AWS DevOps DevOps CI/CD Pipeline Design & Implementation 5 — Questions and Answers
Question 1: A team wants to validate that their Terraform infrastructure code follows company standards before any deployment. Which pipeline stage pattern accomplishes this with minimal custom tooling?
- Use CodeBuild to run terraform validate and tflint as a pre-deployment stage in CodePipeline (Correct answer)
- Use AWS Config rules to evaluate Terraform state files post-deployment and auto-remediate
- Use CloudFormation Guard (cfn-guard) to validate Terraform HCL files against policy rules
- Use AWS Trusted Advisor to scan Terraform plans for compliance violations
Correct answer: Use CodeBuild to run terraform validate and tflint as a pre-deployment stage in CodePipeline
Running terraform validate and linting tools in a CodeBuild stage catches syntax and policy violations early in the pipeline before any infrastructure is provisioned.
Question 2: Which metric should you monitor to measure the DevOps practice of Continuous Delivery pipeline health, representing the time from a code commit to a production deployment?
- Mean Time to Recovery (MTTR)
- Lead time for changes (Correct answer)
- Change failure rate
- Deployment frequency
Correct answer: Lead time for changes
Lead time for changes measures the elapsed time from a code commit to when that change is running in production, directly reflecting CI/CD pipeline efficiency.
Question 3: A CodePipeline stage fails intermittently due to a flaky integration test. What is the recommended approach to handle transient failures without blocking the pipeline?
- Set the CodeBuild retry count to 3 so the action automatically retries on failure
- Use CodePipeline's built-in stage retry functionality to re-run the failed stage without restarting the entire pipeline (Correct answer)
- Configure a CloudWatch Events rule to restart the full pipeline on failure
- Remove the flaky test from the pipeline and run it manually on a schedule
Correct answer: Use CodePipeline's built-in stage retry functionality to re-run the failed stage without restarting the entire pipeline
CodePipeline supports manual stage retry, allowing operators to re-run only the failed stage using the existing artifacts without re-executing earlier stages.
Question 4: An organization wants to enforce that no one can manually push directly to the CodeCommit main branch—all changes must go through a pull request and CodeBuild status check. What enforces this?
- An IAM policy denying the codecommit:GitPush action on the main branch combined with a CodeCommit approval rule template (Correct answer)
- A CloudTrail-triggered Lambda that reverts direct pushes to main automatically
- A CodeCommit repository trigger that notifies the security team of direct pushes
- A Service Control Policy (SCP) in AWS Organizations blocking push to protected branches
Correct answer: An IAM policy denying the codecommit:GitPush action on the main branch combined with a CodeCommit approval rule template
An IAM deny policy on GitPush for the protected branch prevents direct pushes, while CodeCommit approval rule templates require pull request approvals and status checks before merging.
Question 5: A team needs their CodePipeline to deploy to resources inside a private VPC with no internet access. What configuration is required for CodeBuild to reach those resources?
- Enable CodeBuild Enhanced Networking and specify the target VPC CIDR in the project
- Configure the CodeBuild project to run inside the VPC by specifying the VPC ID, subnets, and security groups (Correct answer)
- Use AWS Direct Connect between the CodeBuild service network and the target VPC
- Attach an Internet Gateway to the CodeBuild VPC endpoint to enable outbound connectivity
Correct answer: Configure the CodeBuild project to run inside the VPC by specifying the VPC ID, subnets, and security groups
CodeBuild projects support VPC configuration where you specify the VPC, private subnets, and security groups, allowing build containers to access private resources without internet routing.
Question 6: Which AWS CodeDeploy deployment configuration would you choose to deploy to all instances simultaneously, accepting higher risk for the fastest possible deployment speed?
- CodeDeployDefault.HalfAtATime
- CodeDeployDefault.OneAtATime
- CodeDeployDefault.AllAtOnce (Correct answer)
- CodeDeployDefault.Linear10PercentEvery1Minutes
Correct answer: CodeDeployDefault.AllAtOnce
CodeDeployDefault.AllAtOnce deploys to all instances simultaneously, which is the fastest option but has the highest blast radius if the deployment fails.
Question 7: A company wants to automatically trigger their CodePipeline whenever a new version of a third-party container image is pushed to Amazon ECR. Which service detects this event and starts the pipeline?
- Amazon CloudWatch Logs subscription filter watching ECR API logs
- Amazon EventBridge rule matching the ECR image push event and invoking CodePipeline (Correct answer)
- AWS Lambda polling ECR repository tags on a schedule and triggering the pipeline
- CodePipeline native ECR source action with push-based polling
Correct answer: Amazon EventBridge rule matching the ECR image push event and invoking CodePipeline
Amazon EventBridge receives ECR image push events and can trigger a CodePipeline StartPipelineExecution API call, enabling near-real-time pipeline execution on new image versions.
AWS DevOps DevOps CI/CD Pipeline Design & Implementation 5
A team wants to validate that their Terraform infrastructure code follows company standards before any deployment.
Which pipeline stage pattern accomplishes this with minimal custom tooling?