Examkin

Deployment

376 soru

Tüm türler376Çoktan seçmeli191Çoklu seçim171Sıralama14
Soru 121Soru →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application code needs to read objects from an Amazon S3 bucket.

Which of the following IAM configurations is required to allow the application code to access the S3 bucket?

Cevabı ve açıklamayı göster

Cevap: Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.

Cevap

Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.
Configuring an IAM role with Amazon S3 read permissions and assigning it as the Task Role (taskRoleArn) in the ECS task definition is correct. The Task Role is designed to grant application code running inside the ECS container permissions to call AWS APIs.

Adım Adım Çözüm

1
Identify which role is responsible for providing IAM permissions to application code running inside the container.
The Task Role (taskRoleArn) is identified as the role providing permissions directly to the application.
Differentiating between Task Role (application level) and Task Execution Role (ECS agent level) is critical for configuring correct permissions.
2
Formulate the IAM role policy for S3 access.
An IAM policy allowing S3 Read actions is created and attached to the Task Role.
This grants the application code the exact permissions needed to read objects from the S3 bucket.
3
Verify the trust policy of the IAM role.
The trust policy allows the ecs-tasks.amazonaws.com service principal to assume the role.
This ensures that Amazon ECS can successfully assign the role to the container at launch.

Anahtar Kavram

Distinction between ECS Task Role and Task Execution Role
Soru 122Soru →

A developer is configuring a deployment strategy for a multi-instance AWS Elastic Beanstalk environment. The deployment must satisfy the following constraints:

* The application must maintain 100% of its capacity at all times during the deployment.
* There must be zero downtime.
* The update must be deployed to the entire fleet without splitting production traffic or performing canary testing.

Which of the following Elastic Beanstalk deployment strategies will satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Immutable; Rolling with additional batch

Cevap

The Immutable and Rolling with additional batch deployment strategies are correct because they both maintain 100% capacity throughout the deployment and ensure zero downtime without splitting production traffic.
The Immutable strategy creates a full set of new instances in a separate Auto Scaling group, ensuring full capacity is maintained on the old group until cutover. The Rolling with additional batch strategy launches a temporary batch of new instances before starting the deployment to maintain 100% capacity during the rolling process. Neither strategy splits live production traffic for evaluation purposes.

Adım Adım Çözüm

1
Analyze the constraint of maintaining 100% capacity during deployment.
This eliminates the standard Rolling strategy (which reduces capacity during updates) and the All-at-once strategy (which causes downtime).
We must identify strategies that launch temporary additional instances to offset the ones being upgraded.
2
Analyze the constraint of zero downtime.
This confirms that All-at-once is incorrect as it takes all instances offline at the same time.
Downtime must be avoided completely.
3
Analyze the constraint of not splitting production traffic or performing canary testing.
This eliminates the Traffic splitting strategy, which is designed to route a small percentage of production traffic to the new version for verification.
Traffic splitting acts as a canary deployment and violates the requirement.

Anahtar Kavram

AWS Elastic Beanstalk deployment strategies and their capacity, downtime, and traffic-routing trade-offs.
Tahmini Süre:1m 0s
Soru 123Soru →

A developer is migrating a containerized web application from Amazon EC2 instances to Amazon ECS. The deployment process is managed by AWS CodeDeploy using a Blue/Green deployment configuration. Before production traffic is shifted to the replacement task set, the deployment must execute a database migration script. This script retrieves a database password that must be automatically rotated every 30 days.

The developer writes the following `appspec.yaml` file for the Amazon ECS service:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:111122223333:task-definition/my-app:1"
LoadBalancerInfo: ContainerName: "web"
ContainerPort: 80
Hooks:
- AfterInstall:
- location: "scripts/migrate.sh"
timeout: 600

Which set of actions must the developer perform to ensure the database migration runs successfully and complies with the rotation requirement?

Cevabı ve açıklamayı göster

Cevap: Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook in the `appspec.yaml` to reference the Lambda function's ARN. Store the database password in AWS Secrets Manager with automatic rotation enabled, and grant the Lambda function's execution role permissions to retrieve the secret.

Cevap

Package the database migration script into an AWS Lambda function, update the `AfterInstall` hook to reference its ARN, store the password in AWS Secrets Manager with automatic rotation, and allow the Lambda execution role to retrieve the secret.
The correct answer correctly identifies that Amazon ECS AppSpec files require lifecycle hooks to point to AWS Lambda functions rather than local shell scripts. It also correctly chooses AWS Secrets Manager over Systems Manager Parameter Store because Secrets Manager features native, built-in support for rotating credentials automatically.

