the ID token against the Cognito User Pool client.

This provides built-in token validation without writing custom Lambda code.

Configure an Amazon Cognito Identity Pool that lists the User Pool as an authentication provider, and associate an authenticated IAM role with the Identity Pool.

The client application can exchange the User Pool ID token for temporary AWS IAM credentials.

Cognito Identity Pools provide authorization to access AWS resources directly like S3.

Anahtar Kavram

Cognito User Pools authenticate users and issue tokens, while Cognito Identity Pools authorize users by exchanging those tokens for temporary AWS credentials.

Tahmini Süre:1m 30s

Soru 805Soru →

A developer is building a containerized application running on Amazon ECS. The application must encrypt application log archives of approximately $12\text{ MB}$ each on the client side before uploading them to an Amazon S3 bucket. The developer wants to use a customer managed key in AWS KMS.

Which of the following steps are required to implement this client-side envelope encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted copy of the data key.

Encrypt the log archive locally using the plaintext data key, then immediately remove the plaintext data key from the application's memory.

Call the Encrypt API operation directly, passing the entire

12\text{ MB}

log archive as the plaintext parameter.

Call the GenerateDataKeyWithoutPlaintext API operation, and use the customer managed key's public key to encrypt the log archive.

Store the plaintext data key in AWS Systems Manager Parameter Store with secure string parameters for future decryption processes.

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted copy of the data key.; Encrypt the log archive locally using the plaintext data key, then immediately remove the plaintext data key from the application's memory.

Cevap

To perform client-side envelope encryption for files larger than

4\text{ KB}

, the developer must call the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the files locally and must be destroyed from memory immediately after use. The encrypted data key is stored alongside the encrypted files for future decryption.

The correct steps to implement client-side envelope encryption are to call the GenerateDataKey API operation to retrieve both the plaintext and encrypted data keys, encrypt the data locally with the plaintext key, and then delete the plaintext key from memory. This complies with security best practices and allows the encryption of files larger than the

4\text{ KB}

KMS direct encryption limit.

Adım Adım Çözüm

Generate the data keys by calling AWS KMS.

The GenerateDataKey API returns a plaintext data key and a ciphertext (encrypted) data key.

A plaintext key is needed to perform the encryption algorithm locally, and the encrypted version is needed to store with the data for later decryption.

Encrypt the file locally and clean up memory.

The

12\text{ MB}

log archive is encrypted using the plaintext data key, and the plaintext data key is discarded from memory.

Local encryption avoids the

4\text{ KB}

KMS API limit, and deleting the plaintext key from memory minimizes the risk of key exposure.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow

Soru 806Soru →

A developer is configuring a continuous delivery pipeline using AWS CodePipeline in Account A. The pipeline needs to deploy a serverless application to Account B using AWS CloudFormation. The developer has created a deployment IAM role in Account B with the required permissions to create and manage the application resources. However, when the pipeline runs, the CloudFormation deployment stage fails with an Access Denied error. Which of the following configurations will resolve this issue?

Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role in Account A to assume it, and configure the CloudFormation action in Account A's pipeline to use this cross-account role.

Add the permissions policy from the deployment IAM role in Account B directly to the CodePipeline service role in Account A, and configure the CloudFormation action to run without specifying a role.

Generate long-lived access keys for an IAM user in Account B, store them as a SecureString parameter in Systems Manager Parameter Store in Account A, and configure the CloudFormation action to retrieve these keys for authentication.

Manually deploy the CloudFormation stack in Account B's console first to establish resource ownership, and configure the pipeline in Account A to update the existing stack directly.

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role in Account A to assume it, and configure the CloudFormation action in Account A's pipeline to use this cross-account role.

Cevap

The correct option correctly configures cross-account authorization. AWS CodePipeline supports executing actions in another account by assuming a role created in that account. The role in the target account must trust the CodePipeline service role to perform the 'sts:AssumeRole' action, and the pipeline action configuration must specify the target role ARN.

Adım Adım Çözüm

Modify the trust policy of the IAM role in Account B (target account) to add a trust relationship allowing the 'sts:AssumeRole' action for the CodePipeline service role ARN from Account A.

The IAM role in the target account is now allowed to be assumed by the CodePipeline service role in the source account.

This establishes cross-account trust required for secure delegation of authority.

Update the CodePipeline action configuration in the deployment stage in Account A to reference the IAM role ARN from Account B under the 'RoleArn' parameter.

CodePipeline is configured to assume the target account role when executing the CloudFormation action.

This instructs CodePipeline to use the trusted target account role's temporary credentials for deployment.

Anahtar Kavram

Cross-account deployments in AWS CodePipeline require configuring IAM trust policies that allow the pipeline service role to assume a target deployment role in the destination account.

Tahmini Süre:1m 30s

Soru 807Soru →

A developer is designing a serverless multi-tenant web application where an AWS Lambda function processes incoming user requests. The application must maintain session state for users across subsequent HTTP requests. During initial testing under high concurrency, the developer notices that session data is frequently lost between requests. The session state must persist reliably, scale automatically, and support automatic expiration of sessions after 30 minutes of inactivity. Which of the following database or caching strategies should the developer implement to resolve this issue?

