AWS DevOps DevOps CI/CD Pipeline Design & Implementation 3 — Questions and Answers
Question 1: A microservices application uses separate CodePipeline pipelines per service. How can you ensure Service B's pipeline only runs after Service A's pipeline successfully completes?
- Use an EventBridge rule that triggers Service B's pipeline on a SUCCEEDED pipeline execution event for Service A (Correct answer)
- Configure Service A's last stage to directly invoke Service B's pipeline via the AWS CLI
- Deploy both services in a single pipeline with all stages combined
- Use SQS FIFO queues between the two pipelines to enforce ordering
Correct answer: Use an EventBridge rule that triggers Service B's pipeline on a SUCCEEDED pipeline execution event for Service A
EventBridge can listen for CodePipeline execution state change events and trigger a StartPipelineExecution API call to start a dependent pipeline on success.
Question 2: Which AWS service provides a fully managed source control repository that integrates natively with CodePipeline and supports pull request-based workflows?
- AWS CodeCommit (Correct answer)
- AWS CodeStar Connections (GitHub)
- Amazon S3 with versioning
- AWS Cloud9 shared environments
Correct answer: AWS CodeCommit
AWS CodeCommit is a fully managed Git repository service that integrates natively with other AWS developer tools including CodePipeline as a source action.
Question 3: A build in CodeBuild must access a database password stored in AWS Secrets Manager. What is the recommended approach?
- Hardcode the password in the buildspec.yml file and encrypt the file with KMS
- Reference the secret ARN in the buildspec.yml env/secrets-manager section so CodeBuild retrieves it at runtime (Correct answer)
- Store the password in an S3 object with a bucket policy restricting access to CodeBuild
- Pass the password as a plaintext environment variable in the CodeBuild project configuration
Correct answer: Reference the secret ARN in the buildspec.yml env/secrets-manager section so CodeBuild retrieves it at runtime
CodeBuild's buildspec supports a secrets-manager section that automatically fetches and injects Secrets Manager values as environment variables at build start without exposing them in logs.
Question 4: During a CodeDeploy in-place deployment to EC2 instances, which lifecycle hook runs AFTER the application files are installed but BEFORE traffic is re-routed to the instance?
- BeforeInstall
- ApplicationStart
- AfterInstall (Correct answer)
- ValidateService
Correct answer: AfterInstall
AfterInstall runs immediately after the application files are copied, allowing you to configure permissions or run post-install scripts before the application starts.
Question 5: A team wants to use feature flags to decouple code deployments from feature releases. Which AWS service is purpose-built for this use case?
- AWS AppConfig feature flags
- AWS Systems Manager Parameter Store with environment-specific parameters
- AWS Config rules with auto-remediation
- Amazon CloudWatch Evidently for feature flags and experimentation (Correct answer)
Correct answer: Amazon CloudWatch Evidently for feature flags and experimentation
Amazon CloudWatch Evidently provides feature flags and A/B testing capabilities, allowing teams to deploy code and then gradually roll out features to user segments.
Question 6: A CodeBuild project times out after 1 hour. The build completes in under 30 minutes in most cases but occasionally runs longer. What should be adjusted?
- Increase the CodeBuild build timeout setting beyond 60 minutes up to the 8-hour maximum (Correct answer)
- Split the build into multiple CodeBuild projects chained in CodePipeline
- Use a larger CodeBuild compute type to reduce execution time below 1 hour
- Enable CodeBuild batch builds to parallelize work and finish within the timeout
Correct answer: Increase the CodeBuild build timeout setting beyond 60 minutes up to the 8-hour maximum
CodeBuild supports a configurable timeout per project of up to 8 hours (480 minutes), so increasing the timeout accommodates occasional longer builds.
Question 7: Which deployment strategy minimizes risk by running two identical production environments and switching traffic between them using Route 53 or a load balancer?
- Rolling deployment
- In-place deployment
- Blue/green deployment (Correct answer)
- Canary deployment
Correct answer: Blue/green deployment
Blue/green deployments maintain two environments simultaneously; once the new (green) environment is validated, traffic is shifted from old (blue) to new, enabling instant rollback by reverting the traffic shift.
AWS DevOps DevOps CI/CD Pipeline Design & Implementation 3
A microservices application uses separate CodePipeline pipelines per service.
How can you ensure Service B's pipeline only runs after Service A's pipeline successfully completes?