AWS Certified DevOps Engineer Professional Practice Exams

Practice Test 6: DOP-C02
Open

Practice Test 5: DOP-C02

Finish course

Set a certification due date

AWS Certified DevOps Engineer – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: DOP-C02

Start

Practice Test 2: DOP-C02

Start

Practice Test 3: DOP-C02

Start

Practice Test 4: DOP-C02

Start

Practice Test 5: DOP-C02

Start

Practice Test 6: DOP-C02

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] Pass the AWS DevOps Engineer Professional Exam DOP-C02 | Exam-Difficulty Practice Questions + Exam Simulation

Rating: 4.0 out of 54.0
320 ratings

4,812

Students

130 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified DevOps Engineer Professional exam the first time with a great score

EXAM SIMULATION: All practice tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

ALWAYS UP TO DATE: Covering the latest DOP-C02 exam guide, our question bank is regularly updated based on student feedback from the real exam

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: In this discussion board, students ask questions and share their recent exam experience offering feedback on which topics were covered

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Description

Are you preparing for the AWS Certified DevOps Engineer Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS DevOps Professional practice exams to assess your exam-readiness and get certified for DOP-C02.

Our course includes 6 AWS practice exams that include a total of 130 unique practice questions. All of our practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Our questions are continually revised based on feedback from students who have recently taken the AWS exam, so you can be sure that they are up-to-date and reflect the latest exam format.

Our practice exam course is designed to give you a thorough understanding of the key concepts and topics covered in the DOP-C02 exam. Based on your test report that provides you with detailed feedback, you get to identify areas where you need to improve and build the confidence you need to succeed in the actual exam.

TOP REASONS WHY THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST DOP-C02 EXAM: All practice tests on Udemy are scenario-based reflecting the latest AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES OF QUESTIONS: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered.

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the pass mark for the actual AWS exam is 72%, we highly recommend that you continue taking our AWS practice exams until you achieve a consistent score of 80% or higher. Once you reach this recommended score on our practice tests, you'll be well-prepared to sit the actual exam and achieve a great score.

GET FAMILIAR WITH THE ACTUAL EXAM FORMAT: Our AWS Certified DevOps Pro practice exams are specifically designed to help you become familiar with the test question format and structure of the actual AWS exam. Unlike many other practice tests on the market, our exams closely match the format of the real AWS exam, ensuring that you are adequately prepared for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS DevOps practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified DevOps certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED DEVOPS ENGINEER PROFESSIONAL CERTIFICATION

The AWS Certified DevOps Engineer Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS DevOps are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified DevOps s exam aims to test knowledge of the key services and tools used by DevOps creating applications on AWS.

When you're ready to book your exam you can do so on the AWS Training portal. Curious about the AWS DevOps certification cost? The AWS DevOps Professional Certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. Our mission is to provide you with the resources you need to pass your exam on your first attempt - without wasting time or money. After completing these AWS Certified DevOps Pro Practice Tests and assessing your exam readiness, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified DevOps Engineer Professional (DOP-C02) exam who want to pass with confidence

Students who want to test their skills in exam simulation, assessing their DOP-C02 exam readiness

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

This course is designed for individuals with a solid AWS knowledge and experience (at the Associate level)

It is recommended that students have successfully passed one or more of the AWS Associate level exams.

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 6: DOP-C02

DOP-C02 - Results

Back to result overview
Attempt 1

All domains

All domains

AWS Compute

AWS Networking & Content Delivery

AWS Developer Tools

AWS Application Integration

AWS Management & Governance

AWS Storage

AWS Database

AWS Security, Identity, & Compliance

20 all

0 correct

0 incorrect

20 skipped

0 marked

Collapse all questions

Question 1Skipped

A DevOps team is developing a PHP web application which will be deployed on Amazon EC2 instances. The application has been designed to use a MySQL database. The team requires a deployment model in which they can reliably build, test, and deploy new updates daily, without downtime or degraded performance. The application must also be able to scale to meet an unpredictable number of concurrent users.

Which action will allow the team to quickly meet these objectives?

Correct answer

Create two auto scaling AWS Elastic Beanstalk environments: one for test and one for production. Build the application using AWS CodeBuild and use Amazon RDS to store data. When new versions of the applications have passed all tests, use the Elastic Beanstalk 'swap cname' to promote the test environment to production.

Use AWS OpsWorks to create a stack for the application with a DynamoDB database layer, an Application Load Balancing layer, and an Amazon EC2 instance layer. Use Chef recipes to build and deploy the application. Use custom health checks to run unit tests on each instance with rollback on failure.

Create two Amazon ECS services: one for test and one for production. Upload the web application code to the test ECS tasks using the AWS CLI. Test the application and if the tests pass, upload the code to the production ECS tasks.

Create an AWS CloudFormation template which deploys an Auto Scaling group of EC2 instances behind an Application Load Balancer. Use AWS CodeBuild to build and test the PHP application. Install the application and the MySQL database on each EC2 instance. Update the stack to deploy new application versions.

Overall explanation

Because AWS Elastic Beanstalk performs an in-place update when you update your application versions, your application might become unavailable to users for a short period of time. To avoid this, perform a blue/green deployment. To do this, deploy the new version to a separate environment, and then swap the CNAMEs of the two environments to redirect traffic to the new version instantly.

This solution that meets the requirements of this question by ensuring that the team can build, test, and deploy new updates daily, without downtime or degraded performance. The auto scaling support for the environments will automatically scale the infrastructure to ensure that the application can meet changing demands.

CORRECT: "Create two auto scaling AWS Elastic Beanstalk environments: one for test and one for production. Build the application using AWS CodeBuild and use Amazon RDS to store data. When new versions of the applications have passed all tests, use the Elastic Beanstalk 'swap cname' to promote the test environment to production" is the correct answer (as explained above.)

INCORRECT: "Create two Amazon ECS services: one for test and one for production. Upload the web application code to the test ECS tasks using the AWS CLI. Test the application and if the tests pass, upload the code to the production ECS tasks" is incorrect.

Using the CLI to upload code is not a best practice. It is better to build and test with a service such as AWS CodeBuild. The main problem with this solution is there is no method of deploying updates in a blue/green strategy and to be able to rollback changes when necessary.