Adım Adım Çözüm

1
Analyze the AppSpec file hooks syntax for Amazon ECS.
Identify that the `location` parameter and shell script execution are only supported for EC2/On-Premises deployments. ECS deployments require hooks to point directly to AWS Lambda functions.
To ensure CodeDeploy can execute the database migration hook on the ECS compute platform.
2
Evaluate the database password rotation requirement.
Determine that AWS Secrets Manager provides built-in, out-of-the-box automatic rotation for database secrets, whereas AWS Systems Manager Parameter Store does not support native rotation.
To meet the compliance requirement of rotating the database password every 30 days with minimal administrative overhead.
3
Configure the Lambda function's IAM permissions.
Create an IAM execution role for the Lambda function and attach a policy allowing the `secretsmanager:GetSecretValue` action.
To allow the migration Lambda function to securely retrieve the database credentials during execution.

Anahtar Kavram

AWS CodeDeploy AppSpec configuration for Amazon ECS and Secrets Management integration
Tahmini Süre:3m 0s
Soru 124Soru →

A developer is using an AWS CloudFormation template to deploy an application that includes an Amazon S3 bucket. The S3 bucket contains critical application logs that must be preserved. The developer wants to ensure that the S3 bucket is not deleted when the CloudFormation stack is deleted.

Which action should the developer take to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.

Cevap

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.
The DeletionPolicy attribute in AWS CloudFormation enables you to preserve or back up a resource when its stack is deleted. Setting this policy to Retain on the S3 bucket resource ensures the bucket remains active and intact in the AWS account even after the parent stack is deleted.

Adım Adım Çözüm

1
Identify the target resource (the Amazon S3 bucket) that needs to be preserved.
The target resource is defined in the CloudFormation template.
You must modify the resource's configuration directly in the template definition.
2
Add the DeletionPolicy attribute to the S3 bucket resource block.
The DeletionPolicy attribute is set to Retain.
The Retain policy instructs AWS CloudFormation to keep the resource without deleting it when the stack is deleted.
3
Deploy the updated CloudFormation template.
The stack is updated with the resource retention policy in place.
This ensures that subsequent stack deletion operations will preserve the S3 bucket.

Anahtar Kavram

AWS CloudFormation DeletionPolicy
Tahmini Süre:45s
Soru 125Soru →

A developer is managing a release pipeline in AWS CodePipeline that contains Source, Build, and Deploy stages. The developer wants to temporarily prevent new builds from automatically entering the Deploy stage while a production issue is being investigated, without stopping or deleting the pipeline. Which action should the developer take to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Disable the transition between the Build stage and the Deploy stage in CodePipeline.

Cevap

Disable the transition between the Build stage and the Deploy stage in CodePipeline.
Disabling the transition between stages in AWS CodePipeline prevents executions from moving from the upstream stage (Build) to the downstream stage (Deploy). This is the standard, built-in feature designed specifically for this purpose, allowing executions to compile and build while holding them before the deploy phase.

Adım Adım Çözüm

1
Identify the requirement to temporarily halt the flow of executions into a specific stage without disabling the upstream stages or deleting the pipeline.
Recognized that the pipeline transition between the Build and Deploy stages needs to be controlled.
This isolates the Deploy stage from new incoming changes while allowing build testing to continue.
2
Evaluate AWS CodePipeline features for controlling pipeline flow and execution transitions between stages.
Identified that disabling stage transitions is the built-in mechanism for this use case.
Stage transitions can be enabled or disabled dynamically without changing permissions or configuration store parameters.
3
Select the option to disable the transition between the Build stage and the Deploy stage, which cleanly pauses executions at the boundary.
Correctly determined the operational action to resolve the scenario.
This is the most efficient and native method provided by CodePipeline.

Anahtar Kavram

AWS CodePipeline Stage Transitions
Soru 126Soru →

A company is deploying a new version of a microservice on Amazon ECS (Fargate) behind an Application Load Balancer (ALB). The deployment uses AWS CodeDeploy to perform a blue/green deployment. The ALB is configured with two target groups: one for production traffic on port 80, and one for test traffic on port 8080.

The deployment must satisfy the following requirements:
1. Route 10%10\% of production traffic to the replacement task set (Green) initially, and then route the remaining 90%90\% after a 15-minute wait period.
2. Run automated validation tests against the replacement task set using the test traffic port (8080) before any production traffic is shifted.
3. Automatically roll back the deployment if the validation tests fail or if a CloudWatch alarm monitoring 5XX errors triggers during the 15-minute wait period.

Which configuration should the developer specify in the CodeDeploy deployment configuration and the AppSpec file to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Use CodeDeployDefault.ECSCanary10Percent15Minutes as the deployment configuration. In the AppSpec file, specify the validation test Lambda function under the AfterAllowTestTraffic hook.

