Examkin

Deployment

376 soru

Tüm türler376Çoktan seçmeli191Çoklu seçim171Sıralama14
Soru 341Soru →

A developer is configuring an AWS Serverless Application Model (SAM) template for a microservice. The microservice includes an `AWS::Serverless::Function` that requires access to a database password. The password must be rotated automatically every 30 days to comply with corporate security standards.

Which approach should the developer use to securely provide the database password to the function through the SAM template?

Cevabı ve açıklamayı göster

Cevap: Reference the password in the function's environment variables using an AWS Secrets Manager dynamic reference.

Cevap

Reference the password in the function's environment variables using an AWS Secrets Manager dynamic reference.
The correct approach is to reference the password using an AWS Secrets Manager dynamic reference. AWS Secrets Manager is designed to store sensitive data such as database credentials and supports automated rotation out of the box. By using a dynamic reference in the environment variables of the function, the SAM deployment safely retrieves the value during stack operations.

Adım Adım Çözüm

1
Identify the rotation requirement for the credential.
Since the password must be rotated every 30 days, AWS Secrets Manager is the correct destination because it offers native, automated secret rotation, whereas Systems Manager Parameter Store does not.
Choosing the correct credential store satisfies the rotation compliance rule.
2
Identify how to retrieve the credential in the template.
Utilize a dynamic reference `{{resolve:secretsmanager:secret-id}}` inside the environment variable declaration of the AWS::Serverless::Function resource.
This allows the template to fetch the current value of the secret at runtime or deployment without hardcoding it.
3
Verify template compilation requirements.
Retain the root-level `Transform: AWS::Serverless-2016-10-31` header so that the AWS SAM template is transformed into standard CloudFormation resources successfully.
Omitting the Transform header causes CloudFormation to reject serverless resources like AWS::Serverless::Function.

Anahtar Kavram

AWS SAM integration with AWS Secrets Manager dynamic references for automated credential management.
Tahmini Süre:1m 30s
Soru 342Soru →

A developer is releasing an update to a production REST API managed by Amazon API Gateway. The update includes changes to both the API Gateway resource structure and the backend integrations. To minimize risk, the developer wants to route 15%15\% of the API traffic to the new version while the remaining 85%85\% is handled by the stable production version. The strategy must support immediate rollback to the stable version without modifying client configurations or deploying new API stages. Which approach should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a canary release on the existing API Gateway deployment stage and set the canary traffic percentage to 15%15\%.

Cevap

Configure a canary release on the existing API Gateway deployment stage and set the canary traffic percentage to 15%15\%.
Configuring a canary release on the existing API Gateway stage is the only option that keeps the endpoint URL unchanged for clients, avoids creating new stages, and allows immediate rollback by deleting the canary release.

Adım Adım Çözüm

1
Analyze the deployment constraints: 15%15\% traffic routing, 85%85\% remaining on stable, immediate rollback capability, no client configuration changes, and no creation of new API stages.
Identify that the deployment must take place within the existing API Gateway stage and support built-in traffic shifting.
Creating new stages or changing DNS/client endpoints is prohibited by the scenario requirements.
2
Evaluate the capabilities of Amazon API Gateway deployment stages.
Determine that API Gateway supports configuring a Canary release directly on a stage, allowing a designated percentage of traffic (e.g., 15%15\%) to be sent to a new deployment.
This configuration keeps the stage endpoint URL identical for clients and allows immediate promotion or deletion of the canary to rollback.
3
Compare the correct API Gateway canary configuration with other alternatives.
Confirm that Route 53, CodeDeploy, and Application Load Balancer solutions either require new stages or are not supported natively for shifting API Gateway stage configuration traffic.
Eliminating options that violate the no-new-stage constraint ensures the selection of the correct option.

Anahtar Kavram

API Gateway Canary Deployments
Soru 343Soru →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set before production traffic is shifted. The validation tests require retrieving a database password that must be rotated automatically every 30 days. Additionally, the developer must configure the IAM trust policy for the CodeDeploy service role to allow the service to perform the deployment.

Which configuration should the developer implement?

Cevabı ve açıklamayı göster

Cevap: Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.

Cevap

Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file, store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.
The correct configuration uses the `AfterInstall` lifecycle hook in the `appspec.yaml` file, which is valid for ECS blue/green deployments to run validation tests on the replacement task set before traffic routing. It stores the database password in AWS Secrets Manager because Secrets Manager natively supports automatic rotation of secrets. Lastly, the CodeDeploy service role trust policy must allow `codedeploy.amazonaws.com` to assume the role so CodeDeploy can perform the deployment tasks.

Adım Adım Çözüm

1
Determine the appropriate lifecycle hook for running validation tests on Amazon ECS in AWS CodeDeploy.
The `AfterInstall` hook is selected.
In ECS blue/green deployments, CodeDeploy supports specific hooks such as `AfterInstall` and `AfterAllowTestTraffic` to run validation Lambda functions. Hooks like `ValidateService` are EC2-specific and not supported on ECS.
2
Evaluate the requirement for rotating a database password automatically.
AWS Secrets Manager is chosen.
AWS Secrets Manager natively supports automatic rotation of secrets (e.g., every 30 days) using built-in or custom Lambda functions. AWS Systems Manager Parameter Store does not support native automatic rotation.
3
Determine the service principal for the CodeDeploy service role trust policy.
Configure `codedeploy.amazonaws.com` as the trusted entity.
The service performing the deployment (AWS CodeDeploy) needs permission to assume the role. The principal `ecs-tasks.amazonaws.com` is used for ECS tasks to gain permissions to AWS resources, not for the CodeDeploy deployment service itself.

Anahtar Kavram

Understanding the differences between Amazon ECS and EC2 CodeDeploy lifecycle hooks, choosing appropriate AWS storage options for rotated secrets, and configuring proper IAM service trust policies.
Soru 344Soru →

A developer is creating a serverless application using AWS SAM. The application contains an Amazon SQS queue and an AWS::Serverless::Function that needs to process messages from the queue. The function must have the minimum necessary permissions to poll messages from the SQS queue and delete them after processing. Which two configurations in the AWS SAM template are required to set up this event source and its permissions?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an event source under the function's Events property with the Type set to SQS and the Queue property referencing the SQS queue ARN.; Include the SQSPollerPolicy policy template under the function's Policies property, specifying the SQS queue name.

Cevap

The correct configurations are: (1) Configure an event source under the function's Events property with the Type set to SQS and the Queue property referencing the SQS queue ARN; (2) Include the SQSPollerPolicy policy template under the function's Policies property, specifying the SQS queue's name.
To integrate an SQS queue with an AWS SAM Lambda function, you need two primary configurations: defining the event source and granting the necessary permissions. Specifying the SQS event source under the Events property ensures the AWS Lambda service invokes the function upon message arrival. Referencing the SQSPollerPolicy template under the Policies property is the standard, secure way to assign the Lambda execution role the exact permissions required to pull and process the queue messages.

Adım Adım Çözüm

1
Define the event trigger mapping.
Create an event mapping of type SQS pointing to the queue's ARN under the function's Events property.
This establishes the relationship that enables AWS Lambda to poll the SQS queue automatically.
2
Configure the security execution permissions using SAM policy templates.
Add SQSPollerPolicy under the function's Policies property.
This automatically creates the minimum required IAM permissions for the Lambda function to invoke SQS operations (ReceiveMessage, DeleteMessage, GetQueueAttributes) on the specified queue.

Anahtar Kavram

AWS SAM Event Sources and Policy Templates
Soru 345Soru →

A developer is configuring an in-place deployment using AWS CodeDeploy for an application running on a fleet of 88 Amazon EC2 instances behind an Application Load Balancer. The application must maintain at least 75%75\% of its serving capacity throughout the deployment process. Which TWO of the following CodeDeploy deployment configurations can the developer use to meet this requirement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the predefined CodeDeployDefault.OneAtATime deployment configuration.; Create a custom deployment configuration with the minimum healthy hosts set to a percentage of 75%75\%.

Cevap

To maintain at least 75%75\% capacity of the 88-instance fleet during deployment, the developer can either use the predefined OneAtATime configuration or create a custom configuration with the minimum healthy hosts set to 75%75\%.
To maintain at least 75%75\% capacity of an 88-instance fleet, CodeDeploy must keep at least 66 instances healthy at all times (8×0.75=68 \times 0.75 = 6). The predefined configuration that deploys to one instance at a time ensures that 77 out of 88 instances (87.5%87.5\%) remain healthy during the deployment, which satisfies the 75%75\% threshold. Alternatively, creating a custom deployment configuration with the minimum healthy hosts explicitly set to a percentage of 75%75\% directly guarantees that at least 66 instances remain online and healthy.

Adım Adım Çözüm

1
Calculate the minimum number of healthy instances required during deployment.
88 instances ×0.75=6\times 0.75 = 6 healthy instances.
The scenario requires maintaining at least 75%75\% capacity of the fleet.
2
Evaluate the predefined CodeDeploy deployment configurations against the calculated minimum capacity.
The predefined OneAtATime configuration leaves 77 instances healthy (87.5%87.5\%), which is greater than or equal to 75%75\%. The HalfAtATime configuration leaves 44 instances healthy (50%50\%), and AllAtOnce leaves 00 healthy (0%0\%). Both are less than 75%75\% and are therefore incorrect.
To identify which predefined configuration satisfies the capacity constraint.
3
Evaluate custom deployment configurations to enforce the threshold.
A custom deployment configuration with minimum healthy hosts set to 75%75\% directly guarantees 66 healthy instances remain online, whereas a minimum healthy host configuration set to 25%25\% allows capacity to drop to 22 instances, failing the requirement.
To select the correct custom configuration option.