INCORRECT: "Create an AWS CloudFormation template which deploys an Auto Scaling group of EC2 instances behind an Application Load Balancer. Use AWS CodeBuild to build and test the PHP application. Install the application and the MySQL database on each EC2 instance. Update the stack to deploy new application versions" is incorrect.

CloudFormation stacks are best used for infrastructure deployments and updates and not for application/code level changes.

INCORRECT: "Use AWS OpsWorks to create a stack for the application with a DynamoDB database layer, an Application Load Balancing layer, and an Amazon EC2 instance layer. Use Chef recipes to build and deploy the application. Use custom health checks to run unit tests on each instance with rollback on failure" is incorrect.

DynamoDB is not a suitable solution when the question states that the application has been designed to work with MySQL which is an SQL type of database. A code rewrite would be required to support a NoSQL database.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.CNAMESwap.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-beanstalk/

Domain

AWS Compute

Question 2Skipped

A DevOps engineer is migrating an application running on Docker containers from an on-premises data center to AWS. The application must run with minimal management overhead. Encrypted communications between the data center and AWS must be implemented for secure connectivity with on-premises resources.

Which actions should the DevOps engineer take to meet these requirements? (Select TWO.)

Migrate the container-based workload to Amazon ECS with the EC2 launch type in a custom VPC.

Implement a Network Load Balancer with IP-based targets and configure an HTTPS listener.

Correct selection

Implement an AWS Managed VPN to encrypt traffic between the on-premises data center and the VPC.

Correct selection

Migrate the container-based workload to Amazon ECS with the Fargate launch type in a custom VPC.

Implement a VPC endpoint and update security groups to enable access to Amazon ECS.

Overall explanation

The requirements are for low management overhead of the container-based application on AWS and encryption for traffic between AWS and the on-premises network. To minimize management overhead of the application the DevOps engineer should deploy the container-based application on Amazon ECS with the Fargate launch type. This is the serverless solution for Amazon ECS and will be the easiest to manage.

To encrypt communications between the on-premises data center and the VPC, the engineer should deploy an AWS Managed VPN which will used IPSec to encrypt the traffic between these networks.

CORRECT: "Migrate the container-based workload to Amazon ECS with the Fargate launch type in a custom VPC" is a correct answer (as explained above.)

CORRECT: "Implement an AWS Managed VPN to encrypt traffic between the on-premises data center and the VPC" is also a correct answer (as explained above.)

INCORRECT: "Migrate the container-based workload to Amazon ECS with the EC2 launch type in a custom VPC" is incorrect.

The EC2 launch type has a higher management overhead as you must maintain the EC2 instances that run the container agent.

INCORRECT: "Implement a VPC endpoint and update security groups to enable access to Amazon ECS" is incorrect.

With the Fargate launch type there is no need to add a VPC endpoint to enable connectivity for the ECS cluster.

INCORRECT: "Implement a Network Load Balancer with IP-based targets and configure an HTTPS listener" is incorrect.

You cannot create an HTTPS listener with an NLB and there is no need to use a load balancer to meet these requirements.

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Networking & Content Delivery

Question 3Skipped

A company is developing a continuous delivery pipeline using AWS CodePipeline. The application is deployed across multiple ALBs each of which has a dedicated Auto Scaling group. A DevOps engineer must configure the pipeline so that a simultaneous deployment is triggered to all ALBs and Auto Scaling groups when code is committed to an AWS CodeCommit repository.

Which deployment option meets these requirements with the LEAST amount of configuration?

Use a single AWS CodePipeline pipeline that deploys the application in parallel using separate AWS CodeDeploy applications and deployment groups for each pair of ALB and Auto Scaling group.

Correct answer

Use a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and separate deployment groups for each pair of ALB and Auto Scaling group.

Use a separate AWS CodePipeline pipeline for each pair of ALB and Auto Scaling group that deploys the application using a single AWS CodeDeploy application and deployment group for those resources.

Use a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group that includes all ALBs and Auto Scaling groups.

Overall explanation

You can associate more than one deployment group with an application in CodeDeploy. This makes it possible to deploy an application revision to different sets of instances at different times or in parallel.

In this case the configuration can deploy to each ALB and Auto Scaling group pair in parallel within a single AWS CodePipeline pipeline. This is the most efficient solution and requires the least configuration.

Deployment options include using a blue/green deployment strategy or an in-place deployment.

CORRECT: "Use a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and separate deployment groups for each pair of ALB and Auto Scaling group" is the correct answer (as explained above.)

INCORRECT: "Use a single AWS CodePipeline pipeline that deploys the application in parallel using separate AWS CodeDeploy applications and deployment groups for each pair of ALB and Auto Scaling group" is incorrect.

A separate deployment group can be specified to deploy the updates in parallel. These deployment groups can be created within a single CodeDeploy application. You cannot select multiple CodeDeploy applications within the pipeline.

INCORRECT: "Use a separate AWS CodePipeline pipeline for each pair of ALB and Auto Scaling group that deploys the application using a single AWS CodeDeploy application and deployment group for those resources" is incorrect.

This is a more complex configuration that requires more configuration and management so is not the preferred option.

INCORRECT: "Use a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group that includes all ALBs and Auto Scaling groups" is incorrect.

You cannot include all ALBs and Auto Scaling groups in a single deployment group within CodeDeploy. Each ALB and Auto Scaling group pair should be added to a separate deployment group within the single CodeDeploy application. The pipeline can then be configured to run the deployments in parallel.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-groups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 4Skipped

An application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is used by users around the world who access the application using a custom DNS domain name. The application must support encryption in transit, be protected from DDoS attacks and web exploits, should be optimized for performance.

Which actions should a DevOps engineer take to meet these requirements? (Select TWO.)

Correct selection

Create an AWS WAF web ACL, configure a default action and rule, and specify the CloudFront distribution that WAF should inspect.

Correct selection

Create an Amazon CloudFront distribution with the ALB as an origin. Configure the custom domain name and attach an SSL/TLS certificate.

Create an Amazon CloudFront distribution with the Auto Scaling group as an origin. Configure the custom domain name and attach an SSL/TLS certificate.

Create an AWS WAF web ACL, configure a default action and rule, and specify the Auto Scaling group that WAF should inspect.

Create an AWS WAF web ACL, configure a default action and rule, and specify the ALB that WAF should inspect.

Overall explanation

To improve performance for global users the solution should use Amazon CloudFront. The distribution should specify the ALB as the origin and use a custom domain name and SSL/TLS certificate. This will enable caching of content in Edge Locations around the world and CloudFront offers DDoS protection.

