Architecting on AWS Certification Non-Destructive Testing Methods 4 — Questions and Answers
Question 1: A company uses AWS Service Catalog to provision environments. Which practice ensures that test environment stacks are structurally identical to production stacks for valid non-destructive testing?
- Manually provision test environments using the AWS Console
- Use the same Service Catalog product version for both test and production environments (Correct answer)
- Use separate CloudFormation templates maintained by different teams
- Copy AMIs from production and modify them for the test environment
Correct answer: Use the same Service Catalog product version for both test and production environments
Sharing the same Service Catalog product version guarantees that test and production environments are provisioned from identical infrastructure-as-code definitions.
Question 2: Which AWS feature allows you to test IAM permission changes before applying them to live roles or users?
- AWS Config managed rules
- IAM Access Analyzer policy validation and the IAM policy simulator (Correct answer)
- AWS Trusted Advisor security checks
- AWS Security Hub findings
Correct answer: IAM Access Analyzer policy validation and the IAM policy simulator
The IAM policy simulator evaluates existing or proposed policies against specific API actions so you can verify access changes without modifying live policies.
Question 3: A team uses AWS CDK. Which command lets developers see the synthesized CloudFormation template and diff against a deployed stack before any changes are deployed?
- cdk deploy --dry-run
- cdk diff (Correct answer)
- cdk synth --validate
- cdk check
Correct answer: cdk diff
`cdk diff` compares the locally synthesized template with the deployed stack and prints resource-level changes without making any modifications.
Question 4: To test VPC security group rules without sending real traffic, an architect should use:
- AWS Network Firewall rule tester
- VPC Reachability Analyzer to verify logical connectivity between resources (Correct answer)
- AWS Inspector network scan
- AWS Shield attack simulation
Correct answer: VPC Reachability Analyzer to verify logical connectivity between resources
VPC Reachability Analyzer performs a logical analysis of the network path between two endpoints and reports whether traffic would be allowed or blocked, without sending actual packets.
Question 5: Which Elastic Beanstalk deployment policy swaps environment URLs only after the new environment passes health checks, enabling non-destructive testing of new application versions?
- Rolling with additional batch
- All at once
- Immutable
- Blue/Green (URL swap) (Correct answer)
Correct answer: Blue/Green (URL swap)
Elastic Beanstalk blue/green deploys the new version to a cloned environment and only swaps the CNAME after health checks pass, leaving the old environment intact for rollback.
Question 6: An architect wants to validate that an S3 bucket policy change won't accidentally deny access to an existing application. Which tool provides this pre-deployment check?
- S3 Object Lock legal hold
- IAM Access Analyzer to analyze the updated resource policy for unintended access changes (Correct answer)
- S3 Inventory report
- AWS Macie sensitive data scan
Correct answer: IAM Access Analyzer to analyze the updated resource policy for unintended access changes
IAM Access Analyzer evaluates S3 bucket policies and highlights whether a policy change would grant or revoke access relative to the current state.
Question 7: Which approach lets you test a new ECS task definition revision without stopping the currently running tasks?
- Update the ECS service to replace all tasks immediately
- Run a standalone ECS task using the new task definition revision and validate it independently (Correct answer)
- Modify the running containers in-place using ECS exec
- Stop the ECS service, deploy the new revision, and restart
Correct answer: Run a standalone ECS task using the new task definition revision and validate it independently
Running a standalone task with the new revision lets you test it in the same cluster environment without touching the service's running tasks.
Architecting on AWS Certification Non-Destructive Testing Methods 4
A company uses AWS Service Catalog to provision environments.
Which practice ensures that test environment stacks are structurally identical to production stacks for valid non-destructive testing?