Cevap

Use CodeDeployDefault.ECSCanary10Percent15Minutes as the deployment configuration and run the validation tests under the AfterAllowTestTraffic hook in the AppSpec file.
The configuration using CodeDeployDefault.ECSCanary10Percent15Minutes correctly implements the required traffic shifting (10% initially, wait 15 minutes, then shift the remaining 90%). In an ECS blue/green deployment, the AfterAllowTestTraffic hook is executed after the test listener begins routing traffic to the green task set, making it the correct place to run validation tests on port 8080 before production traffic begins shifting.

Adım Adım Çözüm

1
Analyze the traffic shifting requirement
The requirement is to route 10% of traffic initially, wait 15 minutes, and then route the remaining 90%. This matches the Canary deployment pattern with a 10% initial shift and a 15-minute bake period, represented by the built-in configuration CodeDeployDefault.ECSCanary10Percent15Minutes.
Choosing the correct deployment configuration ensures traffic shifting conforms to the SLA and rollback windows.
2
Identify the lifecycle hook for testing on the test port
The AfterAllowTestTraffic hook is run immediately after the test listener starts routing test traffic to the replacement task set, but before any production traffic is shifted. This is the correct lifecycle hook to trigger a Lambda function to perform validation tests.
Placing validation tests in the correct lifecycle hook ensures that failures can trigger a rollback before production users are affected.
3
Configure the rollback mechanism
If the validation Lambda function fails (returns a failure status to CodeDeploy) or if the CloudWatch alarm triggers during the 15-minute baking period, CodeDeploy will automatically initiate a rollback to the original task set.
Ensures the deployment is safe and automatically rolls back on error detection.

Anahtar Kavram

AWS CodeDeploy ECS Blue/Green Deployment Lifecycle Hooks and Deployment Configurations
Tahmini Süre:3m 0s
Soru 127Soru →

A developer is configuring an automated build pipeline using AWS CodePipeline. The pipeline is configured to trigger automatically when a ZIP file containing the application source code is uploaded to a specific Amazon S3 bucket, build the application using AWS CodeBuild, and store the output in another bucket. Order the sequence of events that occurs from the developer uploading the ZIP file to the start of the AWS CodeBuild execution.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of events starts with the developer uploading the ZIP file to S3, followed by EventBridge detecting the event and triggering CodePipeline, which then downloads the file to the S3 artifact store and subsequently passes it to AWS CodeBuild to start the build.
The correct order follows the event-driven trigger flow: uploading to S3, detection of the S3 event by EventBridge, matching the target rule to trigger CodePipeline, fetching and saving the source code into the pipeline S3 artifact store, and finally starting CodeBuild with the artifact.

Adım Adım Çözüm

1
Upload the source code archive to S3.
The S3 object creation event is emitted.
This is the initial action that starts the event-driven workflow.
2
EventBridge detects the S3 object creation event.
The event is captured and evaluated by EventBridge rules.
EventBridge acts as the serverless event router between Amazon S3 and CodePipeline.
3
The matched EventBridge rule triggers CodePipeline.
CodePipeline receives the trigger and starts a new pipeline execution.
The rule target is configured to initiate the execution of the pipeline.
4
CodePipeline runs the Source stage and writes the ZIP file to the artifact store S3 bucket.
The ZIP file is saved as an input artifact.
CodePipeline must store the retrieved source code in its internal artifact store so that downstream actions like CodeBuild can access it.
5
CodePipeline triggers CodeBuild with the input artifact.
CodeBuild receives the source bundle from the artifact store and begins the build.
The Build stage action is executed with the input artifact specified in the pipeline configuration.

Anahtar Kavram

AWS CodePipeline S3 and EventBridge Event Integration and Artifact Flow
Tahmini Süre:1m 30s
Soru 128Soru →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to deploy a serverless web application. The pipeline is created in the us-east-1 region. The release process must deploy AWS CloudFormation stacks to both us-east-1 and us-west-2 during the deployment stage. The pipeline execution fails during the cross-region deployment action because of issues with artifact access between regions. Which two configurations must the developer implement to support this cross-region deployment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions to encrypt and decrypt the deployment artifacts.; Include an Amazon S3 artifact store bucket in each region where a pipeline action is executed within the pipeline definition.

Cevap

Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions, and include an Amazon S3 artifact store bucket in each region where a pipeline action is executed.
To configure cross-region actions in AWS CodePipeline, a regional S3 artifact store bucket must be configured in each region where actions are executed. Additionally, a customer managed AWS KMS key must be configured in each region to encrypt and decrypt artifacts stored in these regional S3 buckets because default AWS managed keys are not supported for cross-region actions.