To protect against web exploits AWS WAF should be used. A Web ACL must be created with an action and rule specified to deal with threats. The web ACL can be specified in the CloudFront distribution.

CORRECT: "Create an Amazon CloudFront distribution with the ALB as an origin. Configure the custom domain name and attach an SSL/TLS certificate" is a correct answer (as explained above.)

CORRECT: "Create an AWS WAF web ACL, configure a default action and rule, and specify the CloudFront distribution that WAF should inspect" is also a correct answer (as explained above.)

INCORRECT: "Create an Amazon CloudFront distribution with the Auto Scaling group as an origin. Configure the custom domain name and attach an SSL/TLS certificate" is incorrect.

You can configure an ELB as an origin for the distribution, but you cannot specify an ASG.

INCORRECT: "Create an AWS WAF web ACL, configure a default action and rule, and specify the ALB that WAF should inspect" is incorrect.

The web ACL should be attached to the CloudFront distribution in this case as it sits in front of the ALB. It is always better to protect as close to the edge as possible.

INCORRECT: "Create an AWS WAF web ACL, configure a default action and rule, and specify the Auto Scaling group that WAF should inspect" is incorrect.

The web ACL must be attached to the CloudFront distribution, not the ASG.

References:

https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html

https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 5Skipped

A financial organization is already utilizing a CI/CD pipeline to deploy applications in production. A DevOps team has automated the entire upgrade flow for a database upgrade process.

During deployment, they triggered a CI/CD pipeline with no human intervention, and the upgrade progressed smoothly. Then, 20 minutes in, the pipeline became stuck, and the update halted. It was discovered that a planned outage in an AWS region caused the pipeline to fail.

What solution can a DevOps engineer implement to prevent this from happening again without causing unnecessary delay or cost?

Utilize an additional instance of database and apply upgrades on passive database. When the upgrade is complete, route traffic to the passive database and perform a switch between database instances.

Create an AWS CodePipeline pipeline stage to retrigger the pipeline and rerun the CI/CD process.

Correct answer

Embed AWS Health API insights into the CI/CD pipelines using AWS Lambda functions to automatically stop deployments when an AWS Health event is reported in the Region.

Schedule all database upgrades to avoid any planned outages from AWS in the relevant AWS Regions.

Overall explanation

In AWS CodePipeline, you can create a new stage with a single action to asynchronously invoke a Lambda function. The function will call AWS Health DescribeEvents API to retrieve the list of active health incidents. Then, the function will complete the event analysis and decide whether it may impact the running deployment.

Finally, the function will call back CodePipeline with the evaluation results through either PutJobSuccessResult or PutJobFailureResult API operations.

CORRECT: "Embed AWS Health API insights into the CI/CD pipelines using AWS Lambda functions to automatically stop deployments when an AWS Health event is reported in the Region" is the correct answer (as explained above.)

INCORRECT: "Create an AWS CodePipeline pipeline stage to retrigger the pipeline and rerun the CI/CD process" is incorrect.

The issue with this option is that in case AWS health event is still there, the deployment might fail again.

INCORRECT: "Schedule all database upgrades to avoid any planned outages from AWS in the relevant AWS Regions" is incorrect.

This is a manual step which will work but can unnecessarily delay the upgrade in case of business critical/ compliance upgrades.

INCORRECT: "Utilize an additional instance of database and apply upgrades on passive database. When the upgrade is complete, route traffic to the passive database and perform a switch between database instances" is incorrect.

This is a high-cost option and above explained scenario is a better suited one.

References:

https://aws.amazon.com/blogs/devops/build-health-aware-ci-cd-pipelines/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-developer-tools/

Domain

AWS Developer Tools

Question 6Skipped

A DevOps engineer is troubleshooting problems with an application which uses AWS Lambda to process messages in an Amazon SQS standard queue. The function sometimes fails to process the messages in the queue. The engineer needs to analyze the events to determine the cause of the issue and update the function code.

Which action should the engineer take to achieve this outcome?

Enable long-polling by increasing WaitTimeSeconds parameter.

Configure a delay queue by increasing the DelaySeconds parameter.

Enable FIFO support for the queue to preserve ordering of the messages.

Correct answer

Configure a redrive policy to move the messages to a dead-letter queue.

Overall explanation

You can configure a dead-letter queue (DLQ) by specifying a redrive policy on the SQS queue. Dead-letter queues are useful for debugging your application or messaging system because they let you isolate unconsumed messages to determine why their processing doesn't succeed.

CORRECT: "Configure a redrive policy to move the messages to a dead-letter queue" is the correct answer (as explained above.)

INCORRECT: "Enable FIFO support for the queue to preserve ordering of the messages" is incorrect.

You cannot enable FIFO on a standard queue, and it does not help with this issue anyway.

INCORRECT: "Enable long-polling by increasing WaitTimeSeconds parameter" is incorrect.

Long polling just helps with efficiency of API calls as it waits for messages to appear in the queue rather than returning an immediate response. This does not assist with isolating messages for analysis.

INCORRECT: "Configure a delay queue by increasing the DelaySeconds parameter" is incorrect.

A delay queue simply delays visibility of the messages for a specified time. This does not assist with this issue.

References:

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 7Skipped

A company manages several AWS accounts in an AWS Organizations organization. There are several applications running in each account. Many resources have not been tagged properly and the finance team cannot fully determine the costs that should be attributed to each application.

A DevOps engineer has been asked to remediate this issue and ensure it does not happen again.

Which combination of actions should the DevOps engineer take to meet these requirements? (Select TWO.)

Correct selection

Create and attach an SCP that requires tags to be specified when creating resources.

Use the budget report to find untagged resources. Assign tags to the resources.

Define each application in AWS Budgets. Assign the required tag to each resource.

Activate the user-defined cost allocation tags in each AWS account.

Correct selection

Scan all accounts with Tag Editor. Assign the required tag to each resource.

Overall explanation

You can use service control policies (SCPs) to require that tags are specified when creating resources. If the appropriate tags are not specified the resource creation fails. This will prevent the issue of resources not being properly tagged from occurring again in the future.

To resolve the issue now, the DevOps engineer can use Tag Editor to scan resources looking for those that are missing the appropriate tags. The resources can then be tagged.

CORRECT: "Create and attach an SCP that requires tags to be specified when creating resources" is a correct answer (as explained above.)

CORRECT: "Scan all accounts with Tag Editor. Assign the required tag to each resource" is also a correct answer (as explained above.)

INCORRECT: "Activate the user-defined cost allocation tags in each AWS account" is incorrect.

We can assume that this has already been done. The question does not state that we need to enable cost allocation tagging. The context infers that this has already been done and the issue is simply that tagging has not been performed properly on some resources.

INCORRECT: "Define each application in AWS Budgets. Assign the required tag to each resource" is incorrect.

You cannot define application in AWS Budgets or add tags to resources.

INCORRECT: "Use the budget report to find untagged resources. Assign tags to the resources" is incorrect.

The Tag Editor should be used to find untagged resources and then add tags to them.

References:

https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 8Skipped

A company is migrating an important production application to the AWS Cloud. The application includes a containerized web tier and a MySQL database. The application must be deployed with high availability and fault tolerance and must minimize cost.

How should a DevOps engineer refactor the application? (Select TWO.)

Correct selection

Migrate the MySQL database to an Amazon RDS Multi-AZ deployment.

Migrate the MySQL database to an Amazon DynamoDB with Global Tables.

Migrate the MySQL database to an Amazon RDS instance with a Read Replica in another AZ.

Correct selection

Migrate the web tier to an AWS Fargate cluster and configure a service and attach an Application Load Balancer.

Migrate the web tier to an Auto Scaling group of EC2 instances across multiple AZs and use an Application Load Balancer.

Overall explanation

AWS Fargate is a managed and serverless service for running Docker containers. It is part of the Amazon ECS family of AWS services and supports multiple availability zones for all deployments. To attach a load balancer you must create a service and you can define the desired count of ECS tasks to run.

The database tier of the application can be deployed on a highly available Amazon RDS database that has a multi-AZ replica. This provides fault tolerance across multiple AZs.

CORRECT: "Migrate the web tier to an AWS Fargate cluster and configure a service and attach an Application Load Balancer" is a correct answer (as explained above.)

CORRECT: "Migrate the MySQL database to an Amazon RDS Multi-AZ deployment" is also a correct answer (as explained above.)

INCORRECT: "Migrate the web tier to an Auto Scaling group of EC2 instances across multiple AZs and use an Application Load Balancer" is incorrect.

EC2 is not the most cost-effective platform for this solution as the application is already containerized and therefore should run on Amazon ECS for best performance and cost efficiency.

INCORRECT: "Migrate the MySQL database to an Amazon RDS instance with a Read Replica in another AZ" is incorrect.

A Read replica in another AZ can be used as an asynchronous backup target but the promotion time can be quite long in a failure scenario. A multi-AZ instance allows fast failover.

INCORRECT: "Migrate the MySQL database to an Amazon DynamoDB with Global Tables" is incorrect.

DynamoDB is a NoSQL database, so it is not suitable for migrating MySQL which is a relational database.

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-load-balancing.html

https://aws.amazon.com/rds/features/multi-az/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

https://digitalcloud.training/amazon-rds/

Domain

AWS Compute

Question 9Skipped

A DevOps engineer is creating a pipeline in AWS CodePipeline for automation of a testing process. The engineer wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:

Which type of events will match this event pattern?

Failed stage execution events for the executed stage.

Failed deploy and build actions across all the pipelines.

All abandoned or cancelled approval actions across all pipelines.

Correct answer

All rejected or failed approval actions across all the pipelines.

Overall explanation

You can monitor CodePipeline events in EventBridge, which delivers a stream of real-time data from your own applications, software-as-a-service (SaaS) applications, and AWS services. EventBridge routes that data to targets such as AWS Lambda and Amazon Simple Notification Service.

Events are composed of rules. A rule is configured by choosing the following:

Event Pattern. Each rule is expressed as an event pattern with the source and type of events to monitor, and event targets. To monitor events, you create a rule with the service you are monitoring as the event source, such as CodePipeline. For example, you can create a rule with an event pattern that that uses CodePipeline as an event source to trigger the rule when there are changes in the state of a pipeline, stage, or action.

Targets. The new rule receives a selected service as the event target. You might want to set up a target service to send notifications, capture state information, take corrective action, initiate events, or take other actions. When you add your target, you must also grant permissions to Amazon CloudWatch Events to allow it to invoke the selected target service.

For approval actions, the FAILED state means the action was either rejected by the reviewer or failed due to an incorrect action configuration.

CORRECT: "All rejected or failed approval actions across all the pipelines" is the correct answer (as explained above.)

INCORRECT: "Failed stage execution events for the executed stage" is incorrect.

The specified pattern applies to a CodePipeline Action Execution State Change rather than a CodePipeline Stage Execution State Change.

INCORRECT: "Failed deploy and build actions across all the pipelines" is incorrect.

The specified pattern applies to rejected or failed approval actions only.

INCORRECT: "All abandoned or cancelled approval actions across all pipelines" is incorrect.

The specified pattern applies to rejected or failed approval actions only.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/detect-state-changes-cloudwatch-events.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 10Skipped

A web application runs on a custom port. The application has been deployed in an Auto Scaling group with an Application Load Balancer (ALB). After launching instances the Auto Scaling and Target Group health checks are returning a healthy status. However, users report that the application is not accessible.

Which steps should a DevOps engineer take to troubleshoot the issue? (Select TWO.)

Create a path-based routing rule to direct traffic to the custom port and path on the EC2 instances.

Correct selection

Modify the Auto Scaling group health check configuration to check the application process on the custom port and path.

Inspect the listener configuration on the ALB and check it is configured with the TCP protocol and the custom port.

Modify the Target Group configuration to specify targets by IP rather than instance ID to allow routing to any private IP address.

Correct selection

Modify the Target Group health check configuration to check the application process on the custom port and path.

Overall explanation

By default health checks are configured to use the HTTP protocol and port 80. For an ALB the traffic protocol must be HTTP or HTTPS, but the port can be customized. The most likely cause of the issue is that the web service is running on the instances and the default protocol/port is used for health checks on the ALB and ASG. This will result in instances becoming “healthy” despite the actual application service not functioning correctly.

The engineer should check the ASG health check configuration and the target group health check configuration. If the default values are used then the correct custom port number should be entered instead. The path may also be updated if a specific web page should be checked.

The image below shows how you can override the default port number and path in a target group health check:

CORRECT: "Modify the Target Group health check configuration to check the application process on the custom port and path" is a correct answer (as explained above.)

CORRECT: "Modify the Auto Scaling group health check configuration to check the application process on the custom port and path" is also a correct answer (as explained above.)

INCORRECT: "Inspect the listener configuration on the ALB and check it is configured with the TCP protocol and the custom port" is incorrect.

You cannot use a TCP listener with an ALB. It must be HTTP or HTTPS though a custom port number can certainly be used.

INCORRECT: "Modify the Target Group configuration to specify targets by IP rather than instance ID to allow routing to any private IP address" is incorrect.

The issue is not related to the IP addresses traffic is being directed to on the instances; it is related to the port number and path the health checks are configured to check.

INCORRECT: "Create a path-based routing rule to direct traffic to the custom port and path on the EC2 instances" is incorrect.

Path-based routing rules are used to route traffic to different target groups based on the path in the HTTP request. In this case there is only one target group, so a path-based routing rule is useless. Instead, the ALB must direct traffic to a custom port number (configured in the listener) and validate the application is healthy be running health checks against the appropriate port and path.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Compute

Question 11Skipped

A DevOps Engineer must deploy a three-tier web application on AWS. The application will run on Amazon EC2 instances and will use an Amazon RDS database tier. The engineer must select a deployment model the reduces operational overhead as much as possible.

Which solution best meets these requirements?

Use AWS CloudFormation to create an Application Load Balancer, an Auto Scaling group and database resources. Deploy application updates using CloudFormation rolling updates.

Correct answer

Use AWS OpsWorks to create an Application Load Balancer, an Auto Scaling group, and application and database resources. Deploy application updates using OpsWorks lifecycle events.

Use AWS CloudFormation to create an Application Load Balancer and an Auto Scaling group. Use AWS OpsWorks to create the application and database resources. Deploy application updates with OpsWorks using lifecycle events.

Use AWS OpsWorks to create an Application Load Balancer, an Auto Scaling group, and application resources. Use AWS CloudFormation to create the database resources. Deploy application updates using CloudFormation rolling updates.

Overall explanation

AWS OpsWorks Stacks provides a simple and flexible way to create and manage stacks and applications. Using layers, the various components of the three-tier application can be deployed, updated, and managed.

OpsWorks can handle deployment of all resources including application code. Lifecycle events can be used to manage updates to application code and changes to infrastructure.

The diagram below depicts an OpsWorks stack that includes three layers representing each tier of the application:

CORRECT: "Use AWS OpsWorks to create an Application Load Balancer, an Auto Scaling group, and application and database resources. Deploy application updates using OpsWorks lifecycle events" is the correct answer (as explained above.)

INCORRECT: "Use AWS CloudFormation to create an Application Load Balancer and an Auto Scaling group. Use AWS OpsWorks to create the application and database resources. Deploy application updates with OpsWorks using lifecycle events" is incorrect.

It would be better to use OpsWorks for all components of the application and infrastructure deployment and management as it will reduce operational overhead.

INCORRECT: "Use AWS OpsWorks to create an Application Load Balancer, an Auto Scaling group, and application resources. Use AWS CloudFormation to create the database resources. Deploy application updates using CloudFormation rolling updates" is incorrect.

As with the previous answer, it is better to use OpsWorks to manage the stack. Also, CloudFormation is well suited to deploying infrastructure but is not as good at deploying application code.

INCORRECT: "Use AWS CloudFormation to create an Application Load Balancer, an Auto Scaling group and database resources. Deploy application updates using CloudFormation rolling updates" is incorrect.

CloudFormation is an infrastructure as code tool that deploys AWS infrastructure extremely well. However, it is not the best tool to use for deploying application updates. OpsWorks should be used in this scenario as it offers a better solution for reducing overall operational overhead whilst fully meeting the requirements of the solution.

References:

https://docs.aws.amazon.com/opsworks/latest/userguide/welcome_classic.html

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/aws-opsworks/

Domain

AWS Management & Governance

Question 12Skipped

A company is using AWS Storage Gateway for a branch office location. The gateway is configured in file gateway mode in front of an Amazon S3 bucket that contains files that must be processed by workers in the branch office. Each night a batch process uploads many files to the S3 bucket. Users have reported that the new files are not visible in the morning though they do exist in the S3 bucket.

How can a DevOps engineer ensure that the files become visible?

Correct answer

Configure an Amazon EventBridge event to run on a schedule and trigger an AWS Lambda functions that executes the RefreshCache command.

Configure the batch process to upload files to the S3 bucket using Amazon S3 transfer acceleration.

Use S3 same-Region replication to replicate any changes made directly in the S3 bucket to Storage Gateway.

Configure the Storage Gateway to run in cached Volume Gateway mode and use S3 event notifications to update the storage gateway when objects are uploaded.

Overall explanation

In file gateway mode the users and applications in the branch office can access the storage using either NFS or SMB protocols. The new objects in the bucket may sometimes not be visible. The RefreshCache operation refreshes the cached inventory of objects for the specified file share. This operation finds objects in the Amazon S3 bucket that were added, removed, or replaced since the gateway last listed the bucket's contents and cached the results.

CORRECT: "Configure an Amazon EventBridge event to run on a schedule and trigger an AWS Lambda functions that executes the RefreshCache command" is the correct answer (as explained above.)

INCORRECT: "Configure the Storage Gateway to run in cached Volume Gateway mode and use S3 event notifications to update the storage gateway when objects are uploaded" is incorrect.

Volume Gateway mode uses block storage targets (iSCSI) rather than file storage targets (NFS/SMB) and would therefore be a major change to the architecture. Event notifications cannot be used to refresh the cache in a storage gateway.

INCORRECT: "Use S3 same-Region replication to replicate any changes made directly in the S3 bucket to Storage Gateway" is incorrect. S3 replication cannot be used to replicate to storage gateway.

INCORRECT: "Configure the batch process to upload files to the S3 bucket using Amazon S3 transfer acceleration" is incorrect. Transfer acceleration is used to improve upload speeds and does not assist at all in this situation.

References:

https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RefreshCache.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-storage-gateway/

Domain

AWS Storage

Question 13Skipped

A DevOps engineer needs to implement an automated deployment process for an application running on AWS. The implementation should minimize deployment costs whilst ensuring that at least half of the instances are available at any time to service user requests. If the application fails on some instances they should be automatically replaced.

Which deployment strategy will meet these requirements?

Create an AWS OpsWorks stack. Configure the application layer to use rolling deployments as a deployment strategy. Add an Elastic Load Balancing layer. Enable auto healing on the application layer.

Create an AWS Elastic Beanstalk environment and configure it to use Auto Scaling and an Elastic Load Balancer. Use a rolling deployment strategy and configure a batch size of 50%.

Implement Auto Scaling with an Elastic Load Balancer. Use AWS CodeDeploy with a blue/green deployment strategy. Enable an ELB health check and set the Auto Scaling health check to ELB.

Correct answer

Implement Auto Scaling with an Elastic Load Balancer. Use AWS CodeDeploy with the CodeDeployDefault.HalfAtAtime deployment strategy. Enable an ELB health check and set the Auto Scaling health check to ELB.

Overall explanation

With a CodeDeploy ‘CodeDeployDefault.HalfAtAtime’ deployment strategy, half of the instances will be updated at a time. The overall deployment succeeds if the application revision is deployed to at least half of the instances. Otherwise, the deployment fails.

Configuring an ELB health check and updating the ASG to use this health check ensures that the ALB can take the instances that fail out of service. If you do not enable ELB health checks on the ASG it will not know when the target group health checks have failed.

CORRECT: "Implement Auto Scaling with an Elastic Load Balancer. Use AWS CodeDeploy with the CodeDeployDefault.HalfAtAtime deployment strategy. Enable an ELB health check and set the Auto Scaling health check to ELB" is the correct answer (as explained above.)

INCORRECT: "Create an AWS Elastic Beanstalk environment and configure it to use Auto Scaling and an Elastic Load Balancer. Use a rolling deployment strategy and configure a batch size of 50%" is incorrect.

There are no health checks configured for the target group with this answer so if the application fails the ASG may not replace the instances. This is a key requirement that has been missed with this configuration.

INCORRECT: "Create an AWS OpsWorks stack. Configure the application layer to use rolling deployments as a deployment strategy. Add an Elastic Load Balancing layer. Enable auto healing on the application layer" is incorrect.

Auto healing with OpsWorks only checks the instance health, it does not check the application health so this will not detect if the application has failed.

INCORRECT: "Implement Auto Scaling with an Elastic Load Balancer. Use AWS CodeDeploy with a blue/green deployment strategy. Enable an ELB health check and set the Auto Scaling health check to ELB" is incorrect.

This is a more expensive option as a full additional deployment will be running alongside the existing deployment (doubling the number of instances) during the rollout.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 14Skipped

A company is deploying an application in four AWS Regions across North America, Europe and Asia. The application will be used by millions of users. The application must allow users to submit data through the application layer in each Region and have it saved in a low-latency database layer. The company also must ensure that the data can be read through the application layer in each Region.

Which solution will meet these requirements with the LOWEST latency of reads and writes?

Create an Amazon RDS database in one Region and create Read Replicas in each of the three other Regions.

Correct answer

Create a table in Amazon DynamoDB and enable global tables in each of the four Regions.

Create an Amazon ElastiCache for Redis cluster and configure replication groups in each of the four Regions.

Create a database in Amazon DocumentDB (with MongoDB compatibility) in each of the four Regions.

Overall explanation

Global tables build on the global Amazon DynamoDB footprint to provide you with a fully managed, multi-Region, and multi-active database that delivers fast, local, read and write performance for massively scaled, global applications. Global tables replicate your DynamoDB tables automatically across your choice of AWS Regions.

This is the only workable solution in the list that provides both reads and writes in each Region that are replicated across the other Regions. This is also the best solution as it provides low latency reads and writes.

CORRECT: "Create a table in Amazon DynamoDB and enable global tables in each of the four Regions" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon RDS database in one Region and create Read Replicas in each of the three other Regions" is incorrect.

This solutions does not provide local writes in each Region as the Read Replicas cannot be written to. Therefore, this solution only offers low latency reads in each Region.

INCORRECT: "Create an Amazon ElastiCache for Redis cluster and configure replication groups in each of the four Regions" is incorrect.

Replication groups in ElastiCache are used within a Region and not across Regions so this solution does not work.

INCORRECT: "Create a database in Amazon DocumentDB (with MongoDB compatibility) in each of the four Regions" is incorrect.

This solution provides a database in each Region, there is no mechanism for replication. You can create replica instances in different Regions but that would only provide low latency reads (as with RDS), and not low latency writes.

References:

https://aws.amazon.com/dynamodb/global-tables/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-dynamodb/

Domain

AWS Database

Question 15Skipped

A global health care company uses AWS CloudFormation templates to deploy applications across various environments. The template includes Amazon EC2 instances and an Amazon RDS database. During the testing phase before the application went live, the Amazon RDS instance type was changed and caused the instance to be re-created, resulting in the loss of test data. Also, when the CloudFormation stacks are deleted, it is mandatory to keep a snapshot of the EBS volumes for backup and compliance purposes.

How can this be achieved? (Select TWO.)

Correct selection

Use DeletionPolicy=Snapshot to persist the EBS volumes attached to Amazon EC2 instances.

Correct selection

In the AWS CloudFormation template, set the DeletionPolicy of the AWS::RDS::DBInstance DeletionPolicy property to “Retain.”

In the AWS CloudFormation template, set the AWS::RDS::DBInstance DBlnstanceClass property to be read-only.

Use an AWS CloudFormation stack policy to deny updates to the instance. Only allow UpdateStack permission to IAM principals that are denied SetStackPolicy.

Enable termination protection for the Amazon EC2 instances and the Amazon RDS database.

Overall explanation

To control how AWS CloudFormation handles the EBS volume when the stack is deleted, set a deletion policy for the volume. It could be deleted, retained, or stored as a snapshot.

CloudFormation keeps the resource without deleting the resource or its contents when the resource is replaced. This policy could be added to any resource type. Resources that are retained continue to exist and continue to incur applicable charges until the resources are deleted.

CORRECT: "Use DeletionPolicy=Snapshot to persist the EBS volumes attached to Amazon EC2 instances" is a correct answer (as explained above.)

CORRECT: "In the AWS CloudFormation template, set the DeletionPolicy of the AWS::RDS::DBInstance DeletionPolicy property to “Retain.”" is also a correct answer (as explained above.)

INCORRECT: "Enable termination protection for the Amazon EC2 instances and the Amazon RDS database" is incorrect.

With AWS CloudFormation stacks the template should be updated to configure retention of resources and persistence of snapshots. This will achieve the required outcome.

INCORRECT: "Use an AWS CloudFormation stack policy to deny updates to the instance. Only allow UpdateStack permission to IAM principals that are denied SetStackPolicy" is incorrect.

Using permissions will complicate the stack creation and update process and may introduce issues. It is better to use the techniques in the correct answers instead.

INCORRECT: "In the AWS CloudFormation template, set the AWS::RDS::DBInstance DBlnstanceClass property to be read-only" is incorrect.

The solution should not prevent the instance type from being changed as that may be a legitimate requirement. It should instead ensure that the database is not lost, and the snapshots are not deleted.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-ebs-volume.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudformation/

Domain

AWS Management & Governance

Question 16Skipped

A DevOps engineer is troubleshooting an issue with an AWS CodeDeploy deployment to a deployment group containing Amazon EC2 instances. The engineer noticed that all events associated with the specific deployment ID are in a Skipped status, and code was not deployed in the instances associated with the deployment group.

Which of the following as possible reasons for this failure? (Select TWO.)

The target EC2 instances were not properly registered with the CodeDeploy endpoint.

Correct selection

The EC2 instances cannot reach the internet or CodeDeploy public endpoints using a NAT gateway or internet gateway.

The EC2 instances were deployed using instance store volumes rather than EBS volumes.

Correct selection

The target EC2 instances do not have an instance profile attached that provides the required permissions.

The IAM user who initiated the deployment does not have the required permissions to interact with CodeDeploy.

Overall explanation

There are several reasons why the deployment may show a Skipped status for all events. These include the networking configuration of the instances not being correctly setup to include a path to a NAT gateway or internet gateway. This is required for internet access and to connect to the CodeDeploy public endpoints.

Another possible cause of this issue is that the EC2 instances do not have an instance profile attached that uses an IAM policy to assign the required permissions for the application deployment.

CORRECT: "The EC2 instances cannot reach the internet or CodeDeploy public endpoints using a NAT gateway or internet gateway" is a correct answer (as explained above.)

CORRECT: "The target EC2 instances do not have an instance profile attached that provides the required permissions" is also a correct answer (as explained above.)

INCORRECT: "The IAM user who initiated the deployment does not have the required permissions to interact with CodeDeploy" is incorrect.

The deployment uses a service role rather than the IAM user permissions.

INCORRECT: The target EC2 instances were not properly registered with the CodeDeploy endpoint" is incorrect.

An agent must be installed, and the instances must have the required permissions for CodeDeploy. However, they do not need to be registered.

INCORRECT: "The EC2 instances were deployed using instance store volumes rather than EBS volumes" is incorrect.

There is no requirement to use EBS volumes over instance store volumes.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/troubleshooting-deployments.html#troubleshooting-skipped-lifecycle-events

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 17Skipped

A DevOps Engineer manages an application running across accounts which is deployed via AWS CloudFormation.

The application stack has an Amazon ECS Fargate cluster which spins up multiple tasks for the application layer and utilizes an Amazon ElastiCache Redis cache to store frequently accessed data.

The accounts are labelled “sandbox” and “staging”. While the stack spins up fine, the application is unable to connect to Redis with the below error logged in Amazon CloudWatch Logs.

“Stopped reason ResourceInitializationError: unable to pull secrets or registry auth: pull command failed :: signal: killed“.

What is the possible fix for the above error? (Select TWO.)

Ensure that the IAM role provides the required permissions.

Correct selection

Ensure an ENI is configured for the ECS tasks in the AWS Fargate cluster and there is an api.ecr endpoint.

Ensure that the application security group has a rule that accepts connections from 0.0.0.0/0.

Correct selection

Ensure inbound connectivity is allowed in the application security group on port 6379 from the Redis cluster subnet.

Ensure the ECS tasks are launched in a public subnet and public IP addresses are assigned to them.

Overall explanation

AWS Fargate clusters with the 1.4 version upgrade provides ENI at the task level. Below is AWS documentation for the same:

Fargate tasks run on a fleet of virtual machines that AWS manages on behalf of the customer. These VMs are connected to AWS owned VPCs via so called “Fargate ENIs”. When a user launches a task on Fargate, the task is assigned an ENI and this ENI is connected to the customer owned VPC

CORRECT: "Ensure inbound connectivity is allowed in the application security group on port 6379 from the Redis cluster subnet" is a correct answer (as explained above).

CORRECT: "Ensure an ENI is configured for the ECS tasks in the AWS Fargate cluster and there is an api.ecr endpoint" is also a correct answer.

INCORRECT: "Ensure the ECS tasks are launched in a public subnet and public IP addresses are assigned to them" is incorrect since your tasks can sit in a private subnet as well.

INCORRECT: "Ensure that the IAM role provides the required permissions" is incorrect since question is more around connectivity and stack worked fine in one of the environments.

INCORRECT: "Ensure that the application security group has a rule that accepts connections from 0.0.0.0/0" is incorrect.

References:

AWS Fargate launches platform version 1.4.0 | Containers (amazon.com)

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 18Skipped

A DevOps engineer has created a CI/CD pipeline in which AWS CodeDeploy is used to deploy an AWS Lambda function as the last stage of the pipeline. For proper execution, the Lambda function relies on an Amazon API Gateway API to have been fully deployed and ready to accept requests.

The DevOps engineer needs to ensure that the API is ready to accept requests before traffic is shifted to the deployed Lambda function version.

How can this requirement be met?

Use the ValidateService hook in the AppSpec file to check that the deployment was completed successfully before shifting traffic to the deployed Lambda function.

Use the AfterAllowTraffic hook in the AppSpec file to call a validation function that checks that the API is ready to accept requests.

Use the AfterInstall hook in the buildspec file to call AWS CodeBuild and run test commands to check that the API’s production stage endpoint is reachable.

Correct answer

Use the BeforeAllowTraffic hook in the AppSpec file to call a validation function that checks that the API is ready to accept requests.

Overall explanation

An AWS Lambda hook is one Lambda function specified with a string on a new line after the name of the lifecycle event. Each hook is executed once per deployment. Here are descriptions of the hooks available for use in your AppSpec file.

BeforeAllowTraffic – Use to run tasks before traffic is shifted to the deployed Lambda function version.

AfterAllowTraffic – Use to run tasks after all traffic is shifted to the deployed Lambda function version.

In a serverless Lambda function version deployment, event hooks run in the following order: BeforeAllowTraffic > AllowTraffic > AfterAllowTraffic.

Use the 'hooks' section to specify a Lambda function that CodeDeploy can call to validate a Lambda deployment. You can use the same function or a different one for the BeforeAllowTraffic and AfterAllowTraffic deployment lifecyle events. Following completion of the validation tests, the Lambda validation function calls back CodeDeploy and delivers a result of Succeeded or Failed.

CORRECT: "Use the BeforeAllowTraffic hook in the AppSpec file to call a validation function that checks that the API is ready to accept requests" is the correct answer (as explained above.)

INCORRECT: "Use the AfterAllowTraffic hook in the AppSpec file to call a validation function that checks that the API is ready to accept requests" is incorrect.

This hook is run after traffic is shifted to the Lambda function, so it doesn’t offer any value here.

INCORRECT: "Use the ValidateService hook in the AppSpec file to check that the deployment was completed successfully before shifting traffic to the deployed Lambda function" is incorrect.

The ValidateService is the last deployment lifecycle event. It is used to verify the deployment was completed successfully. At that point traffic has already been shifted.

INCORRECT: "Use the AfterInstall hook in the buildspec file to call AWS CodeBuild and run test commands to check that the API’s production stage endpoint is reachable" is incorrect.

CodeDeploy is being used as the last stage of the pipeline so any build commands would have already been completed at this point.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-lambda

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 19Skipped

An application was recently migrated to AWS. While the initial version worked, a new version is displaying an error relating to the database layer.

A DevOps engineer checked Amazon CloudWatch Logs and determined that the error was due to a database connection issue. However, no new database deployment has been performed and there were no changes to the database. Typically the application fetches the database credentials from AWS Secrets Manager.

What is the most likely cause of the issue?

The secretsmanager:DescribeSecret permission is not enabled for the client-side application component and so it is unable to retrieve the database password.

Correct answer

When secret rotation is configured in Secrets Manager, it causes the secret to rotate once as soon as you store the secret. This can lead to a situation where the old credentials are not usable anymore after the initial rotation. It is possible that the team forgot to update the application to retrieve the secret from Secrets Manager.

The GetSecretValue API call in the application didn't include the version of the secret to return.

The DB credentials and connection details in Secrets Manager have been encrypted using the default Secrets Manager KMS key for the account. The application and secret are in different AWS accounts though, and no cross-account access has been granted.

Overall explanation

AWS Secrets manager is the preferred option to store database credentials rather than the application code base since Secrets Manager gives many options to manage, rotate and retrieve secrets out of the box. This is more secure as this information is not embedded in the application code.

CORRECT: "When secret rotation is configured in Secrets Manager, it causes the secret to rotate once as soon as you store the secret. This can lead to a situation where the old credentials are not usable anymore after the initial rotation. It is possible that the team forgot to update the application to retrieve the secret from Secrets Manager" is the correct answer (as explained above.)

INCORRECT: "The DB credentials and connection details in Secrets Manager have been encrypted using the default Secrets Manager CMK for the account. The application and secret are in different AWS accounts though, and no cross-account access has been granted" is incorrect.

As the account is the same and it is a subsequent deployment post initial version, this is unlikely to be the correct explanation.

INCORRECT: "The secretsmanager:DescribeSecret permission is not enabled for the client-side application component and so it is unable to retrieve the database password" is incorrect.

Since permissions were not changed, this is not a correct explanation of the issue.

INCORRECT: "The GetSecretValue API call in the application didn't include the version of the secret to return" is incorrect.

This is also a possible failure when there are multiple versions to a secret and you are fetching the incorrect version of secret but in this scenario, this is not the cause of the issue.

References:

https://awscloudsecvirtualevent.com/workshops/module4/rds/

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html

https://docs.amazonaws.cn/en_us/secretsmanager/latest/userguide/cfn-example_reference-secret.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-secrets-manager/

Domain

AWS Security, Identity, & Compliance

Question 20Skipped

A legacy application runs on a single Amazon EC2 instance and is backed with Amazon EBS storage. The company requires the ability to recover quickly with minimal data losses in the event of network connectivity issues or power failures on the EC2 instance.

Which solution will meet these requirements?

Create an Amazon EC2 Auto Scaling group and configure the minimum, maximum, and desired capacity to 1.

Correct answer

Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric and select the EC2 action to recover the instance.

Create a spread placement group configured across distinct underlying hardware. Enable automatic recovery.

Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric and select the EC2 action to reboot the instance.

Overall explanation

You can create an Amazon CloudWatch alarm that monitors an Amazon EC2 instance and automatically recovers the instance if it becomes impaired due to an underlying hardware failure or a problem that requires AWS involvement to repair.

The alarm uses the StatusCheckFailed_System metric and can be configured to initiate a recover action. When this occurs you will be notified by the Amazon SNS topic you configured when creating the alarm.

During instance recovery, the instance is migrated during an instance reboot, and any data that is in-memory is lost.

Examples of problems that cause system status checks to fail include:

Loss of network connectivity

Loss of system power

Software issues on the physical host

Hardware issues on the physical host that impact network reachability

CORRECT: "Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric and select the EC2 action to recover the instance" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric and select the EC2 action to reboot the instance" is incorrect.

This metric indicates issues that involve your involvement to repair. The StatusCheckFailed_System metric should be used instead to identify issues with the underlying hardware or network.

INCORRECT: "Create an Amazon EC2 Auto Scaling group and configure the minimum, maximum, and desired capacity to 1" is incorrect.

Auto Scaling groups use health checks to identify if the instance is functioning. The StatusCheckFailed_System metric is more useful in this scenario as it can identify several issues that may affect the instance including hardware issues on the physical host that impact network reachability (an instance health check won’t do this).

INCORRECT: "Create a spread placement group configured across distinct underlying hardware. Enable automatic recovery" is incorrect.

Spread placement groups are used when you have more than one instance and want to spread the instances across distinct underlying hardware. In this case there is only one instance, so it is of no benefit.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/UsingAlarmActions.html#AddingRecoverActions

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Management & Governance

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries