Examkin

Deployment

376 soru

Tüm türler376Çoktan seçmeli191Çoklu seçim171Sıralama14
Soru 301Soru →

An engineer is setting up a build process in AWS CodeBuild for a repository where the build specification file is named buildspec.yml and is located inside a directory named config/ instead of the root directory. The build fails during the initial phase because the buildspec file cannot be found. How can the engineer configure CodeBuild to successfully locate and use this buildspec file?

Cevabı ve açıklamayı göster

Cevap: Update the buildspec path in the AWS CodeBuild project configuration to point to config/buildspec.yml.

Cevap

Update the buildspec path in the AWS CodeBuild project configuration to point to config/buildspec.yml.
The correct action is to update the buildspec path in the AWS CodeBuild project settings to point to the actual subdirectory path. AWS CodeBuild allows developers to override the default root location by specifying a custom file path relative to the root of the repository.

Adım Adım Çözüm

Identify the default behavior of AWS CodeBuild regarding the buildspec file.
CodeBuild expects the buildspec.yml file to be located at the root of the source directory by default.
To understand why the build is failing when the file is in the config/ directory.
Determine how to override the default buildspec path in CodeBuild.
The project configuration allows defining a custom path relative to the root directory, such as config/buildspec.yml.
To tell CodeBuild where to look for the configuration file during the build initialization phase.
Update the CodeBuild project settings using the AWS Console, AWS CLI, or AWS CloudFormation.
The build specification is resolved successfully and the build starts.
To apply the configuration changes and fix the failing build.

Anahtar Kavram

Custom Buildspec File Paths
Soru 302Soru →

A developer is deploying a three-tier web application using an AWS CloudFormation template. The template defines an Amazon RDS DB instance that requires database credentials. The company's security policy requires that database passwords must be stored securely, rotated every 30 days, and retrieved dynamically during stack operations. Additionally, the developer must ensure that any failed stack updates automatically revert to the last stable state without leaving orphaned resources or requiring manual intervention. Which two actions should the developer take to meet these security and deployment requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format.; Rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.

Cevap

Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format, and rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.
Storing database credentials in AWS Secrets Manager and referencing them using dynamic references satisfies the credential security and 30-day rotation policy while keeping passwords out of plaintext template properties. Relying on default CloudFormation update rollbacks ensures that stack updates that fail revert all affected resources back to their original stable configurations automatically.

Adım Adım Çözüm

1
Select AWS Secrets Manager as the secure vault for credentials.
The database password is created and stored in AWS Secrets Manager, allowing automatic 30-day rotation configurations.
Parameter Store does not support automatic rotation natively, making Secrets Manager the compliant choice for rotated secrets.
2
Integrate the secret reference into the CloudFormation template using dynamic references.
CloudFormation retrieves the password dynamically at runtime during stack operations without exposing the password in template files.
Dynamic references are resolved only during resource provisioning and keep plaintext passwords out of templates and outputs.
3
Determine the automatic rollback strategy on deployment failure.
The rollback mechanism reverts stack resources back to their pre-update state, returning the stack to UPDATE_ROLLBACK_COMPLETE on failure.
This behavior prevents orphan resources and returns the infrastructure configuration to the last known stable state.

Anahtar Kavram

AWS CloudFormation deployment lifecycle controls stack update rollbacks and integrates with AWS Secrets Manager via dynamic references to handle rotated secrets securely.
Tahmini Süre:2m 0s
Soru 303Soru →

A company runs a containerized web application on Amazon ECS using the AWS Fargate launch type. The ECS service is configured with a desired count of 88 tasks. Due to strict budget constraints, the developer cannot allocate any additional Fargate tasks or capacity during a deployment. However, the application must remain online, maintaining at least 50%50\% of its desired processing capacity throughout the update process.

Which two deployment configuration values should the developer specify in the ECS service definition to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: `minimumHealthyPercent` set to 5050; `maximumPercent` set to 100100

Cevap

Setting the minimum healthy percent to 5050 and the maximum percent to 100100.
Specifying a `maximumPercent` of 100100 and a `minimumHealthyPercent` of 5050 satisfies all constraints. Setting `maximumPercent` to 100100 ensures that Amazon ECS does not provision any extra Fargate tasks beyond the desired count during the deployment, adhering to the strict budget limits. Setting `minimumHealthyPercent` to 5050 ensures that at least half of the tasks (44 out of 88) remain running and healthy during the update, maintaining the required processing capacity online.