Adım Adım Çözüm

1
Analyze cross-region action requirements in AWS CodePipeline.
Identify that CodePipeline requires a separate S3 bucket in each region where an action is executed to act as a regional artifact store.
Artifacts must be stored locally in the region of execution to prevent latency and allow regional services to access them.
2
Determine the encryption requirements for cross-region artifact stores.
Identify that a customer managed KMS key must be configured in each region to encrypt and decrypt the artifacts.
Default AWS managed S3 keys (aws/s3) cannot be used for cross-region actions because they cannot be used to decrypt artifacts across regional or account boundaries by the pipeline's service role.
3
Evaluate the distractors against the requirements.
Reject the options proposing default AWS managed S3 keys, Parameter Store for automatic secret rotation, and modifying the CodePipeline trust policy for CloudFormation.
These distractors rely on incorrect assumptions about AWS managed keys, Parameter Store capabilities, and IAM trust relationship delegations.

Anahtar Kavram

AWS CodePipeline Cross-Region Action Configurations
Soru 129Soru →

A developer is configuring a CI/CD pipeline in AWS CodePipeline. The pipeline consists of a Source stage, a Build stage running AWS CodeBuild, and a Deploy stage running AWS CloudFormation. During the Build stage, CodeBuild executes a script that generates a dynamic configuration token required by the CloudFormation template as a parameter named ConfigToken. The pipeline must support concurrent executions without resource state conflicts, out-of-band credential dependencies, or exposure of sensitive data. Which configuration should the developer implement to pass this dynamic token to the CloudFormation deployment action?

Cevabı ve açıklamayı göster

Cevap: Define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml and assign the value during the build phase. Set a Namespace (e.g., BuildVariables) in the CodePipeline build action, and configure the CloudFormation Deploy action ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.

Cevap

Define the ConfigToken under exported-variables in the env section of the buildspec.yml, set a Namespace on the CodePipeline build action, and reference it in the CloudFormation ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.
The correct option is to define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml, assign a Namespace to the Build action, and configure the CloudFormation ParameterOverrides using the syntax #{Namespace.Variable}. CodePipeline natively supports variable sharing across actions using execution namespaces. Each execution has its own runtime scope, which ensures that concurrent pipeline runs remain isolated and do not overwrite each other's data.

Adım Adım Çözüm

1
Export the variable in CodeBuild
ConfigToken is defined under the exported-variables key in the buildspec's env section.
This registers the variable with AWS CodeBuild, making it eligible to be captured by AWS CodePipeline upon build completion.
2
Assign a namespace to the Build action
The Build stage action configuration is updated with a Namespace property (e.g., BuildVariables).
Creating a namespace allows other actions within the same pipeline execution path to access the output variables of this specific action.
3
Reference the namespace variable in the CloudFormation action
The ParameterOverrides parameter is set to reference the variable using #{BuildVariables.ConfigToken}.
CodePipeline dynamically interpolates variables using the #{Namespace.VariableName} format during execution, ensuring isolation and supporting concurrency.

Anahtar Kavram

AWS CodePipeline variables and namespaces
Soru 130Soru →

A developer is designing a deployment strategy for a high-traffic microservice running on Amazon ECS (Fargate). The service has a desired count of 8 tasks. Due to strict vCPU and memory service quotas in the AWS region, the deployment process must never run more than the 8 desired tasks at any point during the update. Additionally, to handle baseline traffic and prevent downtime, at least 4 healthy tasks must remain in service throughout the deployment. Which deployment strategy and configuration should the developer choose to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: An ECS rolling update with the minimum healthy percent set to 50% and the maximum percent set to 100%.

Cevap

An ECS rolling update with the minimum healthy percent set to 50% and the maximum percent set to 100%.
The correct strategy is a rolling update with the minimum healthy percent set to 50% and the maximum percent set to 100%. In Amazon ECS, setting the minimum healthy percent to 50% with a desired task count of 8 guarantees that at least 4 tasks (8 * 0.50) will remain running and healthy at all times during the deployment, preventing downtime. Setting the maximum percent to 100% restricts the total number of tasks to 8 (8 * 1.00), ensuring the service never exceeds the desired task count and respects the strict resource quotas. ECS will stop 4 old tasks first to make room under the 100% limit, start 4 new tasks, wait for them to become healthy, and then repeat the process for the remaining tasks.