Anahtar Kavram

CodeDeploy Deployment Configurations
Soru 346Soru →

A cloud engineer is deploying a serverless microservice using an AWS Serverless Application Model (SAM) template. During the deployment process, the AWS CloudFormation engine returns an error stating that the resource type `AWS::Serverless::Function` is not supported or is invalid.

The template contains the following configuration:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
GetProductFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
GetProductApi:
Type: Api
Properties:
Path: /products/{id}
Method: get

Which of the following configuration adjustments will resolve this deployment error?

Cevabı ve açıklamayı göster

Cevap: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.

Cevap

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.
Adding the `Transform` declaration at the root level of the template allows AWS CloudFormation to process the SAM template. The template is converted into standard CloudFormation resources, resolving the error where `AWS::Serverless::Function` is unrecognized.

Adım Adım Çözüm

1
Analyze the error message returned by CloudFormation.
The parser fails because it does not recognize the custom resource type `AWS::Serverless::Function`.
CloudFormation by default only supports standard AWS resource types unless a transform macro is declared.
2
Identify the missing requirement for AWS SAM templates.
The template is missing the mandatory `Transform` header.
The Transform header specifies the macro that AWS CloudFormation uses to translate the SAM template into a compliant CloudFormation template.
3
Insert the Transform statement at the root level.
The template now contains `Transform: AWS::Serverless-2016-10-31`.
This allows CloudFormation to resolve SAM shorthand syntax like `AWS::Serverless::Function` into standard AWS Lambda and IAM resources.

Anahtar Kavram

AWS Serverless Application Model (SAM) template transformation
Tahmini Süre:1m 15s
Soru 347Soru →

A developer is configuring a blue/green deployment for an Amazon ECS application using AWS CodeDeploy. The deployment must execute validation tests on the green task set after it starts but before production traffic is directed to it. In addition, the developer must ensure that AWS CodeDeploy has the correct permissions to perform the deployment. Which two configurations must the developer implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the AppSpec file, specify an AWS Lambda function under the AfterAllowTestTraffic lifecycle hook to perform validation tests on the green task set.; Configure the AWS IAM service role for CodeDeploy with a trust policy that allows the service principal codedeploy.amazonaws.com to assume the role.

Cevap

To configure validation testing and permissions for an ECS blue/green deployment, the developer must specify an AWS Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role.
For validation testing on Amazon ECS, the AppSpec file must define an AWS Lambda function under the AfterAllowTestTraffic hook, allowing testing on the green task set before production traffic is routed. Furthermore, CodeDeploy needs a service role with a trust policy that designates the codedeploy.amazonaws.com service principal as an allowed entity to assume the role.

Adım Adım Çözüm

1
Determine the correct CodeDeploy AppSpec hook for validation testing before shifting production traffic in ECS.
Identify the AfterAllowTestTraffic lifecycle hook.
This hook executes after traffic is directed to the test port on the green task set, allowing validation tests to run prior to the production traffic shift.
2
Select the correct executor type for ECS AppSpec lifecycle hooks.
Use an AWS Lambda function for the lifecycle hook.
Unlike EC2 deployments, CodeDeploy hook executions for ECS and Lambda deployments only support invoking an AWS Lambda function, not executing custom shell scripts.
3
Configure the IAM trust policy for the CodeDeploy service role.
Add codedeploy.amazonaws.com as the principal in the AssumeRole policy statement.
This allows CodeDeploy to assume the service role and make API calls to update the ECS service and shift traffic on behalf of the developer.

Anahtar Kavram

AWS CodeDeploy AppSpec lifecycle hooks for ECS and the trust policy required for the CodeDeploy service role.
Soru 348Soru →

An organization is deploying updates to a high-traffic web application hosted on AWS Elastic Beanstalk. The application is highly sensitive to performance issues, so the deployment process must maintain 100%100\% of the current instance capacity at all times. Additionally, if the new version fails health checks, the deployment must support an immediate rollback that does not alter or disrupt the active instances in the original environment. Which two Elastic Beanstalk deployment policies will meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Immutable; Traffic Splitting

Cevap

The Immutable and Traffic Splitting deployment policies should be selected.
The Immutable and Traffic Splitting policies both satisfy the constraints. The Immutable policy creates a temporary Auto Scaling group to launch the new version alongside the original one. Once health checks pass, traffic is shifted. Traffic Splitting routes a configured percentage of traffic to a new temporary Auto Scaling group for evaluation. In both cases, the original instances remain untouched, maintaining 100%100\% capacity and enabling instant rollback by simply deleting the temporary resources.