Adım Adım Çözüm

1
Analyze the capacity and resource constraint.
The constraint states that no additional tasks or capacity can be allocated during the deployment. Therefore, the maximum number of concurrent running or pending tasks must be capped exactly at the desired count, which is 100%100\%. This determines that `maximumPercent` must be 100100.
Setting `maximumPercent` to 100100 prevents Amazon ECS from scaling up and provisioning extra Fargate tasks during the update.
2
Analyze the availability constraint.
The application must maintain at least 50%50\% of its processing capacity online at all times. Since the desired count is 88 tasks, at least 44 tasks must remain running and healthy. This determines that `minimumHealthyPercent` must be 5050.
Setting `minimumHealthyPercent` to 5050 guarantees that Amazon ECS will only stop up to 44 tasks at a time, keeping the remaining 44 active to handle incoming traffic.

Anahtar Kavram

Amazon ECS Rolling Updates Configuration
Soru 304Soru →

A developer is configuring an AWS CodeBuild project to build a Docker image and push it to an Amazon Elastic Container Registry (ECR) repository. The CodeBuild project is configured to run inside a private VPC subnet to access internal databases. During the build execution, CodeBuild fails to pull the public base image from Docker Hub and fails to authenticate with the Amazon ECR repository. Which TWO actions should the developer take to resolve these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a NAT Gateway in a public subnet of the VPC, and update the route table of the CodeBuild private subnet to route outbound traffic through the NAT Gateway.; Add the ecr:GetAuthorizationToken permission and repository permissions (such as ecr:BatchCheckLayerAvailability and ecr:PutImage) to the IAM service role associated with the CodeBuild project.

Cevap

The developer should configure a NAT Gateway to allow internet access for CodeBuild's private subnet, and attach the required ECR permissions to the CodeBuild service role.
Routing outbound traffic through a NAT Gateway enables the CodeBuild container inside the private subnet to connect to the public Docker Hub registry. Additionally, attaching ECR permissions to the service role allows the build container to authenticate and push the compiled Docker image to Amazon ECR.

Adım Adım Çözüm

1
Analyze the network route for pulling external dependencies.
CodeBuild requires internet access to pull base images from public Docker Hub. Since CodeBuild is running in a private VPC subnet, a NAT Gateway must be configured in a public subnet to forward this outbound traffic.
Resolves the connection failure when attempting to pull the public base image.
2
Analyze IAM role permissions for ECR authentication and upload.
The CodeBuild project's service role needs permission to fetch an authorization token from ECR (ecr:GetAuthorizationToken) and perform repository write actions.
Resolves the authentication and push authorization failures when interacting with Amazon ECR.

Anahtar Kavram

AWS CodeBuild VPC routing and ECR IAM permissions
Soru 305Soru →

A developer is configuring a new AWS CodeBuild project to build and package a serverless application. When attempting to start a build, the execution fails immediately with the error message: "Failed to assume the service role." The developer confirms that the associated IAM service role has the correct managed policies for accessing Amazon S3, Amazon CloudWatch Logs, and VPC resources. What should the developer modify to resolve this issue and allow the build to initiate?

Cevabı ve açıklamayı göster

Cevap: The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.

Cevap

The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.
The correct option is the one specifying the trust relationship of the IAM service role. For AWS CodeBuild to execute a build, it must assume the specified IAM service role. This trust relationship must be defined in the role's trust policy, permitting the 'codebuild.amazonaws.com' service principal to call 'sts:AssumeRole'.

Adım Adım Çözüm

1
Analyze the error message "Failed to assume the service role."
Identify that the issue is an authorization failure preventing CodeBuild from assuming the assigned IAM role at build start.
This isolates the issue to the trust boundary between the AWS CodeBuild service and the IAM service role.
2
Differentiate between IAM permissions policies and IAM trust policies.
Determine that while permissions policies govern what the role can do after it is assumed, the trust policy (trust relationship) governs which entities are permitted to assume the role.
This explains why verifying the attached managed policies did not solve the startup failure.
3
Configure the trust relationship to trust CodeBuild.
Add codebuild.amazonaws.com as a trusted service principal with the sts:AssumeRole action.
This allows CodeBuild to successfully assume the role and execute the container environment.

