AWS DevOps DevOps CI/CD Pipeline Design & Implementation 4

Question 1

A company wants to enforce that every container image deployed to ECS was built by their CodeBuild pipeline and has not been tampered with. Which AWS service enforces this?

Accepted Answer

AWS Signer with container image signing and ECR image tag immutability

Answer

AWS Signer can sign container images, and combined with ECR immutable tags and IAM policies, ensures only pipeline-signed images are deployable to ECS.

Question 2

In a multi-account AWS CI/CD setup, a CodePipeline in the tools account needs to deploy CloudFormation stacks in a production account. What mechanism enables cross-account deployment?

Accepted Answer

Create a cross-account IAM role in the production account and configure CodePipeline to assume it during deployment

Answer

Cross-account deployments require a deployment role in the target account that the pipeline's role in the tools account can assume; the S3 artifact bucket must also grant the target account access.

Question 3

A pipeline should automatically roll back an ECS service deployment if the average CPU exceeds 80% for 5 minutes after release. Which AWS feature implements this?

Accepted Answer

CodeDeploy deployment group with a CloudWatch alarm configured to trigger automatic rollback

Answer

CodeDeploy deployment groups support CloudWatch alarm-based automatic rollback; if the alarm fires during or after deployment, CodeDeploy reverts to the previous version.

Question 4

Which CodeBuild environment variable is automatically provided and contains the S3 URL of the input artifact for the current build?

Accepted Answer

CODEBUILD_SRC_DIR

Answer

CODEBUILD_SRC_DIR contains the absolute path of the directory where CodeBuild places the downloaded source (or input artifact) for the build.

Question 5

A team wants to test infrastructure changes using CloudFormation before deploying to production. Which CodePipeline action type supports deploying a change set for review without executing it?

Accepted Answer

AWS CloudFormation CREATE_CHANGE_SET action followed by a manual approval and EXECUTE_CHANGE_SET action

Answer

The CREATE_CHANGE_SET action generates a CloudFormation change set for review; after a manual approval gate, EXECUTE_CHANGE_SET applies the changes, providing a safe review workflow.

AWS Practice Test

AWS Practice Test

AWS DevOps DevOps CI/CD Pipeline Design & Implementation 4