Adım Adım Çözüm

1
Analyze capacity requirements.
The strategy must maintain 100%100\% capacity during deployment, which rules out All at once and Rolling strategies.
Maintaining full capacity requires launching new instances before terminating old ones.
2
Analyze rollback constraints.
The rollback must be immediate and must not alter or affect the running production instances if the update fails. This rules out Rolling with additional batch, which updates active instances and requires a slow rolling rollback.
To prevent disruption, the original instances must remain untouched until the new version is verified.
3
Select the matching Elastic Beanstalk policies.
Immutable and Traffic Splitting satisfy both constraints as they launch new instances in a temporary group and only transition traffic once verified.
Both policies keep the original instances completely intact during evaluation and allow instant cleanup/rollback upon failure.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their impact on environment capacity, duration, and rollback mechanisms.
Soru 349Soru →

A developer is configuring an in-place deployment to a fleet of Amazon EC2 instances registered with an Application Load Balancer using AWS CodeDeploy. The developer needs to run a local shell script named `verify_health.sh` to confirm that the application server is responding successfully on port 8080. This verification must execute after the application has started but before the instances are reregistered with the load balancer to receive production traffic. Which lifecycle hook in the `appspec.yml` file must the developer use to run this script?

Cevabı ve açıklamayı göster

Cevap: ValidateService

Cevap

ValidateService
The ValidateService lifecycle hook is the designated phase in EC2/On-Premises deployments to run verification scripts. It executes after the application has started (ApplicationStart) and before CodeDeploy reregisters the instances with the Application Load Balancer target group. A successful script exit code allows the deployment to proceed, while a non-zero exit code triggers an automatic rollback.

Adım Adım Çözüm

1
Identify the compute platform and deployment style.
Compute platform is Amazon EC2, and the deployment is an in-place update with a load balancer.
Different compute platforms (EC2 vs. ECS/Lambda) support different sets of AppSpec lifecycle hooks.
2
Determine which hooks support running user-defined scripts on EC2 instances.
Only specific hooks like BeforeInstall, AfterInstall, ApplicationStart, and ValidateService support script execution on EC2.
Load balancer hooks such as BeforeAllowTraffic are managed by CodeDeploy to update target group registration and cannot run user-defined scripts in the AppSpec file.
3
Order the lifecycle hooks to locate the correct phase after application startup but before traffic registration.
The ApplicationStart hook starts the service, followed by ValidateService to run health checks. Only after ValidateService passes does CodeDeploy proceed to BeforeAllowTraffic/AllowTraffic.
This guarantees that unhealthy instances are caught and the deployment is rolled back before they are exposed to production traffic.

Anahtar Kavram

AWS CodeDeploy AppSpec lifecycle hook execution order and capability differences between EC2/On-Premises and ECS/Lambda compute platforms.
Soru 350Soru →

A developer is configuring an AWS CodeDeploy Blue/Green deployment for a critical web application. The application runs on Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer. The deployment must satisfy the following constraints:

- If any issues are detected after shifting traffic to the new (Green) fleet, the application must be rolled back to the original (Blue) fleet within a 11-hour window.
- The rollback must be nearly instantaneous, avoiding the time required to provision new EC2 instances or initialize the application.
- To control costs, all resources from the original fleet must be automatically terminated after the 11-hour window if no issues are detected.

Which configuration settings in the CodeDeploy deployment group will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the deployment group to redirect traffic immediately, set the action on the original instances to keep them running, and specify a rerun transition wait time of 11 hour before termination.

Cevap

Configure the deployment group to redirect traffic immediately, set the action on the original instances to keep them running, and specify a rerun transition wait time of 11 hour before termination.
The correct configuration is to configure the deployment group to redirect traffic immediately, keep the original instances running, and specify a wait time of 11 hour. In a CodeDeploy Blue/Green deployment, keeping the original (Blue) instances running inside the original Auto Scaling group allows CodeDeploy to perform a near-instantaneous rollback if an issue is detected. If the validation timer of 11 hour expires without any rollback being triggered, CodeDeploy automatically terminates the original instances and Auto Scaling group, ensuring that costs are controlled.

Adım Adım Çözüm

1
Analyze the rollback requirement.
Since the rollback must be nearly instantaneous, the original (Blue) instances must remain running and active in their target group during the testing period.
If the instances are terminated, rolling back requires provisioning new EC2 instances, which takes several minutes and violates the time constraint.
2
Analyze the cost optimization requirement.
The original instances should not run indefinitely; they must be automatically terminated after the validation window.
This is achieved by specifying a wait time (e.g., 11 hour) in CodeDeploy's deployment configuration settings for original instances.
3
Select the correct CodeDeploy configuration option.
Configure CodeDeploy to redirect traffic immediately, keep the original fleet running, and set the wait time to 11 hour.
This satisfies all constraints by preserving the instances for fast rollback while ensuring automatic cleanup after 11 hour.