Adım Adım Çözüm

1
Analyze the constraints given in the scenario.
Desired count is 8 tasks. Maximum allowed concurrent tasks is 8 (100% of desired). Minimum required healthy tasks is 4 (50% of desired).
This establishes the bounds for the maximum capacity percent and the minimum healthy capacity percent.
2
Evaluate the rolling update configuration options against the constraints.
A minimum healthy percent of 50% (4 tasks) and a maximum percent of 100% (8 tasks) matches the capacity bounds exactly.
ECS calculates these percentages relative to the desired task count to determine how many tasks can be stopped and started during a deployment.
3
Evaluate the Blue/Green deployment option.
CodeDeploy Blue/Green deployments for ECS spin up a full replacement task set (8 additional tasks, totaling 16), which violates the resource quota constraint.
Blue/Green deployment requires duplicate resource capacity during the cutover phase.

Anahtar Kavram

Configuring rolling update parameters (minimumHealthyPercent and maximumPercent) in Amazon ECS to control deployment capacity limits and maintain service availability.
Tahmini Süre:2m 0s
Soru 131Soru →

An organization runs an internal test environment on AWS Elastic Beanstalk. The system administrator wants to update the application version with zero budget for temporary resource overhead, meaning no additional EC2 instances can be launched during the update. A temporary reduction in application performance or brief downtime is acceptable during the process. Which of the following deployment strategies can be used to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: All at once; Rolling

Cevap

The correct deployment strategies are All at once and Rolling.
The All at once and Rolling deployment strategies perform the update on the existing EC2 instances in the environment. Neither strategy provisions additional instances, ensuring that no extra costs are incurred. The All at once strategy updates all instances simultaneously (causing downtime), whereas the Rolling strategy updates instances in batches (temporarily reducing capacity), both of which fit within the allowed constraints.

Adım Adım Çözüm

1
Analyze the resource and cost constraints.
The scenario requires zero additional budget for temporary resource overhead, meaning no new EC2 instances can be provisioned.
This rules out any deployment strategies that launch new instances (e.g., Rolling with additional batch, Immutable, and Blue/Green).
2
Analyze the availability and capacity constraints.
Temporary capacity reduction or complete downtime is acceptable during the update.
This allows for strategies that take instances out of service or deploy to all instances simultaneously.
3
Identify strategies matching both criteria.
All at once updates all existing instances at once (causing downtime but no extra cost). Rolling updates existing instances in batches (reducing capacity but no extra cost). Both satisfy the constraints.
Both strategies perform in-place deployments on existing instances without provisioning new ones.

Anahtar Kavram

AWS Elastic Beanstalk Deployment Strategies and Cost Trade-offs
Tahmini Süre:1m 0s
Soru 132Soru →

A development team is migrating a legacy backend API to run on Amazon ECS with the AWS Fargate launch type. The deployment process requires the Amazon ECS agent to authenticate with a private Amazon ECR registry to retrieve the Docker image and to configure log streams in Amazon CloudWatch. Which of the following IAM configuration steps are required to enable this setup? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch.; Configure the trust policy of the Task Execution Role to permit the Amazon ECS Tasks service principal (ecs-tasks.amazonaws.com) to assume the role.

Cevap

To successfully deploy the tasks on Fargate, you must assign an ECS Task Execution Role containing ECR pull and CloudWatch logging permissions, and update its trust policy to allow the ecs-tasks.amazonaws.com service principal to assume it.
The correct options state that we must assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch, and configure the trust policy of this role to permit the Amazon ECS Tasks service principal to assume it. This ensures that the ECS agent, running outside the container space, has the necessary permissions to retrieve the container image and initialize logging.

Adım Adım Çözüm

1
Identify the entity performing infrastructure actions (image pull and log creation).
The Amazon ECS container agent runs before the application starts, requiring these permissions via the Task Execution Role.
Differentiating between task execution permissions (infra setup) and application permissions (runtime code) is necessary to choose the correct IAM role.
2
Configure the trust relationship on the Task Execution Role.
Trust policy is updated to allow the 'ecs-tasks.amazonaws.com' service principal to call AssumeRole.
Without the correct trust policy, AWS services cannot assume the IAM role to retrieve temporary security credentials.

Anahtar Kavram

Distinction between ECS Task Role and ECS Task Execution Role, and configuring appropriate trust relationships.
Tahmini Süre:1m 0s
Soru 133Soru →

A developer is packaging a web application for deployment to AWS Elastic Beanstalk. To configure custom environment properties and OS-level packages, the developer creates a configuration file named 01_setup.config. However, after deploying the application source bundle zip file, the developer notices that none of the custom configurations are applied to the EC2 instances. Where must the configuration file be located within the application source bundle for AWS Elastic Beanstalk to detect and process it?

Cevabı ve açıklamayı göster

Cevap: Inside a folder named .ebextensions placed at the root of the application source bundle

Cevap

Inside a folder named .ebextensions placed at the root of the application source bundle
AWS Elastic Beanstalk requires configuration files to be stored in a directory named '.ebextensions' at the root of the application source bundle. Files within this directory must have a '.config' extension to be parsed and executed during deployment.

