AWS DevOps Container Services 3

Question 1

Which ECR feature can automatically delete untagged images older than 30 days to control storage costs?

Accepted Answer

ECR lifecycle policies

Answer

ECR lifecycle policies define rules that automatically expire and delete images based on age, tag status, or image count thresholds.

Question 2

In an ECS blue/green deployment via CodeDeploy, what does the 'test listener' port allow you to do before traffic shifts?

Accepted Answer

Run automated smoke tests against the green environment before routing production traffic

Answer

The test listener routes a portion of traffic (or test tools) to the green task set so you can validate the new version before full cutover.

Question 3

Which kubectl command would a DevOps engineer use to perform a rolling update of a container image in an EKS Deployment?

Accepted Answer

kubectl set image deployment/myapp myapp=myrepo:v2

Answer

kubectl set image updates the container image in the Deployment spec, triggering a rolling update that replaces pods incrementally.

Question 4

What does enabling ECR tag immutability prevent?

Accepted Answer

Overwriting an existing image tag with a different image digest

Answer

Tag immutability ensures that once an image tag (e.g., 'v1.0') is pushed, subsequent pushes with the same tag are rejected, preventing silent overwrites.

Question 5

A containerized application on ECS needs to access an RDS password stored in AWS Secrets Manager. What is the recommended approach?

Accepted Answer

Pass the secret ARN as an environment variable in the task definition referencing Secrets Manager

Answer

ECS task definitions support native Secrets Manager and SSM Parameter Store integration, injecting secrets as environment variables at task launch without exposing them in code.

AWS Practice Test

AWS Practice Test

AWS DevOps Container Services 3