Anahtar Kavram

AWS CodeDeploy Blue/Green Deployment Instance Termination Lifecycle
Soru 351Soru →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. During the deployment process, the deployment fails with an access denied error because CodeDeploy is unable to modify the Application Load Balancer listeners and target groups. The developer verifies that the CodeDeploy service role has the AWSCodeDeployRoleForECS managed policy attached. Which configuration must the developer verify or update to resolve this deployment failure?

Cevabı ve açıklamayı göster

Cevap: The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.

Cevap

The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.
The trust policy of an IAM role defines which principal (such as an AWS service or another account) is allowed to assume the role. For AWS CodeDeploy to perform deployment actions on behalf of the developer (such as updating ECS target groups), its service role's trust policy must trust the CodeDeploy service principal (codedeploy.amazonaws.com) and allow the sts:AssumeRole action. If this trust policy is missing or misconfigured, CodeDeploy cannot assume the role, resulting in an access denied error even if the role has the correct permissions attached.

Adım Adım Çözüm

1
Analyze the deployment error and identify that CodeDeploy failed to assume the service role despite the correct permissions policy being attached.
Recognize that the failure is related to IAM role delegation/trust rather than the permissions policy contents.
CodeDeploy must be trusted by the service role before it can assume it to perform deployment tasks on ECS resources.
2
Locate the CodeDeploy service role in the IAM console and inspect its trust relationships (trust policy).
Determine that the trust policy must explicitly allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
Without this trust policy, AWS Security Token Service (STS) will deny the assume role request, causing CodeDeploy to fail with an access denied error.

Anahtar Kavram

AWS CodeDeploy Service Role Trust Policy
Tahmini Süre:1m 30s
Soru 352Soru →

A developer is using AWS SAM to deploy a serverless application. The template file (`template.yaml`) contains the following definition:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
ProcessDataFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
GetRequest:
Type: Api
Properties:
Path: /data
Method: get

When the developer attempts to deploy the application, the deployment fails with errors indicating unrecognized resource types and invalid code locations.

Which two actions must the developer take to resolve these issues and successfully deploy the application? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.; Run the `sam deploy` command to package the local code, upload the zip archive to Amazon S3, and deploy the stack.

Cevap

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template, and run the `sam deploy` command to package the local code, upload the zip archive to Amazon S3, and deploy the stack.
To successfully deploy the application, the developer must first add the `Transform: AWS::Serverless-2016-10-31` statement to the template. This enables the CloudFormation service to parse and translate SAM resources. Second, because the template references a local path for the function's code (`CodeUri: ./src`), the developer must package the code and upload it to Amazon S3. The `sam deploy` command automatically handles both the packaging of local artifacts to S3 and the deployment of the generated template.

Adım Adım Çözüm

1
Analyze the validation errors in the CloudFormation deployment trace.
Identify that CloudFormation fails to recognize `AWS::Serverless::Function` and cannot resolve the local path `./src` for code execution.
This helps target the missing template-level processor definition and the untranslated local reference.
2
Add the required SAM transform statement to the template root.
The template now contains the `Transform: AWS::Serverless-2016-10-31` header, allowing the CloudFormation engine to translate SAM-specific resources into standard resources.
This is a mandatory declaration for any AWS SAM template.
3
Use the SAM CLI commands to upload local assets and deploy the resources.
Run `sam deploy`, which compiles, zips, and uploads the local folder to S3, replaces `CodeUri` with the S3 URI, and initiates the CloudFormation deployment.
CloudFormation does not natively support local directory uploads, so packaging via SAM is required.

Anahtar Kavram

AWS SAM template structure and deployment workflow using CLI tools
Soru 353Soru →

A developer is configuring a canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment must run a test Lambda function to validate the deployment before shifting traffic, and another test Lambda function to run post-deployment validation checks after all traffic has been shifted to the new version. Which two configuration steps must the developer perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file.; Attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions, and ensure its trust policy allows the codedeploy.amazonaws.com service principal.

Cevap

Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file, and attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions while ensuring its trust policy allows the codedeploy.amazonaws.com service principal.
The correct options properly configure the deployment lifecycle hooks for AWS Lambda (BeforeAllowTraffic and AfterAllowTraffic) in the AppSpec file and grant the required invoke permissions to the CodeDeploy service role.

Adım Adım Çözüm

1
Identify the target compute platform and the required hooks.
The target is AWS Lambda. The appropriate lifecycle hooks for running validation tests before traffic shifting starts and after it completes are BeforeAllowTraffic and AfterAllowTraffic.
Choosing the correct lifecycle hooks ensures CodeDeploy triggers the validation tests at the correct points in the deployment process.
2
Configure the CodeDeploy service role permissions.
Ensure the CodeDeploy service role has a trust relationship with codedeploy.amazonaws.com and contains permissions for lambda:InvokeFunction targeting the test Lambda functions.
CodeDeploy must be authorized to assume its role and invoke the external Lambda functions designated as validation hooks.

Anahtar Kavram

AWS CodeDeploy lifecycle hooks for Lambda deployments and their associated IAM permissions.
Soru 354Soru →

A developer is configuring a CI/CD pipeline for a microservice deployed on Amazon ECS. The company requires a deployment strategy that minimizes the blast radius by shifting traffic to the new version of the application in multiple stages (either in a single initial test phase followed by a complete cutover, or in periodic increments). The deployment must also support automatic rollbacks if any CloudWatch alarms are triggered. Which two AWS CodeDeploy predefined deployment configurations can the developer use to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.ECSCanary10Percent5Minutes; CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Cevap

CodeDeployDefault.ECSCanary10Percent5Minutes and CodeDeployDefault.ECSLinear10PercentEvery1Minutes
The configurations CodeDeployDefault.ECSCanary10Percent5Minutes and CodeDeployDefault.ECSLinear10PercentEvery1Minutes are correct because they are predefined deployment configurations for Amazon ECS. The Canary configuration routes 10% of traffic to the green task set and waits 5 minutes before routing the rest, while the Linear configuration shifts traffic in equal increments of 10% every minute. Both meet the requirement of gradual traffic shifting and support automatic rollback via CloudWatch alarms.

Adım Adım Çözüm

1
Filter deployment configurations by targeted service.
Identify that the target service is Amazon ECS, which eliminates Lambda-specific configurations.
AWS CodeDeploy separates predefined configurations for ECS, Lambda, and EC2/On-Premises; attempting to cross-assign them results in errors.
2
Evaluate the traffic routing requirement.
Identify configurations that support gradual traffic shifting (Canary or Linear) rather than an immediate cutover.
The requirement asks for shifting traffic in multiple stages or periodic increments to minimize blast radius.
3
Select matching predefined configurations.
Choose the configurations matching ECS canary and linear strategies.
Both configurations allow testing with a subset of traffic before full cutover and support automatic rollback via CloudWatch alarms.

Anahtar Kavram

AWS CodeDeploy deployment configurations for Amazon ECS support Canary and Linear traffic shifting to control blast radius and facilitate automatic rollbacks.
Tahmini Süre:1m 30s
Soru 355Soru →

A developer is planning to deploy a new version of an application on AWS Elastic Beanstalk. The application is currently running in a single production environment containing 44 Amazon EC2 instances behind an Application Load Balancer. The deployment must meet the following constraints:
- The environment must maintain 100%100\% of its processing capacity (44 active instances) during the deployment process.
- To control cost, the developer must not create a separate, duplicate Elastic Beanstalk environment or perform a DNS swap.
- The rollback process must be fully automated in the event that the new version fails application health checks.

Which Elastic Beanstalk deployment policy should the developer select?

Cevabı ve açıklamayı göster

Cevap: Immutable

Cevap

The Immutable deployment policy should be selected because it maintains 100%100\% capacity by deploying the new version to a temporary Auto Scaling group, automatically rolls back if health checks fail, and operates within a single Elastic Beanstalk environment.
The Immutable deployment policy satisfies all constraints. It maintains 100%100\% capacity by launching a temporary Auto Scaling group with the new version alongside the original instances. If the new version fails health checks, Elastic Beanstalk automatically deletes the temporary Auto Scaling group, rolling back the deployment. Additionally, it avoids the overhead of managing a separate Elastic Beanstalk environment.

Adım Adım Çözüm

1
Analyze the capacity requirement during deployment.
The environment must maintain 100%100\% of its processing capacity (44 active instances) at all times.
This rules out the standard Rolling deployment policy, which takes some instances offline to update them, reducing active capacity.
2
Analyze the rollback requirement.
The deployment must automatically roll back to the previous version without manual intervention if health checks fail.
This rules out Rolling with additional batch, which requires a manual rollback deployment if the new version is unhealthy.
3
Analyze the environment management and cost constraint.
The developer must avoid creating a separate environment or performing a DNS swap.
This rules out the Blue/Green environment swap strategy, leaving the Immutable policy as the only one satisfying all constraints.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their trade-offs regarding capacity, rollback behavior, and environment overhead.
Soru 356Soru →

A developer is configuring a deployment group in AWS CodeDeploy to deploy an application to a fleet of Amazon EC2 instances. The developer creates a new IAM role to serve as the service role for the deployment group. However, when the deployment is initiated, it fails immediately with a service role authorization error before any lifecycle event scripts in the appspec.yml file are executed. Which configuration issue is the most likely cause of this failure?

Cevabı ve açıklamayı göster

Cevap: The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.

Cevap

The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.
The correct option is correct because AWS CodeDeploy needs to assume the specified service role to perform operations such as registering instances, updating Auto Scaling groups, and interacting with load balancers. This trust is established via the trust policy of the role, which must explicitly allow the 'codedeploy.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. If this trust policy is missing or incorrect, the CodeDeploy service cannot assume the role, and the deployment fails immediately with an authorization error.

Adım Adım Çözüm

1
Analyze the timing and nature of the error, noting that the deployment fails immediately with a 'service role authorization error' before CodeDeploy attempts to connect to the target instances or run any lifecycle scripts.
This indicates that the issue lies with the permissions of the CodeDeploy service itself to act on the user's behalf, rather than an agent or configuration file issue on the EC2 instances.
Before any deployment actions can be orchestrated, the AWS CodeDeploy service must successfully assume the service role associated with the deployment group.
2
Examine the role requirements for AWS CodeDeploy to perform deployment actions on AWS resources.
CodeDeploy requires an IAM service role with a trust policy allowing the 'codedeploy.amazonaws.com' service principal to perform 'sts:AssumeRole'.
Without this trust policy, the AWS Security Token Service (STS) will reject CodeDeploy's request to assume the role, preventing the deployment from starting.
3
Differentiate between the CodeDeploy service role and the EC2 instance profile role, and rule out other configuration issues.
The EC2 instance profile role is assumed by the EC2 service to allow the agent to read from S3. The AppSpec file hooks and parameter configurations are parsed much later by the agent, so failures there would not occur immediately at the start of the deployment.
This confirms that the missing trust relationship on the CodeDeploy service role is the root cause of the immediate service role authorization failure.

Anahtar Kavram

AWS CodeDeploy IAM service role and trust relationship requirements
Soru 357Soru →

A developer uses AWS SAM to deploy a serverless application. The template defines an `AWS::Serverless::Function` triggered by an API Gateway HTTP API event source, and a custom `AWS::IAM::Role` for the execution role. The deployment completes successfully. However, when the API is invoked, the client receives a `502502 Bad Gateway` error. The CloudWatch logs show that the Lambda service is unable to assume the configured execution role, and the function is not executed.

Here is a portion of the template:

yaml
Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: src/
Handler: index.handler
Runtime: nodejs18.x
Role: !GetAtt ExecutionRole.Arn
Events:
CreateOrder:
Type: Api
Properties:
Path: /orders
Method: post

ExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: apigateway.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: WriteLogs
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:PutLogEvents
Resource: '*'

The handler code in `src/index.js` is defined as:

javascript
exports.handler = async (event) => {
return "Order successfully processed!";
};

Which TWO modifications are required to resolve both the execution role assumption issue and the `502502 Bad Gateway` error? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Change the service principal in the AssumeRolePolicyDocument of ExecutionRole to lambda.amazonaws.com; Modify the handler code in src/index.js to return a JSON object containing statusCode and body keys

Cevap

To resolve these errors, change the execution role's trust policy service principal to lambda.amazonaws.com, and update the Lambda function handler to return a structured JSON object containing statusCode and body properties.
The trust policy must authorize the AWS Lambda service principal (lambda.amazonaws.com) to assume the role. The default Lambda Proxy Integration requires the response payload to be formatted with statusCode and body keys; otherwise, API Gateway returns a 502 Bad Gateway error.

Adım Adım Çözüm

1
Analyze the IAM trust configuration for ExecutionRole in the template.
The principal service is set to apigateway.amazonaws.com, which grants API Gateway trust to assume the role instead of granting it to the Lambda execution service.
AWS Lambda must be explicitly trusted in the role's AssumeRolePolicyDocument to run the function code.
2
Analyze the API response model requirements for SAM Api events.
The Api event source implicitly sets up a Lambda Proxy Integration, which requires the handler to return a JSON object with statusCode and body properties.
Returning a raw string causes API Gateway to fail parsing the response, leading to a HTTP 502 Bad Gateway response.
3
Update the IAM service principal to lambda.amazonaws.com and refactor the handler return statement.
The execution role can now be assumed by Lambda, and the handler output conforms to the required proxy integration format.
These changes address both the execution permissions and the API response structure validation rules.

Anahtar Kavram

AWS SAM Integration Mechanics and IAM Service Trust Principles
Tahmini Süre:1m 30s
Soru 358Soru →

A developer needs to deploy a new version of a critical web application. The deployment must satisfy the following constraints:
- The application must maintain 100%100\% of its serving capacity throughout the deployment.
- The deployment must have zero downtime.
- The deployment must not modify the existing production instances until the new version is fully verified.
- Rollbacks must be fast and have minimal impact on the active production environment if the new version fails verification.

Which two deployment strategies will satisfy these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Blue/Green deployment; Immutable deployment

Cevap

The correct strategies are Blue/Green deployment and Immutable deployment.
The correct strategies are Blue/Green deployment and Immutable deployment. Both strategies deploy the new version of the application to new resources that are separate from the active production environment. This ensures that the active environment is not modified during the deployment, 100%100\% capacity is maintained using the old version, and rollbacks are fast and simple (either by swapping DNS/traffic back or by terminating the temporary instances) if the verification fails.

Adım Adım Çözüm

1
Analyze the capacity requirement
Strategies like Rolling or All-at-once, which temporarily take existing instances out of service, are eliminated because they reduce capacity below 100%100\%.
The requirement states that 100%100\% capacity must be maintained at all times.
2
Analyze the requirement to not modify existing instances until verified
Strategies like Rolling with additional batch are eliminated because they perform in-place updates on existing production instances during the rollout.
The system must keep the existing production environment untouched during the verification phase of the new version.
3
Evaluate Blue/Green and Immutable strategies
Both Blue/Green and Immutable deployments provision new resources separately from the active production fleet, keep the active environment intact until fully verified, support zero downtime, and can roll back instantly by redirecting traffic or terminating the new temporary resource group.
These strategies align perfectly with the need for zero downtime, full capacity, isolated verification, and rapid rollback.

Anahtar Kavram

Deployment strategies vary in how they handle capacity, resource overhead, in-place modifications, and rollback speed. Blue/Green and Immutable deployments prevent modification of existing production resources during validation, while Rolling and All-at-once modify them in-place.
Tahmini Süre:2m 0s
Soru 359Soru →

An organization is transitioning their microservices to Amazon ECS and plans to use AWS CodeDeploy for automated blue/green deployments. To ensure zero downtime, the deployment workflow must execute validation tests against the replacement task set on a secondary port before shifting any production traffic. Furthermore, AWS CodeDeploy must be authorized to interact with the ECS cluster and load balancer during the deployment execution.

Which TWO configuration actions should the developer perform to support this deployment flow?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define the validation test under the AfterAllowTestTraffic lifecycle hook in the AppSpec file to trigger a validation AWS Lambda function.; Configure a trust policy on the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Cevap

To support this deployment flow, the developer must configure the validation tests under the AfterAllowTestTraffic lifecycle hook in the AppSpec file to trigger a validation AWS Lambda function, and configure a trust policy on the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
To run validation tests on a test listener before production traffic shifts, the AfterAllowTestTraffic hook must be used to trigger a validation Lambda function. Additionally, CodeDeploy requires a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role via sts:AssumeRole so it has the permissions to execute the deployment.

Adım Adım Çözüm

1
Determine the deployment platform and validation timing requirement.
The target platform is Amazon ECS, and validation must occur on a test port before production traffic shifts.
This determines which AppSpec hooks and execution environments are valid.
2
Select the correct AppSpec hook and execution format for ECS.
The AfterAllowTestTraffic hook must be configured with a Lambda function reference. Script execution is not supported for ECS.
Only Lambda hooks are supported for ECS, and AfterAllowTestTraffic runs after the test listener routes traffic but before the production listener shifts.
3
Identify the service authorization mechanism.
CodeDeploy itself needs permissions, which requires a CodeDeploy service role with a trust policy for codedeploy.amazonaws.com.
This enables CodeDeploy to call ECS and Elastic Load Balancing APIs to execute the deployment.

Anahtar Kavram

AWS CodeDeploy ECS Deployment Validation and IAM Authorization
Soru 360Soru →

An organization hosts a web application on an AWS Elastic Beanstalk environment. The operations team needs to deploy a minor software update. Due to strict AWS account limits, the environment cannot launch any additional Amazon EC2 instances during the deployment. The application must remain online and accessible to users, but it can tolerate running at a minimum of 50%50\% of its total instance capacity during the deployment. Which Elastic Beanstalk deployment policy should the developer configure to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Rolling

Cevap

Rolling
The Rolling deployment strategy updates the application in batches on the existing instances. This ensures that no new EC2 instances are provisioned during the process, adhering to the strict service limits. Because it updates one batch at a time, the application remains online, satisfying the availability requirement while running at the tolerated reduced capacity.

Adım Adım Çözüm

1
Evaluate the capacity constraints and compute the allowed additional resources.
Zero new Amazon EC2 instances can be launched due to strict AWS account limits.
This rules out deployment strategies that require provisioning new instances, such as Immutable or Rolling with additional batch.
2
Analyze the availability requirement for the web application.
The application must remain online and accessible to users.
This rules out the All at once deployment strategy, which takes all instances out of service simultaneously.
3
Evaluate the remaining candidate strategies against the performance threshold.
The Rolling policy is selected because it updates instances in batches without creating new instances, while maintaining application availability at a reduced capacity of at least 50%50\%.
Rolling updates satisfy the zero-new-instance limit and the online requirement by using existing instances in batches.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their resource/capacity trade-offs
Tahmini Süre:1m 30s
ÖncekiSayfa 18 / 19Sonraki
Deployment Alıştırma Soruları — AWS Certified Developer - Associate — Sayfa 18 | Examkin