Adım Adım Çözüm

1
Identify the mechanism AWS Elastic Beanstalk uses for customization during deployment.
Elastic Beanstalk uses configuration files (ending in .config) to customize environment resources and software.
Understanding the built-in configuration mechanism of Elastic Beanstalk helps locate where configuration files must be stored.
2
Determine the required directory name and location requirements for these configuration files.
The files must be located in a folder named '.ebextensions' (with a leading dot) situated precisely at the root of the application source bundle.
Elastic Beanstalk's deployment agent scans only the root-level '.ebextensions' folder for files ending in '.config'.

Anahtar Kavram

AWS Elastic Beanstalk configuration files (.ebextensions) structure
Tahmini Süre:1m 30s
Soru 134Soru →

A developer manages an AWS CloudFormation stack for a production application. The stack defines an Amazon S3 bucket with the `DeletionPolicy` attribute set to `Retain`. To update the application's storage architecture, the developer modifies the CloudFormation template to change the name of the S3 bucket, which requires resource replacement. Before executing the stack update, the developer manually deletes the original S3 bucket out-of-band using the AWS CLI. During the stack update, a name collision error occurs for the new S3 bucket, causing the update to fail and begin rolling back. The rollback fails because the original S3 bucket no longer exists, and the parent stack becomes stuck in the `UPDATE_ROLLBACK_FAILED` state.

Which sequence of actions must the developer take to resolve this failure and successfully complete the name change?

Cevabı ve açıklamayı göster

Cevap: Invoke the `ContinueUpdateRollback` action and select the original S3 bucket as a resource to skip. Once the stack returns to a stable state, update the template to use a globally unique name for the new S3 bucket, and then run the stack update again.

Cevap

Invoke the `ContinueUpdateRollback` action and select the original S3 bucket as a resource to skip. Once the stack returns to a stable state, update the template to use a globally unique name for the new S3 bucket, and then run the stack update again.
The correct answer is to use the `ContinueUpdateRollback` action and skip the deleted S3 bucket. Because the original bucket was deleted manually, CloudFormation cannot recreate it or revert its state during the rollback, which blocks the stack. Skipping the resource during the rollback process lets the stack reach a stable status (`ROLLBACK_COMPLETE` or `UPDATE_ROLLBACK_COMPLETE`). From there, the template can be fixed with a unique bucket name to avoid collision and update successfully.

Adım Adım Çözüm

1
Perform the ContinueUpdateRollback operation.
The stack skips rolling back the deleted S3 bucket and successfully transitions to the `ROLLBACK_COMPLETE` state.
When a stack update rollback fails due to a missing resource, skipping that resource allows CloudFormation to bypass the block and bring the stack to a stable state.
2
Modify the CloudFormation template to specify a globally unique name for the new S3 bucket.
The template is prepared with a unique resource name that will not cause a name collision.
The initial stack update failed due to a name collision, so a unique name is required for successful creation.
3
Initiate a new stack update using the updated template.
The stack updates successfully, creating the new S3 bucket and completing the replacement.
Since the stack is now in a stable state, it can accept new update commands to apply the corrected configuration.

Anahtar Kavram

CloudFormation update rollback recovery and handling resource replacement drift
Soru 135Soru →

A developer is creating an Amazon ECS task definition to deploy a containerized application to AWS Fargate. The container needs to pull its image from Amazon ECR, write container logs to Amazon CloudWatch Logs, and query an Amazon DynamoDB table. Which two configurations must the developer specify in the task definition to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A task execution role that grants permissions to pull the container image from Amazon ECR and write logs to Amazon CloudWatch Logs; A task role that grants permissions to the application code running inside the container to query the Amazon DynamoDB table

Cevap

The developer must specify a task execution role to grant ECR and CloudWatch access to the ECS agent, and a task role to grant DynamoDB access to the application code.
The correct choices specify a task execution role to grant the ECS agent permissions to pull ECR images and write CloudWatch logs, and a task role to grant the application code permissions to query DynamoDB.

Adım Adım Çözüm

1
Identify the permissions needed for the ECS container agent to pull the Docker image and configure logging.
These infrastructure lifecycle actions are executed by the ECS agent, requiring the Task Execution Role.
The Task Execution Role provides the necessary permissions for the container agent itself before the application container starts.
2
Identify the permissions needed for the application code itself to interact with Amazon DynamoDB.
This business logic is executed inside the application container, requiring the Task Role.
The Task Role assigns permissions directly to the application container so the code can query AWS resources using SDKs.

Anahtar Kavram

Amazon ECS Task IAM Roles
Tahmini Süre:1m 0s
Soru 136Soru →

A developer is managing a web application infrastructure using AWS CloudFormation. The developer needs to configure the stack to retrieve a database password securely and ensure that the deployed infrastructure remains consistent with the template definition. Which two actions should the developer take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference.; Use CloudFormation stack updates to perform all infrastructure modifications, avoiding direct manual updates to the resources.

Cevap

Storing the database password in AWS Secrets Manager and referencing it dynamically, and using CloudFormation stack updates to perform all infrastructure modifications.
The correct actions are storing the database password in AWS Secrets Manager using dynamic references to prevent exposing credentials, and performing all changes via CloudFormation stack updates to avoid resource drift.

Adım Adım Çözüm

1
Identify the requirement for secure password retrieval.
AWS Secrets Manager is selected because it securely stores secrets and supports dynamic references in CloudFormation.
This avoids exposing credentials in plaintext.
2
Identify the requirement to prevent configuration drift.
Deploying all changes through CloudFormation stack updates instead of manual out-of-band modifications.
This maintains resource consistency and avoids drift-related failures during future updates.

Anahtar Kavram

AWS CloudFormation best practices for resource consistency and secrets management
Soru 137Soru →

A company is using AWS CodePipeline to automate their deployment process. The pipeline includes a deploy stage that triggers a custom AWS Lambda action to run database migrations against an Amazon RDS MySQL DB instance located in a private subnet. The migration script requires database credentials that must be rotated automatically every 14 days, as well as a non-sensitive database endpoint port number. During execution, the custom Lambda action fails. Which configuration should the developer implement to allow the Lambda function to securely run the migrations while optimizing for operational overhead, cost, and security?

Cevabı ve açıklamayı göster

Cevap: Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway. Retrieve the database credentials from AWS Secrets Manager and the database port from AWS Systems Manager Parameter Store. Attach a permissions policy to the Lambda execution role allowing secretsmanager:GetSecretValue and ssm:GetParameter, and ensure the role's trust policy allows the lambda.amazonaws.com service principal to assume the role.

Cevap

Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway, retrieving the credentials from AWS Secrets Manager and the port from AWS Systems Manager Parameter Store, while attaching the appropriate permissions policy and a trust policy allowing lambda.amazonaws.com to assume the role.
The correct configuration deploys the Lambda function in private VPC subnets alongside a NAT Gateway to permit egress access to both the RDS database and AWS public service endpoints. By retrieving the database credentials from AWS Secrets Manager, the developer secures the credentials and can leverage automatic secret rotation. Using Systems Manager Parameter Store for the database port optimizes cost for non-sensitive configurations. Finally, creating a permissions policy for the AWS actions and maintaining a trust policy that allows the Lambda service principal to assume the role complies with the AWS IAM model.

Adım Adım Çözüm

1
Determine the network topology for the database migration Lambda function.
The Lambda function must be placed in private VPC subnets with a route to a NAT Gateway to access the private RDS DB instance and reach public AWS endpoints for Secrets Manager and Parameter Store.
Since the RDS MySQL instance is in a private subnet, the Lambda function needs to be in the same VPC to communicate with it, and it needs a NAT Gateway to call AWS API endpoints.
2
Select the correct secrets and parameter storage services based on requirements.
Store database credentials in AWS Secrets Manager and the database port in Systems Manager Parameter Store.
AWS Secrets Manager is required because it natively supports automatic rotation every 14 days. Systems Manager Parameter Store is used for the non-sensitive port number to minimize costs.
3
Configure the Lambda execution role policies.
Attach a permissions policy allowing secretsmanager:GetSecretValue and ssm:GetParameter. Ensure the trust policy allows lambda.amazonaws.com to assume the role.
The permissions policy governs what resources the role can access, while the trust policy specifies that the Lambda service itself is permitted to assume the role during execution.

Anahtar Kavram

Integration of AWS CodePipeline custom actions with VPC network configurations, AWS Secrets Manager, Systems Manager Parameter Store, and IAM role trust/permissions separation.
Tahmini Süre:2m 0s
Soru 138Soru →

A developer is setting up a basic release pipeline using AWS CodePipeline to compile a containerized application and deploy it to Amazon Elastic Container Service (Amazon ECS). The source code is stored in an AWS CodeCommit repository. Which of the following configurations are required to successfully set up this pipeline? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Source action in AWS CodePipeline with AWS CodeCommit as the source provider.; Configure a Build action in AWS CodePipeline with AWS CodeBuild as the build provider.

Cevap

To configure the release pipeline, the developer must add a Source action with AWS CodeCommit as the provider and a Build action with AWS CodeBuild as the provider.
The correct configurations are configuring a Source action with AWS CodeCommit as the source provider and configuring a Build action with AWS CodeBuild as the build provider. The Source action triggers the pipeline when changes are detected in the repository, and the Build action compiles the containerized application and packages it as a Docker image.

Adım Adım Çözüm

1
Define the Source stage.
The pipeline is configured with a Source stage that references the AWS CodeCommit repository to pull the code on changes.
AWS CodePipeline requires a source repository to fetch the code before running subsequent compilation or build actions.
2
Define the Build stage.
The pipeline is configured with a Build stage that uses AWS CodeBuild to execute the compilation and Docker image build steps.
An AWS CodeBuild action is necessary to compile the containerized application code and package it as a Docker image.

Anahtar Kavram

AWS CodePipeline Stages and Actions
Soru 139Soru →

A developer is planning the deployment strategy for a critical, high-volume API hosted on AWS Elastic Beanstalk. The API is highly sensitive to performance fluctuations under load and must maintain 100%100\% of its provisioned capacity throughout the deployment process. Additionally, company compliance requires that the update must be deployed onto brand-new EC2 instances to ensure compliance with a fresh OS base image, and any deployment failure must support an immediate rollback to minimize service disruption. Which two AWS Elastic Beanstalk deployment strategies should the developer choose to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Immutable; Traffic Splitting

Cevap

The correct strategies are Immutable and Traffic Splitting because both launch a separate, temporary Auto Scaling group to host the new version on brand-new instances while keeping the original instances fully operational, thereby maintaining 100%100\% capacity and allowing for immediate rollback if a failure occurs.
The correct strategies are the ones that deploy to a temporary Auto Scaling group rather than performing in-place updates. The Immutable strategy creates a parallel Auto Scaling group with the new version, maintaining 100%100\% capacity on the old instances, and swaps traffic once healthy. Similarly, the Traffic Splitting strategy launches a temporary Auto Scaling group and routes a set percentage of traffic to it to perform canary testing. Both options use brand-new EC2 instances and support fast, clean rollbacks by destroying the temporary resources.

Adım Adım Çözüm

1
Analyze the capacity requirement
The requirement to maintain 100%100\% capacity eliminates the standard Rolling strategy, which takes batches of existing instances offline during the deployment, and the All at once strategy, which takes all instances offline.
Maintaining capacity ensures no performance degradation occurs under high-volume load.
2
Analyze the infrastructure requirement
The requirement to deploy the new application version onto brand-new EC2 instances eliminates the Rolling with additional batch strategy. While it launches an initial extra batch, subsequent batches are updated in-place on the existing EC2 instances.
Compliance policies often require fresh operating system baselines rather than patching running hosts.
3
Evaluate the remaining strategies against rollback requirements
Both Immutable and Traffic Splitting deployment strategies satisfy all conditions. They launch a temporary Auto Scaling group with the new application version, keeping the existing environment fully scaled, and allow an immediate rollback by terminating the new group if health checks fail.
Validating both strategies confirms they fulfill the capacity, new instance, and rapid rollback criteria.

Anahtar Kavram

AWS Elastic Beanstalk Deployment Policies and Strategies
Soru 140Soru →

A developer needs to deploy an update to a non-production web application running in an AWS Elastic Beanstalk environment. The update must be deployed as quickly as possible, and the developer can tolerate a brief period of downtime during the deployment. Additionally, no new EC2 instances should be provisioned to avoid temporary cost increases. Which deployment policy should the developer select?

Cevabı ve açıklamayı göster

Cevap: All at once

Cevap

All at once
The 'All at once' deployment policy is the fastest way to deploy an update because it deploys the new application version to all instances at the same time. Since it uses the existing instances in-place without launching new ones, it incurs no additional costs. While it causes temporary downtime because all instances are out of service during the update, this is acceptable under the given constraints.

Adım Adım Çözüm

1
Analyze the deployment constraints.
The requirements specify: maximum speed of deployment, acceptable downtime, and no additional EC2 instances (zero extra cost).
Understanding the constraints is necessary to choose the correct AWS Elastic Beanstalk deployment policy.
2
Evaluate the deployment policies against the constraints.
The 'All at once' policy stops all instances, deploys the new version, and starts them up. This is the fastest method, uses only existing instances (no extra cost), but causes downtime. Other methods like Rolling, Rolling with additional batch, or Immutable focus on avoiding downtime, which increases deployment duration and, in some cases, temporary resource costs.
Comparing available deployment policies identifies the policy that matches the constraints.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their trade-offs between speed, cost, and availability.
ÖncekiSayfa 7 / 19Sonraki