Anahtar Kavram

AWS CodeBuild Service Role Trust Policy
Soru 306Soru →

A developer is updating a serverless API backend running on AWS Lambda. The deployment must minimize user-facing impact by routing 10%10\% of the incoming traffic to the new Lambda version for a test window of 1010 minutes, while monitoring a CloudWatch alarm. If the alarm remains green, the remaining 90%90\% of traffic must shift to the new version immediately. If the alarm is triggered, the deployment must revert to the original version. Which AWS CodeDeploy configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.LambdaCanary10Percent10Minutes

Cevap

CodeDeployDefault.LambdaCanary10Percent10Minutes
The configuration CodeDeployDefault.LambdaCanary10Percent10Minutes routes 10% of traffic to the new Lambda version, waits 10 minutes, and then immediately routes the remaining 90% if no alarms are triggered. This perfectly aligns with the requirement for a 10-minute test window at 10% traffic followed by an immediate shift of the remaining traffic.

Adım Adım Çözüm

1
Analyze the traffic shifting requirement
The deployment requires routing 10% of traffic initially, waiting for a specific test duration, and then routing the remaining 90% immediately.
This behavior corresponds to a Canary deployment strategy rather than a Linear or All-At-Once deployment strategy.
2
Identify the required test window duration
The test window duration is specified as 10 minutes.
This requires a configuration that specifies a 10-minute wait time.
3
Select the matching pre-defined AWS CodeDeploy configuration
The configuration CodeDeployDefault.LambdaCanary10Percent10Minutes meets both the 10% initial shift and 10-minute duration criteria.
CodeDeployDefault.LambdaCanary10Percent10Minutes routes 10% of traffic first and shifts the remaining 90% after 10 minutes if health checks pass.

Anahtar Kavram

AWS CodeDeploy Canary vs Linear configurations for serverless deployments
Tahmini Süre:1m 30s
Soru 307Soru →

A developer is setting up an AWS CodeBuild project for a microservice located in a subdirectory (`services/order-service`) of a monorepo. The build process needs to run tests that require a database password stored in AWS Secrets Manager, and it must use a custom build specification file located at `services/order-service/buildspec.yml`. During the initial build run, the build fails immediately because the build specification file cannot be found, and the developer realizes that the application also lacks permission to fetch the database password.

Which combination of actions must the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml.; Add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

Cevap

Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml, and add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.
To fix the buildspec resolution issue, the developer must update the CodeBuild project settings to specify the custom path services/order-service/buildspec.yml, since CodeBuild expects buildspec.yml in the repository root by default. To resolve the permission issue, the developer must add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project so that it is authorized to retrieve the database credentials.

Adım Adım Çözüm

1
Configure the CodeBuild project settings with the custom buildspec location.
CodeBuild searches for the buildspec at services/order-service/buildspec.yml instead of the default root path, successfully finding and executing it.
By default, CodeBuild expects the buildspec file to be named buildspec.yml and located in the root of the repository source directory. Any other configuration must be specified in the project settings.
2
Update the IAM service role permissions policy for the CodeBuild project.
The project gains permission to fetch the secret from Secrets Manager.
CodeBuild assumes a service role during execution. This role must have an identity-based policy allowing secretsmanager:GetSecretValue in order to read the credentials.

Anahtar Kavram

AWS CodeBuild buildspec configuration and IAM service role permissions.
Soru 308Soru →

A development team manages their application infrastructure using an AWS CloudFormation stack. A developer needs to update the stack to change the instance type of an Amazon EC2 instance. However, drift detection reveals that the security group attached to the EC2 instance was manually modified out-of-band in the AWS Management Console to allow traffic on port 80808080. In addition, the developer needs to reference a database password that must be automatically rotated.

Which combination of steps should the developer take to resolve the drift and retrieve the password securely and cost-effectively? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the CloudFormation template to match the drifted security group configuration (allowing port 80808080) before proceeding with the stack update.; Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Cevap

Update the CloudFormation template to match the drifted security group configuration before proceeding with the stack update, and use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.
To resolve the configuration drift where port 80808080 was manually allowed, the developer must update the template to match this state before performing subsequent updates. Additionally, retrieving an automatically rotated database credential is best achieved by storing the credential in AWS Secrets Manager and accessing it using a dynamic reference in the template.

Adım Adım Çözüm

1
Analyze the drift detection results for the security group resource.
Identify that port 80808080 was manually allowed out-of-band.
Before performing stack updates, drift must be resolved to prevent update failures or configuration overwrites.
2
Modify the CloudFormation template to include the port 80808080 configuration in the security group resource definition.
The template now matches the live resource configuration.
This aligns the template with the drifted state, resolving the drift status.
3
Implement a dynamic reference using the Secrets Manager resolver pattern in the template to access the database password.
The template references the secret securely without hardcoding it.
Secrets Manager provides native support for automated credential rotation, unlike Systems Manager Parameter Store.

Anahtar Kavram

CloudFormation drift resolution and dynamic references for rotated secrets
Soru 309Soru →

A developer is configuring a build project in AWS CodeBuild to package an application. The build process requires retrieving a non-sensitive database port number that rarely changes, and a database password that must be automatically rotated every 30 days. To optimize for cost, operational efficiency, and security, which configuration should the developer implement?

Cevabı ve açıklamayı göster

Cevap: Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.

Cevap

Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.
Storing the port in Parameter Store is cost-effective because standard parameters are free. Storing the password in Secrets Manager meets the security requirement for automatic rotation. Referencing them in the parameter-store and secrets-manager blocks of the env section in the root buildspec.yml file allows CodeBuild to automatically fetch the values and inject them as environment variables during the build execution.

Adım Adım Çözüm

1
Identify the security and operational requirements of the two variables.
The database port is non-sensitive and static, while the database password is sensitive and requires automatic rotation every 30 days.
This classification determines the most cost-effective and secure AWS service to store each parameter.
2
Select the appropriate storage service for each parameter type.
AWS Systems Manager Parameter Store is chosen for the database port to avoid costs. AWS Secrets Manager is chosen for the database password to support automatic rotation.
Parameter Store does not natively support rotation of secrets, while Secrets Manager is expensive for non-sensitive parameters.
3
Configure the retrieval mechanism in the build specification.
Reference the variables under their respective blocks (parameter-store and secrets-manager) in the env section of the root buildspec.yml file.
AWS CodeBuild natively supports retrieving values from both services during the build lifecycle when configured in the buildspec.

Anahtar Kavram

Retrieving configuration data and secrets in AWS CodeBuild using AWS Systems Manager Parameter Store and AWS Secrets Manager
Tahmini Süre:1m 30s
Soru 310Soru →

A developer is creating an AWS CloudFormation template to deploy a web application. The application requires access to two configuration values:

1. A database connection password that must support automatic rotation every 30 days.
2. A public API endpoint URL for a third-party service that is non-sensitive and updated infrequently.

To follow security best practices and optimize costs, how should the developer store and reference these values in the CloudFormation template?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Cevap

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference, and store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.
Storing the database password in AWS Secrets Manager and referencing it via a dynamic reference satisfies the security and automatic rotation requirements. Storing the non-sensitive public API endpoint URL in Systems Manager Parameter Store standard parameters satisfies the cost-efficiency constraint because Parameter Store standard parameters are free, and using a dynamic reference allows secure integration without exposure.

Adım Adım Çözüm

1
Determine the storage requirements for the database password.
The password requires automatic rotation every 30 days, which points to AWS Secrets Manager as the appropriate service because it integrates with AWS Lambda for automated credential rotation.
Systems Manager Parameter Store does not offer native automatic rotation for secrets.
2
Determine the storage requirements for the non-sensitive public API endpoint.
The endpoint URL is non-sensitive and updated infrequently, making Systems Manager Parameter Store standard parameters the most cost-effective choice since they are free.
Using Secrets Manager for non-sensitive data incurs unnecessary monthly costs.
3
Identify the proper CloudFormation integration method.
Use dynamic references to resolve the values dynamically at runtime (e.g., {{resolve:secretsmanager:...}} and {{resolve:ssm:...}}).
Dynamic references allow CloudFormation to securely retrieve external values during deployment without hardcoding them in the template.

Anahtar Kavram

Selecting and referencing the appropriate parameter store or secrets service in CloudFormation based on security, rotation, and cost requirements.
Tahmini Süre:1m 30s
Soru 311Soru →

A developer needs to deploy a new version of an application to an active AWS Elastic Beanstalk environment. The application must maintain 100% of its instance capacity to handle traffic during the deployment process. The deployment must be completed within the existing environment without creating a second, separate Elastic Beanstalk environment. Which two deployment strategies will meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rolling with additional batch; Immutable

Cevap

The correct strategies are 'Rolling with additional batch' and 'Immutable' because they both maintain full capacity throughout the deployment process and run entirely within the existing Elastic Beanstalk environment.
The correct strategies are the 'Rolling with additional batch' and 'Immutable' deployment strategies. The 'Rolling with additional batch' strategy launches a temporary batch of instances first, ensuring that the environment's capacity never drops below 100% during the rolling update. The 'Immutable' strategy launches a full set of new instances in a temporary Auto Scaling group, ensuring full capacity is maintained, and performs a clean switchover within the existing environment once health checks pass.

Adım Adım Çözüm

1
Analyze the capacity requirement
The application must maintain 100% capacity. This rules out standard 'Rolling' (which reduces capacity by the batch size) and 'All at once' (which takes all instances offline).
Determining which deployment strategies preserve capacity.
2
Analyze the environment boundary constraint
The deployment must occur within the existing environment. This rules out 'Blue/Green (Environment Swap)' because it requires provisioning a new, separate Elastic Beanstalk environment.
Filtering out strategies that require multiple environments.
3
Identify matching strategies
'Rolling with additional batch' and 'Immutable' both run in the existing environment, provision temporary instances to maintain 100% capacity, and clean up the extra instances afterward.
Selecting the remaining compliant strategies.

Anahtar Kavram

Elastic Beanstalk deployment policies balance cost, deployment speed, capacity, and environmental overhead.
Tahmini Süre:1m 30s
Soru 312Soru →

A developer is configuring an AWS CodeBuild project that runs as a stage in an AWS CodePipeline. During the build execution, a script generates a dynamic version identifier based on the current git commit hash. The developer needs to pass this dynamically generated version identifier directly to a subsequent deployment stage in the pipeline without creating external dependencies. Which configuration in the `buildspec.yml` file will achieve this?

Cevabı ve açıklamayı göster

Cevap: Define the variable name under the `exported-variables` sequence in the `env` block.

Cevap

Define the variable name under the `exported-variables` sequence in the `env` block.
Defining the variable name under the `exported-variables` sequence in the `env` block allows CodeBuild to export the value of environment variables that are dynamically set during the build execution. AWS CodePipeline captures these exported variables and makes them available to downstream pipeline actions as variables.

Adım Adım Çözüm

1
Add the desired environment variable name to the `exported-variables` sequence under the `env` block in `buildspec.yml`.
CodeBuild is configured to monitor and capture this specific environment variable's value at the end of the build execution.
This registers the variable name so CodeBuild knows to export it.
2
Assign the dynamic commit-based value to the environment variable inside one of the build commands, such as using `export MY_VERSION=$(git rev-parse --short HEAD)`.
The variable is populated with the dynamically generated value during the build execution.
This updates the environment variable's value dynamically during runtime.
3
Reference the exported variable in downstream CodePipeline actions using the namespace syntax.
The subsequent stages in AWS CodePipeline can access the version identifier natively.
This completes the transfer of the dynamic variable across the pipeline without external API calls or storage.

Anahtar Kavram

AWS CodeBuild Exported Variables
Soru 313Soru →

A developer needs to update a web application running on an AWS Elastic Beanstalk environment. The update must be performed with zero downtime. Due to strict budget constraints, the environment must not provision any additional Amazon EC2 instances during the deployment process. The development team is willing to accept a temporary reduction in application capacity while the update is in progress. Which deployment strategy should the developer configure?

Cevabı ve açıklamayı göster

Cevap: Rolling

Cevap

Rolling
The Rolling deployment strategy updates instances in-place in batches. Because it uses the existing instances to perform the update and does not launch additional instances, it complies with the budget constraint. It keeps the remaining instances in service during the batch updates, satisfying the zero-downtime requirement at the expense of a temporary reduction in capacity.

Adım Adım Çözüm

1
Analyze the requirements and constraints in the scenario.
Requirements identified: 1. Zero downtime. 2. No additional EC2 instances allowed due to budget. 3. Temporary capacity reduction is acceptable.
Understanding the constraints is necessary to eliminate unsuitable deployment options.
2
Evaluate the available AWS Elastic Beanstalk deployment policies against the constraints.
All-at-once causes downtime. Immutable and Rolling with additional batch launch new EC2 instances. Rolling updates existing instances in batches without provisioning extra instances.
To find the strategy that satisfies both zero-downtime and zero additional instance creation.
3
Select the strategy that meets all constraints.
Rolling is the correct selection as it updates instances in-place in batches, incurring no extra instance costs and maintaining service availability at reduced capacity.
Ensures the selected option fulfills the application requirements.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies allow developers to balance application availability, capacity, and cost during updates.
Soru 314Soru →

A developer is deploying updates to an AWS CloudFormation stack. The update fails due to a configuration error, initiating an automatic rollback. However, the rollback fails because a security group managed by the stack was manually attached to an EC2 instance outside of CloudFormation, placing the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to successfully complete the rollback and return the stack to a stable state. Which action should the developer take to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

Cevap

Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.
When a resource deletion blocks a stack rollback, the correct procedure is to use the 'Continue update rollback' operation. This action allows the developer to skip the specific resource that is failing to roll back. CloudFormation will mark that resource's state as skipped and proceed to complete the rollback for the rest of the stack, bringing it back to a stable UPDATE_ROLLBACK_COMPLETE status. Afterward, the developer must manually clean up the skipped resource.

Adım Adım Çözüm

1
Identify the cause of the rollback failure.
Determine that the security group cannot be deleted because it is still in use by an out-of-band EC2 instance.
You must identify which resource is blocking the rollback before deciding on the recovery path.
2
Use the CloudFormation console or AWS CLI to execute the 'Continue update rollback' action.
Specify the security group in the list of resources to skip during the rollback operation.
Skipping the blocked resource allows CloudFormation to successfully complete the rollback process for all other resources, transitioning the stack to the UPDATE_ROLLBACK_COMPLETE state.
3
Perform manual remediation of the skipped resource.
Manually detach the security group from the out-of-band EC2 instance and clean up the association.
Since the resource was skipped, it remains in its current state and must be manually aligned with the desired state once the stack is stable.

Anahtar Kavram

Resolving UPDATE_ROLLBACK_FAILED states by skipping blocked resources during the Continue Update Rollback operation.
Soru 315Soru →

A developer is configuring an AWS CodeBuild project to build a containerized application. The build process must retrieve a database credential that undergoes automatic rotation every 3030 days. In addition, the source code repository holds a custom build specification file at the path `build-configs/custom-buildspec.yml` instead of the root directory.

Which two configurations must the developer perform to ensure the build project executes successfully?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the CodeBuild project settings by specifying `build-configs/custom-buildspec.yml` in the buildspec configuration path.; Store the database credential in AWS Secrets Manager and reference it in the `secrets-manager` section under the `env` sequence in the buildspec file.

Cevap

The developer must configure the CodeBuild project settings to point to the custom buildspec path, and store the database credential in AWS Secrets Manager while referencing it in the buildspec's env section.
To successfully execute this build project, the developer must specify the custom buildspec location (`build-configs/custom-buildspec.yml`) in the CodeBuild project configuration because CodeBuild defaults to looking for a file named `buildspec.yml` in the root directory. Additionally, because the database credential requires automatic rotation, it must be stored in AWS Secrets Manager (which supports rotation) and retrieved in the buildspec file using the `secrets-manager` parameter within the `env` section.

Adım Adım Çözüm

1
Determine the correct storage and retrieval mechanism for a rotated database credential.
Choose AWS Secrets Manager over Systems Manager Parameter Store.
The requirement specifies that the credential undergoes automatic rotation, which is natively supported by AWS Secrets Manager.
2
Determine the configuration needed to handle the custom buildspec file location.
Explicitly set the buildspec path in the CodeBuild project settings to `build-configs/custom-buildspec.yml`.
By default, CodeBuild looks for a file named `buildspec.yml` at the root of the repository. Any custom path or filename must be declared in the project settings.

Anahtar Kavram

Configuring custom buildspec paths in AWS CodeBuild and integrating AWS Secrets Manager for secrets requiring automatic rotation.
Tahmini Süre:1m 30s
Soru 316Soru →

A developer is using AWS CodeDeploy to perform an in-place deployment of an application to an EC2 Auto Scaling group containing 44 running instances. The application must maintain at least 75%75\% of its traffic-serving capacity during the deployment process to handle regular user traffic. The developer also wants to avoid launching any new EC2 instances to minimize additional costs.

Which of the following CodeDeploy configurations will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The CodeDeployDefault.OneAtATime default deployment configuration; A custom deployment configuration with the minimum healthy hosts parameter set to a host count of 33

Cevap

The correct configurations are the CodeDeployDefault.OneAtATime default deployment configuration and a custom deployment configuration with the minimum healthy hosts parameter set to a host count of 33.
The correct options are the default configuration that updates one host at a time and the custom configuration that specifies a minimum of 33 healthy hosts. With a desired capacity of 44 instances, maintaining 75%75\% capacity means at least 33 instances must remain online and healthy during the deployment. The configuration that deploys to one instance at a time will update exactly 11 instance, leaving 33 active (75%75\%). Similarly, setting the custom minimum healthy hosts to a host count of 33 explicitly forces CodeDeploy to maintain 33 healthy instances throughout the process.

Adım Adım Çözüm

1
Calculate the number of healthy instances required to meet the 75%75\% capacity threshold.
For a fleet of 44 instances, 75%75\% capacity requires at least 33 instances to remain healthy and online (4×0.75=34 \times 0.75 = 3).
To understand the minimum healthy host constraint needed for the deployment configuration.
2
Analyze the default and custom CodeDeploy configurations against the calculated constraint.
CodeDeployDefault.OneAtATime updates 11 instance at a time, leaving 33 online (75%75\%). A custom configuration with minimum healthy hosts set to a host count of 33 explicitly guarantees 33 online instances.
To identify which specific configurations satisfy the target constraint of keeping at least 33 instances healthy.

Anahtar Kavram

AWS CodeDeploy deployment configurations and minimum healthy hosts settings for EC2 deployments
Soru 317Soru →

An organization is setting up a continuous integration pipeline. The build phase is executed by AWS CodeBuild using a custom IAM service role. However, during the initial run, the build fails immediately before executing any build phases, throwing an error that CodeBuild is not authorized to assume the specified service role. Which of the following actions will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.

Cevap

Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.
The correct answer is to modify the trust policy of the IAM service role. AWS CodeBuild requires a service role to perform actions on your behalf. For CodeBuild to assume this role, the role's trust policy must explicitly allow the 'codebuild.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. Without this trust relationship, CodeBuild cannot run the build project and fails immediately during initialization.

Adım Adım Çözüm

1
Identify the service principal for AWS CodeBuild.
The service principal is codebuild.amazonaws.com.
AWS services require trust relationships defined by their specific service principal to assume IAM roles.
2
Locate the trust policy of the CodeBuild service role in the IAM console.
The trust policy is found under the 'Trust relationships' tab of the role.
The trust policy determines which entities are trusted to assume the role.
3
Update the trust policy document to include the service principal with sts:AssumeRole permission.
CodeBuild is now authorized to assume the role, and the build starts successfully.
Allowing the service principal in the trust policy resolves the authorization failure during CodeBuild initialization.

Anahtar Kavram

AWS CodeBuild service role trust policy configuration
Soru 318Soru →

An application deployed via an AWS CloudFormation stack requires a database password that must be rotated automatically every 30 days. Additionally, operators occasionally make direct manual changes to the security group rules associated with the stack, which causes drift between the physical resources and the template definition. Which two actions should the developer take to manage these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the password in AWS Secrets Manager, enable automatic rotation, and reference the password in the CloudFormation template using a dynamic reference.; Use AWS CloudFormation drift detection to identify manual modifications, and then update the template or resource properties to align with the actual state.

Cevap

To securely manage the password and handle out-of-band configuration changes, the developer should store the password in AWS Secrets Manager with automatic rotation enabled and reference it in the CloudFormation template using dynamic references. In addition, the developer should use AWS CloudFormation drift detection to identify manual modifications and update the template or resource properties to align them.
The correct approach involves using AWS Secrets Manager to store the database password with automatic rotation and reference it securely in CloudFormation using dynamic references. Additionally, using CloudFormation drift detection helps developers identify out-of-band modifications to resources and synchronize the stack configuration, avoiding deployment failures.

Adım Adım Çözüm

1
Determine the storage and rotation method for the password.
AWS Secrets Manager is selected because it supports automatic rotation natively, unlike Systems Manager Parameter Store.
Satisfies the security requirement for automatic 30-day rotation.
2
Reference the stored password in the CloudFormation template.
Use dynamic references to retrieve the password from Secrets Manager at deployment time.
Avoids hardcoding sensitive passwords in the CloudFormation template.
3
Resolve resource drift caused by manual changes.
Run drift detection on the stack to identify differences, and update the template or import the actual resources to align them.
Prevents future stack updates from failing due to conflicts with manual modifications.

Anahtar Kavram

AWS CloudFormation Drift Detection and AWS Secrets Manager Dynamic References
Soru 319Soru →

A developer is setting up a blue/green deployment for a containerized application running on Amazon ECS using AWS CodeDeploy. The deployment must route 10%10\% of the production traffic to the new version of the application immediately. The remaining 90%90\% of the traffic must be routed to the new version only after a 1515-minute validation period, during which the application's health is monitored. If any errors occur during this period, CodeDeploy must automatically roll back the deployment.

Which pre-defined CodeDeploy deployment configuration should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.ECSCanary10Percent15Minutes

Cevap

CodeDeployDefault.ECSCanary10Percent15Minutes
The configuration CodeDeployDefault.ECSCanary10Percent15Minutes is correct because it is a pre-defined CodeDeploy deployment configuration designed for Amazon ECS. It shifts 10%10\% of traffic to the replacement task set immediately, waits for 1515 minutes for validation and monitoring, and then routes the remaining 90%90\% of traffic to the new version.

Adım Adım Çözüm

1
Identify the target compute platform.
The application runs on Amazon ECS, so the configuration name must begin with CodeDeployDefault.ECS.
CodeDeploy has separate pre-defined configurations for ECS, Lambda, and EC2/On-Premises.
2
Determine the traffic shifting pattern.
The requirement is to shift a small portion (10%10\%) and then the rest after a delay, which corresponds to a Canary deployment pattern.
Linear configurations shift traffic in equal increments at regular intervals, whereas Canary configurations shift an initial percentage, wait for a specified time, and then shift all remaining traffic.
3
Match the specified percentage and time interval parameters.
The parameters are 10%10\% traffic shifted immediately and a 1515-minute wait time, which matches CodeDeployDefault.ECSCanary10Percent15Minutes.
This is a standard pre-defined deployment configuration provided by AWS CodeDeploy for ECS.

Anahtar Kavram

AWS CodeDeploy deployment configurations for ECS Blue/Green deployments control how traffic is shifted from the old task set to the new task set, allowing canary testing with built-in validation periods.
Soru 320Soru →

A developer deployed an Amazon EC2 instance and an associated security group using an AWS CloudFormation stack. Later, a network administrator manually added an inbound rule allowing TCP port 3389 (RDP) directly via the Amazon VPC Console to troubleshoot a connection issue. The developer runs drift detection on the stack and confirms that the security group is in a drifted state. The developer wants to restore the security group to the exact configuration defined in the CloudFormation template. Which of the following is the correct method to resolve this drift?

Cevabı ve açıklamayı göster

Cevap: Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Cevap

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.
Manually removing the out-of-band RDP rule is the correct way to resolve the drift. When a resource is modified out-of-band, CloudFormation drift detection flags the difference but does not automatically remediate it. To resolve the drift without changing the template, the resource must be manually modified to align back with the template definition.

Adım Adım Çözüm

1
Analyze the source of the configuration drift.
Identify that the security group has an extra inbound RDP rule added manually.
To determine how the live resource differs from the CloudFormation template definition.
2
Evaluate whether a standard stack update using the original template can remediate the drift.
Determine that running an update with the same template does not overwrite manual changes because CloudFormation checks template differences, not live resource differences.
To rule out stack updates as an automatic remediation tool for unmodified templates.
3
Manually remove the unauthorized inbound RDP rule.
The security group configuration matches the CloudFormation template, resolving the drift.
To successfully restore the stack's resources to their expected template-defined state.

Anahtar Kavram

AWS CloudFormation Drift Detection and Remediation
ÖncekiSayfa 16 / 19Sonraki
Deployment Alıştırma Soruları — AWS Certified Developer - Associate — Sayfa 16 | Examkin