Store session state in Amazon DynamoDB with Time to Live (TTL) enabled, using a unique session ID as the partition key.

Store session state in a global variable within the Lambda function's execution context to reuse cached data across subsequent invocations.

Store session state in AWS Systems Manager Parameter Store with SecureString parameters, using a TTL parameter policy to expire sessions.

Store session state in Amazon DynamoDB and run a cron-triggered Scan operation filtered by a session timestamp to purge expired sessions.

Cevabı ve açıklamayı göster

Cevap: Store session state in Amazon DynamoDB with Time to Live (TTL) enabled, using a unique session ID as the partition key.

Cevap

Store session state in Amazon DynamoDB with Time to Live (TTL) enabled, using a unique session ID as the partition key.

Storing session state in Amazon DynamoDB with TTL enabled and using a unique session ID as the partition key provides a highly scalable, key-value lookup mechanism that natively handles session expiration at no additional cost. DynamoDB automatically deletes expired items, which minimizes table size and prevents performance degradation, satisfying the 30-minute inactivity requirement.

Adım Adım Çözüm

Analyze the application requirements: session persistence must survive concurrent requests, scale automatically, and support automated cleanup after 30 minutes of inactivity.

Determine that local memory storage within Lambda is unsuitable because Lambda execution contexts are isolated, ephemeral, and dynamically recycled under load.

To ensure reliable session persistence, session data must be written to an external, centralized datastore rather than the local execution context.

Select a centralized database solution that supports low-latency lookups and native scaling.

Amazon DynamoDB is chosen because using the session ID as a partition key provides

O(1)

key-value read and write performance that scales horizontally.

DynamoDB is the AWS best practice for serverless session state storage because it handles high concurrency with minimal administrative overhead.

Incorporate the session cleanup/expiration requirement into the DynamoDB configuration.

Enable Time to Live (TTL) on the DynamoDB table and designate an attribute representing the expiration timestamp (

30\text{ minutes}

in the future).

DynamoDB handles the background deletion of expired items automatically and for free, avoiding the need for expensive and resource-intensive Scan operations.

Anahtar Kavram

Session State Management in Serverless Architectures using DynamoDB TTL

Tahmini Süre:2m 0s

Soru 808Soru →

An organization wants to run a microservice on Amazon ECS using the AWS Fargate launch type. The containerized application needs to publish events to an Amazon SNS topic. Additionally, the Amazon ECS container agent must download the Docker image from a private Amazon ECR repository. Which of the following configurations are required in the task definition to support this deployment? (Select TWO.)

Geçerli olan tümünü seçin

Specify a Task Role in the task definition that grants the containerized application permission to publish to the Amazon SNS topic.

Specify a Task Execution Role in the task definition that allows the Amazon ECS container agent to pull the image from Amazon ECR.

Specify a Task Role in the task definition that grants the containerized application permission to pull the container image from Amazon ECR.

Specify a Task Execution Role in the task definition that allows the Amazon ECS container agent to publish to the Amazon SNS topic.

Configure a Task Role that includes a trust policy allowing the Amazon EC2 service principal (ec2.amazonaws.com) to assume it.

Cevabı ve açıklamayı göster

Cevap: Specify a Task Role in the task definition that grants the containerized application permission to publish to the Amazon SNS topic.; Specify a Task Execution Role in the task definition that allows the Amazon ECS container agent to pull the image from Amazon ECR.

Cevap

To configure this deployment successfully, the task definition must specify a Task Role that grants the containerized application permission to publish to Amazon SNS, and a Task Execution Role that allows the Amazon ECS container agent to pull the container image from Amazon ECR.

The ECS Task Role is assumed by the containerized application itself, allowing the code to make API calls to AWS services such as publishing messages to an Amazon SNS topic. The ECS Task Execution Role is assumed by the ECS agent to perform tasks on behalf of the container registry and logging services, such as pulling the image from Amazon ECR before the container starts.

Adım Adım Çözüm

Identify the permissions needed by the application code running inside the container (publishing to Amazon SNS).

Determine that these application-level permissions must be associated with the ECS Task Role.

The Task Role is used by the containerized application to access AWS resources after the container starts.

Identify the permissions needed by the Amazon ECS container agent (pulling the Docker image from Amazon ECR).

Determine that these agent-level permissions must be associated with the ECS Task Execution Role.

The Task Execution Role is used by the ECS container agent to execute tasks like pulling images and writing logs before the container code runs.

Anahtar Kavram

Delineation between the ECS Task Role (used by the application container to interact with AWS services) and the ECS Task Execution Role (used by the ECS agent to perform container lifecycle tasks like pulling images or sending logs).

Soru 809Soru →

A developer is designing a serverless e-commerce application. The application has a public API endpoint hosted on Amazon API Gateway that triggers an AWS Lambda function. The Lambda function queries an Amazon DynamoDB table to retrieve a list of active discount codes. This discount list is read-heavy, updated only once per day, and must be returned with sub-second response times. During peak shopping events, the API Gateway endpoint experiences high latency and DynamoDB triggers provisioned throughput exceptions. The developer wants to implement a caching solution that minimizes costs and reduces the load on both the Lambda function and the DynamoDB table.

Which caching strategy should the developer implement to meet these requirements?

Provision an Amazon DynamoDB Accelerator (DAX) cluster to cache the read queries from the DynamoDB table.

Enable Amazon API Gateway stage-level caching with a Time to Live (TTL) of 24 hours.

Initialize a global variable inside the AWS Lambda function to cache the list in the execution context.

Perform a DynamoDB Scan operation within the Lambda function and cache the results in the AWS Systems Manager Parameter Store.

Cevabı ve açıklamayı göster

Cevap: Enable Amazon API Gateway stage-level caching with a Time to Live (TTL) of 24 hours.

Cevap

Enable Amazon API Gateway stage-level caching with a Time to Live (TTL) of 24 hours.

Enabling caching at the Amazon API Gateway stage level is the most cost-effective and low-latency solution. When API Gateway caching is enabled, API Gateway caches responses from the backend (Lambda and DynamoDB) for the specified Time to Live (TTL). If a cache hit occurs, API Gateway returns the response directly to the client without invoking the AWS Lambda function or querying the Amazon DynamoDB table. This eliminates Lambda execution costs and DynamoDB read unit charges for all cached requests, while providing the lowest latency.

Adım Adım Çözüm

Analyze the traffic and cost profile of the serverless application layers.

Determine that requests are read-heavy, data changes only once per day, and both Lambda execution cost and DynamoDB read capacity need to be optimized.

This establishes that caching should occur as close to the client as possible to prevent downstream invocations and costs.

Evaluate the capabilities of Amazon API Gateway stage-level caching.

API Gateway caching can store responses and serve them directly to clients, bypassing both Lambda and DynamoDB entirely for cache hits.

Serving requests directly from API Gateway minimizes latency and eliminates execution costs for downstream services.

Determine the appropriate cache configuration and TTL.

Configure API Gateway caching with a TTL of 24 hours to align with the daily update frequency of the discount codes.

Aligning the TTL with the data update frequency ensures clients receive fresh data while maximizing the cache hit ratio.

Anahtar Kavram

Caching at the API Gateway layer to minimize downstream serverless execution and database costs.

Soru 810Soru →

A developer is deploying an application on Amazon ECS (Fargate) tasks within a private subnet of a VPC. The application must retrieve database credentials from AWS Secrets Manager and publish events to an Amazon SNS topic. The company's security policy mandates that all traffic to AWS services must remain within the AWS network and must not traverse the public internet.

Which combination of configurations will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create Interface VPC Endpoints (AWS PrivateLink) for Secrets Manager and SNS in the private subnets, and ensure private DNS hostnames are enabled for the VPC.

Configure the security groups associated with the VPC endpoints to allow inbound traffic on port 443 from the security group of the ECS tasks.

Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to route traffic destined for Secrets Manager and SNS through the NAT Gateway.

Create Gateway VPC Endpoints for Secrets Manager and SNS, and add routes targeting these endpoints in the private subnet's route table.

Update the trust policy of the ECS task execution role to permit the VPC endpoint services to assume the role, granting them permission to route network traffic to the tasks.

Cevabı ve açıklamayı göster

Cevap: Create Interface VPC Endpoints (AWS PrivateLink) for Secrets Manager and SNS in the private subnets, and ensure private DNS hostnames are enabled for the VPC.; Configure the security groups associated with the VPC endpoints to allow inbound traffic on port 443 from the security group of the ECS tasks.

Cevap

The correct configurations are to create Interface VPC Endpoints for Secrets Manager and SNS with private DNS hostnames enabled, and to configure the security groups on the VPC endpoints to allow inbound traffic on port 443 from the ECS tasks' security group.

To connect ECS tasks in a private subnet securely to AWS services (Secrets Manager and SNS) without traversing the public internet, the developer must use Interface VPC Endpoints (AWS PrivateLink). Private DNS hostnames must be enabled so that standard SDK calls to these services resolve to the private endpoint interfaces. Additionally, because Interface VPC Endpoints use ENIs with security groups, the endpoint security groups must be configured to allow inbound traffic on port 443 (HTTPS) from the ECS tasks' security group.

Adım Adım Çözüm

Determine the type of VPC endpoint required for Secrets Manager and SNS.

Both AWS Secrets Manager and Amazon SNS require Interface VPC Endpoints (AWS PrivateLink), as Gateway VPC Endpoints are only available for Amazon S3 and Amazon DynamoDB.

This establishes the basic network architecture needed to access these services without using a public internet path.

Configure private resolution for the service endpoints within the VPC.

Enable private DNS hostnames for the created Interface VPC Endpoints in the VPC settings.

This ensures that DNS queries for the service endpoints (e.g., secretsmanager.us-east-1.amazonaws.com) resolve to the private IP addresses of the endpoint ENIs rather than their public IPs, preventing application code modifications.

Configure network security rules (security groups) to permit communication.

Allow inbound traffic on port 443 in the VPC endpoint security groups originating from the ECS tasks' security group, and ensure the ECS tasks' security group allows outbound traffic to the endpoints on port 443.

Interface VPC Endpoints are stateful and use security groups to filter incoming traffic. Since they expose resources over HTTPS, traffic must be allowed on port 443.

Anahtar Kavram

Establishing secure, private connections from resources in a private VPC subnet to AWS services using AWS PrivateLink (Interface VPC Endpoints) and proper security group configurations.

Tahmini Süre:1m 30s

Soru 811Soru →

A developer is managing a web application infrastructure deployed via an AWS CloudFormation stack. The stack includes an Amazon RDS DB instance and an Amazon ECS service. The developer needs to update the database master password to a new value and configure the ECS tasks to retrieve this password securely. During the update attempt, the stack update fails because another team member manually modified the database security group rules directly in the Amazon VPC console to debug a connection issue. Which combination of actions should the developer take to resolve the update failure and secure the password? (Select TWO.)

Geçerli olan tümünü seçin

Run drift detection on the CloudFormation stack, identify the differences in the database security group, and manually revert the security group rules in the VPC console to match the template definition before retrying the update.

Update the CloudFormation template to reference the database password using the {{resolve:secretsmanager:db-password}} dynamic reference, allowing ECS tasks to retrieve the password securely at runtime.

Manually delete the modified database security group from the VPC console, and allow CloudFormation to automatically recreate the security group with the original configuration during the next stack update.

Save the database password as a plaintext string in a standard Systems Manager Parameter Store parameter and reference it using {{resolve:ssm:db-password}} to avoid the overhead of Secrets Manager.

Continue the stack update and select the option to ignore the database security group resource rollback, then run the UpdateStack API with the --force flag to override the drift status.

Cevabı ve açıklamayı göster

Cevap: Run drift detection on the CloudFormation stack, identify the differences in the database security group, and manually revert the security group rules in the VPC console to match the template definition before retrying the update.; Update the CloudFormation template to reference the database password using the {{resolve:secretsmanager:db-password}} dynamic reference, allowing ECS tasks to retrieve the password securely at runtime.

Cevap

Run drift detection on the CloudFormation stack to identify changes and manually revert the security group rules in the VPC console. Additionally, update the template to use the AWS Secrets Manager dynamic reference for the database password.

To fix a stack update blocked by out-of-band modifications, the developer must first identify the drift and manually revert the changes in the console to match the template. To secure the database password, the developer should use the AWS Secrets Manager dynamic reference, which securely resolves the secret during resource creation and runtime without exposing it in plaintext.

Adım Adım Çözüm

Initiate drift detection on the target CloudFormation stack.

The stack status reveals that the database security group has drifted from its template-defined state due to manual rules modifications.

Identifying the specific resources that have drifted is necessary to resolve conflicts before executing stack updates.

Manually revert the database security group rules in the VPC console back to the values specified in the CloudFormation template.

The security group configuration aligns perfectly with the template definition, and the drift status returns to IN_SYNC.

Resolving the drift state allows CloudFormation to execute updates without encountering resource state conflicts.

Modify the CloudFormation template to reference the database password from AWS Secrets Manager using the dynamic reference format.

The template uses the dynamic lookup expression to retrieve the credential securely at deployment and runtime.

This avoids hardcoding sensitive credentials in plaintext templates or parameters, meeting security compliance requirements.

Anahtar Kavram

Handling resource drift and managing secrets securely using dynamic references in AWS CloudFormation.

Tahmini Süre:2m 0s

Soru 812Soru →

A developer is planning an update for a non-critical internal application deployed on AWS Elastic Beanstalk. Because the application has low usage, the developer wants to minimize deployment duration and is comfortable with the environment's capacity being temporarily reduced or offline during the update. Which two Elastic Beanstalk deployment strategies will result in a temporary reduction of active instance capacity during the deployment? (Select TWO).

Geçerli olan tümünü seçin

All-at-once

Rolling

Rolling with additional batch

Immutable

Traffic splitting

Cevabı ve açıklamayı göster

Cevap: All-at-once; Rolling

Cevap

All-at-once and Rolling

The correct strategies are All-at-once and Rolling. The All-at-once strategy deploys the update to all instances at the same time, which temporarily takes all instances out of service and reduces active capacity to zero. The Rolling strategy updates the environment in batches, taking one batch of instances out of service at a time, which temporarily reduces the overall active capacity of the environment.

Adım Adım Çözüm

Analyze the capacity behavior of each Elastic Beanstalk deployment strategy.

Identify how each strategy handles active instances during an update.

The requirement specifies selecting strategies that temporarily reduce the active instance capacity of the environment.

Evaluate which strategies take existing instances out of service without pre-provisioning replacement capacity.

All-at-once takes all instances out of service simultaneously. Rolling takes a subset (batch) of instances out of service at a time.

Both of these strategies deploy directly to existing instances in-place, leading to a temporary reduction in capacity.

Verify that the remaining strategies maintain 100% capacity.

Rolling with additional batch, Immutable, and Traffic splitting all provision new instances before taking old ones out of service to maintain full capacity.

Confirming these strategies are incorrect because they preserve full capacity during deployment.

Anahtar Kavram

Understanding the impact of AWS Elastic Beanstalk deployment strategies on environment capacity and instance count.

Soru 813Soru →

A developer is deploying a backend application on Amazon ECS (Fargate) within a custom VPC. The application tasks are placed in private subnets and must connect to an Amazon ElastiCache for Redis cluster located in dedicated isolated subnets within the same VPC. Additionally, the application must fetch runtime API keys from AWS Secrets Manager and send transaction data to a third-party payment processing API on the public internet. Which combination of configurations will securely enable these connections while adhering to the principle of least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group, and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group.

Deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.

Configure an Interface VPC Endpoint in the private subnets to route traffic directly to the third-party payment processing API, and add an inbound security group rule on the ECS tasks to allow return traffic on port 443.

Configure the ECS tasks' security group with an inbound rule allowing TCP traffic on port 6379 from the ElastiCache security group to allow return cache traffic, and configure the private subnets' Network ACL to be stateful to track outbound connection responses.

Store the third-party API keys in AWS Systems Manager Parameter Store with automatic rotation configured, and route both Secrets Manager and payment API requests through a NAT Gateway deployed in the isolated subnet.

Cevabı ve açıklamayı göster

Cevap: Configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group, and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group.; Deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.

Cevap

The correct configurations are to configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group, and deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.

The correct configurations involve using stateful security group rules to authorize outbound traffic from the ECS tasks' security group to the ElastiCache security group on port 6379, while allowing inbound traffic on the ElastiCache security group from the ECS tasks. To access the public internet, a NAT Gateway must be deployed in a public subnet with a corresponding route in the private subnets' route table. To securely access AWS Secrets Manager without using the public internet, an Interface VPC Endpoint should be created inside the private subnets.

Adım Adım Çözüm

Configure internal database connectivity using security groups.

ECS tasks are permitted to initiate TCP connections to the ElastiCache cluster on port 6379, and the ElastiCache cluster permits inbound connections only from the ECS tasks' security group. Because security groups are stateful, return traffic is automatically handled without extra inbound rules.

Ensures secure, restricted database access within the VPC without exposing databases to broader subnet traffic.

Configure public internet routing for the external API.

A NAT Gateway is deployed in a public subnet, and the private subnet routing table is updated with a route pointing 0.0.0.0/0 to the NAT Gateway. This allows tasks in the private subnet to securely initiate outbound HTTPS connections to the payment gateway.

Private subnets do not have direct internet access; routing traffic through a NAT Gateway in a public subnet is required.

Establish secure private access to AWS Secrets Manager.

An Interface VPC Endpoint (AWS PrivateLink) is provisioned inside the private subnets for Secrets Manager. The application resolves the Secrets Manager DNS to private IP addresses.

Allows the application to fetch sensitive secrets without sending API requests over the public internet, reducing exposure.

Anahtar Kavram

VPC security controls require coordinating stateful security groups for internal resources, stateless routing via NAT Gateways for internet access, and VPC Endpoints for private AWS service communication.

Tahmini Süre:2m 0s

Soru 814Soru →

An application team is configuring AWS CodeBuild to compile and package a Java application. The build process requires a buildspec file to define the build phases and must retrieve a database connection string stored in AWS Systems Manager Parameter Store. Which of the following actions should the developer take to meet these requirements? (Select TWO)

Geçerli olan tümünü seçin

Place the buildspec.yml file in the root directory of the application source code.

Reference the database connection string under the parameter-store mapping of the env sequence in the buildspec file.

Place the buildspec.yml file inside a subdirectory named build/ in the source code repository.

Reference the database connection string under the variables mapping of the env sequence in the buildspec file.

Configure the CodeBuild service role trust policy to trust AWS Systems Manager instead of AWS CodeBuild.

Cevabı ve açıklamayı göster

Cevap: Place the buildspec.yml file in the root directory of the application source code.; Reference the database connection string under the parameter-store mapping of the env sequence in the buildspec file.

Cevap

Place the buildspec.yml file in the root directory of the application source code, and reference the database connection string under the parameter-store mapping of the env sequence in the buildspec file.

The correct options are placing the buildspec.yml in the root directory of the source code and referencing the database connection string under the parameter-store mapping in the env sequence. By default, CodeBuild automatically looks for buildspec.yml at the root level of the source directory. To securely load secrets or configuration details from Systems Manager Parameter Store during the build, the developer must declare them under 'parameter-store' in the 'env' section of the buildspec, which maps the Parameter Store keys to environment variables in the build environment.

Adım Adım Çözüm

Determine the default location of the build configuration file.

Confirm that the buildspec.yml file should be placed in the root directory of the source code.

AWS CodeBuild looks for the buildspec.yml file at the root of the source directory by default unless overridden in the project configuration.

Determine how to retrieve parameter values from AWS Systems Manager Parameter Store inside the buildspec file.

Declare the parameters under the parameter-store block in the env sequence of the buildspec file.

This allows CodeBuild to automatically fetch the values from Systems Manager Parameter Store and expose them as environment variables during the build phases.

Anahtar Kavram

AWS CodeBuild configuration requires the buildspec.yml file to be placed in the root of the source code by default, and Systems Manager Parameter Store variables must be declared under the parameter-store mapping in the env block.

Soru 815Soru →

A developer is managing a batch processing system deployed via an AWS CloudFormation stack. During an update of the stack, the deployment fails because of a resource configuration error, and CloudFormation automatically initiates a rollback. However, the rollback fails because an Amazon S3 bucket that was created by the stack has been manually deleted outside of CloudFormation. The stack is now stuck in the `UPDATE_ROLLBACK_FAILED` state. Which two actions must the developer take to resolve this issue and update the stack? (Choose two.)

Geçerli olan tümünü seçin

Perform a `ContinueUpdateRollback` operation using the AWS CLI or CloudFormation console, specifying the logical ID of the deleted Amazon S3 bucket in the resources to skip parameter.

Run CloudFormation drift detection on the stack to automatically synchronize the template state with the deleted S3 bucket so that the rollback can complete successfully.

Execute the `update-stack` command with the `--force-update` flag to force the new template changes onto the stack despite the failed rollback state.

Wait for the stack to transition to the `UPDATE_ROLLBACK_COMPLETE` state, then perform a standard stack update using the corrected template.

Create a parameter in the AWS Systems Manager Parameter Store with the configuration of the deleted bucket, and use a dynamic reference to resolve the missing resource during rollback.

Cevabı ve açıklamayı göster

Cevap: Perform a `ContinueUpdateRollback` operation using the AWS CLI or CloudFormation console, specifying the logical ID of the deleted Amazon S3 bucket in the resources to skip parameter.; Wait for the stack to transition to the `UPDATE_ROLLBACK_COMPLETE` state, then perform a standard stack update using the corrected template.

Cevap

Perform a `ContinueUpdateRollback` operation specifying the logical ID of the deleted S3 bucket to be skipped, and then perform a standard stack update using the corrected template after the stack transitions to the `UPDATE_ROLLBACK_COMPLETE` state.

To recover a stack in the UPDATE_ROLLBACK_FAILED state, you must use ContinueUpdateRollback and skip the resources that are causing the rollback to fail (such as the manually deleted S3 bucket). This allows the rollback operation to complete and the stack to transition to the UPDATE_ROLLBACK_COMPLETE state, which is a stable state. Once the stack is stable, you can perform a normal update with the corrected template to align it with the desired configuration.

Adım Adım Çözüm

Initiate ContinueUpdateRollback

The stack skips the deleted S3 bucket resource during rollback.

This bypasses the rollback failure caused by the missing bucket.

Wait for UPDATE_ROLLBACK_COMPLETE state

The stack status transitions to UPDATE_ROLLBACK_COMPLETE.

The stack must be in a stable state before it can accept new update commands.

Run stack update with corrected template

The stack is updated with the corrected configuration.

This updates the resources and template definition to the desired state.

Anahtar Kavram

Handling AWS CloudFormation rollback failures and recovering from UPDATE_ROLLBACK_FAILED state by skipping deleted resources.

Soru 816Soru →

A developer is building a client-side utility in Python using the Boto3 SDK to encrypt database export files, each averaging $45\text{ MB}$ in size, before archiving them to an Amazon S3 bucket. The compliance policy requires the use of client-side envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS. Which of the following SDK workflows represents the correct and most efficient implementation for encrypting each file?

Call the KMS `generate_data_key` API to retrieve both a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, immediately delete the plaintext data key from memory, and store the encrypted file alongside the encrypted data key.

Call the KMS `generate_data_key_without_plaintext` API to retrieve the encrypted data key. Use the encrypted data key to encrypt the file locally, and store the encrypted file along with the encrypted data key.

Divide the file into chunks smaller than

4\text{ KB}

each. For each chunk, call the KMS `encrypt` API directly using the Customer Managed Key, concatenate the ciphertexts, and upload the final consolidated file.

Call the Systems Manager Parameter Store to retrieve the plaintext key material of the Customer Managed Key. Use this key material to encrypt the file locally, and upload the encrypted file.

Cevabı ve açıklamayı göster

Cevap: Call the KMS `generate_data_key` API to retrieve both a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, immediately delete the plaintext data key from memory, and store the encrypted file alongside the encrypted data key.

Cevap

The correct implementation is to call the KMS `generate_data_key` API using the Customer Managed Key ID. KMS returns both the plaintext data key and the ciphertext (encrypted) data key. The application uses the plaintext key to encrypt the large file locally (client-side) using an algorithm like AES-256, deletes the plaintext key from memory to maintain security, and stores the encrypted data key alongside the encrypted file (often as S3 metadata) so it can be sent to KMS for decryption later.

Adım Adım Çözüm

Request a data key from AWS KMS.

Receive a payload containing both the plaintext data key and the encrypted version of that key.

The plaintext key is required for local encryption, and the encrypted key is required for future decryption.

Encrypt the file locally using a symmetric encryption algorithm (e.g., AES-256) with the plaintext data key.

Generate the encrypted file payload.

Using the data key allows the encryption to happen locally, avoiding the

4\text{ KB}

limit of KMS direct encryption.

Secure the keys by deleting the plaintext data key from memory and keeping the encrypted data key.

The plaintext key is discarded, and the encrypted data key is kept.

Leaving the plaintext key in memory or writing it to disk is a security risk. The encrypted data key can only be decrypted by KMS.

Upload the encrypted file and the encrypted data key together to Amazon S3.

The ciphertext and metadata are stored in S3.

When decrypting, the client will retrieve the encrypted data key from S3 and pass it to KMS to get the plaintext key back.

Anahtar Kavram

AWS KMS Client-Side Envelope Encryption Workflow

Tahmini Süre:2m 30s

Soru 817Soru →

A company is deploying a containerized microservice to Amazon ECS on AWS Fargate using a blue/green deployment managed by AWS CodeDeploy. The deployment must run a database schema migration script before production traffic is routed to the new task set, and it must execute post-deployment integration tests once the traffic routing is complete. Additionally, the deployment process must have the necessary permissions to interact with ECS and Lambda. Which TWO options represent the correct configuration steps required for this deployment?

Geçerli olan tümünü seçin

Configure the AppSpec file with a BeforeAllowTraffic lifecycle hook pointing to a Lambda function that runs the database migration, and an AfterAllowTraffic hook pointing to a Lambda function that executes the post-deployment tests.

Configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Configure the AppSpec file with a BeforeInstall lifecycle hook referencing a shell script path to execute the database migrations directly inside the target ECS containers.

Add the sts:AssumeRole permission directly to the CodeDeploy service role's identity-based permissions policy to allow CodeDeploy to assume the ECS task execution role.

Store the database credentials in Systems Manager Parameter Store as a SecureString and enable the built-in Parameter Store automatic rotation feature to rotate the password before the BeforeAllowTraffic hook runs.

Cevabı ve açıklamayı göster

Cevap: Configure the AppSpec file with a BeforeAllowTraffic lifecycle hook pointing to a Lambda function that runs the database migration, and an AfterAllowTraffic hook pointing to a Lambda function that executes the post-deployment tests.; Configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Cevap

Configure the AppSpec file with a BeforeAllowTraffic hook pointing to a Lambda function to run the database migration and an AfterAllowTraffic hook pointing to a Lambda function for post-deployment tests, and configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

The correct configurations involve using ECS-compatible AppSpec hooks (BeforeAllowTraffic and AfterAllowTraffic invoking Lambda functions) and establishing the correct trust relationship on the CodeDeploy service role (trusting codedeploy.amazonaws.com to perform sts:AssumeRole).

Adım Adım Çözüm

Analyze the target compute platform and the required hooks.

Since the target platform is Amazon ECS, CodeDeploy lifecycle hooks must invoke AWS Lambda functions rather than executing local shell scripts.

ECS AppSpec syntax specifies Lambda functions for hooks, whereas EC2 AppSpec supports shell script execution.

Determine the correct sequencing for database migrations and post-deployment validation.

Migrations must happen before production traffic shifts (BeforeAllowTraffic), and integration tests must run after traffic shifts completely (AfterAllowTraffic).

Running migrations after traffic shifts would cause errors on the new task set, and tests must validate the live production traffic state.

Establish the necessary IAM authorization for CodeDeploy.

Configure a trust policy (trust relationship) on the CodeDeploy service role to allow the service principal codedeploy.amazonaws.com to assume it.

A trust policy is required for AWS services to assume a role and perform actions on resources in your account.

Anahtar Kavram

AWS CodeDeploy ECS Deployment Lifecycle Hooks and IAM Service Role Configuration

Soru 818Soru →

A developer is configuring a test stage in AWS CodePipeline that invokes an AWS Lambda function to run integration tests against an Amazon RDS database. The Lambda function requires access to the database credentials and must inform CodePipeline of the test execution results so the pipeline can proceed or halt. Which configuration steps should the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret.

Program the Lambda function to parse the job ID from the event payload and invoke PutJobSuccessResult or PutJobFailureResult to report the outcome to CodePipeline.

Store the database credentials as a standard parameter in Systems Manager Parameter Store and retrieve them using the Parameter Store API.

Modify the trust policy of the Lambda execution role to allow the CodePipeline service principal to assume the role.

Save the database credentials as plaintext environment variables in the Lambda function configuration to bypass permission checks.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret.; Program the Lambda function to parse the job ID from the event payload and invoke PutJobSuccessResult or PutJobFailureResult to report the outcome to CodePipeline.

Cevap

Store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret. Program the Lambda function to parse the job ID from the event payload and invoke PutJobSuccessResult or PutJobFailureResult to report the outcome to CodePipeline.

The correct steps involve securely managing credentials and properly signaling CodePipeline. Storing database credentials in AWS Secrets Manager is secure and supports automatic rotation. Additionally, AWS CodePipeline expects any invoked Lambda action to notify it of success or failure by calling PutJobSuccessResult or PutJobFailureResult using the job ID extracted from the event payload.

Adım Adım Çözüm

Analyze how AWS CodePipeline interacts with custom Lambda actions.

The Lambda function receives a job details payload from CodePipeline containing a unique job ID.

This job ID is required to notify CodePipeline of the action's success or failure using the appropriate API calls.

Implement the completion signaling logic inside the Lambda function.

The Lambda code calls PutJobSuccessResult on success or PutJobFailureResult on failure, passing the job ID.

If the Lambda function does not send this signal, CodePipeline will remain in the 'InProgress' state until the action times out.

Evaluate options for secure credential retrieval.

Database credentials should be stored in AWS Secrets Manager, and the Lambda execution role must be granted permissions to retrieve them.

This ensures the credentials are encrypted, not hardcoded in the codebase, and can be rotated automatically.

Anahtar Kavram

AWS CodePipeline integration with AWS Lambda requires the Lambda function to explicitly return status using the PutJobSuccessResult or PutJobFailureResult API, and secrets should be managed securely using AWS Secrets Manager.

Tahmini Süre:2m 0s

Soru 819Soru →

A developer is configuring an in-place deployment in AWS CodeDeploy for an application running on a fleet of $12$ Amazon EC2 instances. To prevent performance degradation during peak hours, the application must maintain at least $75\%$ of its serving capacity online and healthy at all times during the update. The developer wants to configure the deployment to update the maximum number of instances simultaneously while strictly adhering to this availability constraint. Which configuration should the developer use?

Create a custom deployment configuration with Minimum Healthy Hosts defined as a type of FLEET_PERCENT with a value of

75

Create a custom deployment configuration with Minimum Healthy Hosts defined as a type of HOST_COUNT with a value of

3

Use the predefined CodeDeployDefault.HalfAtATime deployment configuration.

Use the predefined CodeDeployDefault.OneAtATime deployment configuration.

Cevabı ve açıklamayı göster

Cevap: Create a custom deployment configuration with Minimum Healthy Hosts defined as a type of FLEET_PERCENT with a value of $75$ .

Cevap

Create a custom deployment configuration with Minimum Healthy Hosts defined as a type of FLEET_PERCENT with a value of

75

The correct option ensures that

75\%

of the instance capacity (

9

instances) remains healthy and online during the deployment. This allows CodeDeploy to update the remaining

3

instances (

25\%

) in parallel, completing the deployment as quickly as possible without violating the availability threshold.

Adım Adım Çözüm

Calculate the minimum number of healthy instances required.

At least

9

instances must remain online (

12 \times 0.75 = 9

This establishes the target capacity baseline that cannot be breached during the rolling update.

Evaluate the maximum number of instances that can be updated simultaneously.

A maximum of

3

instances can be updated at any given time (

12 - 9 = 3

To complete the deployment as fast as possible, CodeDeploy should update the maximum allowable instances (

3

) in each batch.

Determine the type and value for the Minimum Healthy Hosts parameter.

Set Minimum Healthy Hosts to a type of FLEET_PERCENT with a value of

75

(or HOST_COUNT with a value of

9

Using FLEET_PERCENT with

75\%

ensures that

9

instances remain online. The predefined configurations (such as HalfAtATime) or setting HOST_COUNT to

3

would violate the constraint or deploy slower than necessary.

Anahtar Kavram

Custom deployment configurations in AWS CodeDeploy allow developers to define availability requirements using the Minimum Healthy Hosts parameter, specified as either a percentage or absolute host count.

Tahmini Süre:2m 0s

Soru 820Soru →

A developer is attempting to update an AWS CloudFormation stack that manages a microservices application. During a previous update attempt, a custom resource failed to stabilize, triggering a rollback. During the rollback, the stack became stuck in the `UPDATE_ROLLBACK_FAILED` state because an IAM role resource defined in the template had been manually deleted from the AWS account. The developer has created a new IAM role and needs to update the stack to use this new role.

How should the developer resolve this issue and successfully apply the update to the stack?

Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.

Submit a new stack update with the corrected template immediately using the --force-update flag in the AWS CLI to bypass the current rollback state.

Run drift detection to automatically identify the missing IAM role, select the option to synchronize the stack resources with the physical resources, and then execute a standard stack update.

Store the new IAM role's ARN in AWS Systems Manager Parameter Store, configure the template to dynamically reference this parameter, and initiate a stack synchronization.

Cevabı ve açıklamayı göster

Cevap: Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.

Cevap

The correct option outlines the required operational procedure for recovering a stack from the UPDATE_ROLLBACK_FAILED state when a resource (the IAM role) has been deleted out-of-band. The developer must use the ContinueUpdateRollback operation and opt to skip the deleted resource. This allows CloudFormation to bypass the missing resource and complete the rollback sequence, shifting the stack status to UPDATE_ROLLBACK_COMPLETE. From there, a regular stack update can be initiated using the corrected template that points to the new IAM role.

Adım Adım Çözüm

Acknowledge the current stack state.

The stack is stuck in the UPDATE_ROLLBACK_FAILED state, which blocks any direct update actions.

CloudFormation prevents updates on stacks that are not in a clean, stable state (such as UPDATE_ROLLBACK_COMPLETE or CREATE_COMPLETE).

Trigger the ContinueUpdateRollback process.

The rollback resumes, but normally it would fail again because the IAM role is missing.

Initiating ContinueUpdateRollback is the only way to move the stack out of the failed rollback state.

Skip the deleted IAM role resource during the ContinueUpdateRollback operation.

CloudFormation marks the rollback of the missing IAM role as complete without attempting to modify it, allowing the rest of the stack rollback to finish successfully.

Skipping resources that cannot be rolled back (due to manual deletion) prevents the rollback from failing again.

Verify stack state and perform the update.

The stack reaches the UPDATE_ROLLBACK_COMPLETE state, and the developer successfully deploys the new template pointing to the new IAM role.

Once the stack is stable, it can process standard update requests normally.

Anahtar Kavram

CloudFormation Rollback Troubleshooting and Recovery

ÖncekiSayfa 41 / 78Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram