AWS DevOps Container Services 3 — Questions and Answers
Question 1: Which ECR feature can automatically delete untagged images older than 30 days to control storage costs?
- ECR image scanning
- ECR replication rules
- ECR lifecycle policies (Correct answer)
- ECR tag immutability
Correct answer: ECR lifecycle policies
ECR lifecycle policies define rules that automatically expire and delete images based on age, tag status, or image count thresholds.
Question 2: In an ECS blue/green deployment via CodeDeploy, what does the 'test listener' port allow you to do before traffic shifts?
- Run automated smoke tests against the green environment before routing production traffic (Correct answer)
- Encrypt inter-container communication
- Register new EC2 instances into the load balancer
- Monitor CloudWatch logs from the blue environment
Correct answer: Run automated smoke tests against the green environment before routing production traffic
The test listener routes a portion of traffic (or test tools) to the green task set so you can validate the new version before full cutover.
Question 3: Which kubectl command would a DevOps engineer use to perform a rolling update of a container image in an EKS Deployment?
- kubectl scale deployment myapp --replicas=0
- kubectl set image deployment/myapp myapp=myrepo:v2 (Correct answer)
- kubectl delete pod -l app=myapp
- kubectl apply -f configmap.yaml
Correct answer: kubectl set image deployment/myapp myapp=myrepo:v2
kubectl set image updates the container image in the Deployment spec, triggering a rolling update that replaces pods incrementally.
Question 4: What does enabling ECR tag immutability prevent?
- Pushing new images to the repository
- Overwriting an existing image tag with a different image digest (Correct answer)
- Pulling images from a different AWS account
- Deleting images via lifecycle policies
Correct answer: Overwriting an existing image tag with a different image digest
Tag immutability ensures that once an image tag (e.g., 'v1.0') is pushed, subsequent pushes with the same tag are rejected, preventing silent overwrites.
Question 5: A containerized application on ECS needs to access an RDS password stored in AWS Secrets Manager. What is the recommended approach?
- Hard-code the password in the Docker image
- Pass the secret ARN as an environment variable in the task definition referencing Secrets Manager (Correct answer)
- Store the password in an S3 bucket and mount it
- Use EC2 instance metadata to retrieve the secret
Correct answer: Pass the secret ARN as an environment variable in the task definition referencing Secrets Manager
ECS task definitions support native Secrets Manager and SSM Parameter Store integration, injecting secrets as environment variables at task launch without exposing them in code.
Question 6: Which EKS feature lets you run Kubernetes pods on AWS Fargate without managing EC2 worker nodes?
- Managed node groups
- EKS Fargate profiles (Correct answer)
- EKS Anywhere
- Karpenter
Correct answer: EKS Fargate profiles
EKS Fargate profiles define namespaces and label selectors that determine which pods are scheduled on Fargate's serverless infrastructure.
Question 7: In Amazon ECS, which scheduling strategy places one task on each active container instance in a cluster?
- REPLICA
- DAEMON (Correct answer)
- SPOT
- BALANCED
Correct answer: DAEMON
The DAEMON scheduling strategy deploys exactly one task per EC2 instance, useful for monitoring agents or log collectors.
AWS DevOps Container Services 3
Which ECR feature can automatically delete untagged images older than 30 days to control storage costs?