AWS DevOps DevOps Monitoring, Testing & Deployment Strategies 5 — Questions and Answers
Question 1: Which AWS service enables you to continuously assess EC2 instances for software vulnerabilities and unintended network exposure without deploying agents?
- Amazon Inspector v2 (Correct answer)
- AWS Security Hub
- AWS Systems Manager Patch Manager
- Amazon GuardDuty
Correct answer: Amazon Inspector v2
Amazon Inspector v2 uses agentless scanning for EC2 (via SSM) and container images to find CVEs and network reachability issues.
Question 2: In a CodeDeploy blue/green deployment to EC2, where does the deployment traffic shift AFTER the green (new) environment passes health checks?
- The load balancer is updated to route traffic from blue target group to green target group (Correct answer)
- Route 53 weighted records are updated to point to the new instances
- An Auto Scaling lifecycle hook completes to allow traffic
- CloudFront origin is switched from the old to the new instance
Correct answer: The load balancer is updated to route traffic from blue target group to green target group
CodeDeploy blue/green on EC2 re-registers green instances with the load balancer and deregisters blue instances, shifting all traffic at the ALB/NLB level.
Question 3: A pipeline needs to validate that a CloudFormation stack change set won't delete production resources before deploying. Which action type checks this?
- CloudFormation CREATE_CHANGE_SET action followed by a manual approval reviewing the change set (Correct answer)
- CodeBuild action running cfn-lint on the template
- CloudFormation DEPLOY action with --fail-on-empty-changeset flag
- AWS Config conformance pack evaluation
Correct answer: CloudFormation CREATE_CHANGE_SET action followed by a manual approval reviewing the change set
Creating a change set and adding a manual approval step lets reviewers inspect resource deletions before executing the change set.
Question 4: Which feature of Amazon CloudWatch RUM (Real User Monitoring) differentiates it from synthetic monitoring?
- It captures performance data from actual end-user browsers and sessions (Correct answer)
- It runs scripted Canary tests from AWS infrastructure
- It monitors server-side response times via CloudWatch metrics
- It analyzes VPC Flow Logs to infer client experience
Correct answer: It captures performance data from actual end-user browsers and sessions
CloudWatch RUM collects client-side performance metrics and errors from real user browser sessions using a JavaScript snippet.
Question 5: When configuring a CodePipeline with an ECR source action, what event triggers the pipeline to start automatically?
- An Amazon EventBridge rule detecting an ECR image push to the specified repository and tag (Correct answer)
- A CloudWatch Alarm detecting increased container pull requests
- An S3 event notification when the image layer is stored
- A CodeBuild webhook listening for Docker build completion
Correct answer: An Amazon EventBridge rule detecting an ECR image push to the specified repository and tag
CodePipeline uses EventBridge rules to detect ECR image push events and automatically trigger the pipeline when a new image is pushed.
Question 6: Which AWS CodeDeploy deployment configuration ensures that at least 75% of instances remain in service during an in-place rolling deployment?
- CodeDeployDefault.HalfAtATime
- CodeDeployDefault.OneAtATime
- CodeDeployDefault.AllAtOnce
- A custom deployment configuration specifying minimum healthy hosts (Correct answer)
Correct answer: A custom deployment configuration specifying minimum healthy hosts
A custom deployment configuration lets you specify a minimum healthy host percentage (e.g., 75%), whereas built-in configs use fixed fractions like half or one.
Question 7: A DevOps team wants to correlate application logs with deployment events to quickly identify which deployment caused a spike in errors. Which approach achieves this in CloudWatch?
- Add deployment annotations to CloudWatch dashboards and use Logs Insights to query error rates filtered by time (Correct answer)
- Enable CloudTrail data events and join them with application logs
- Tag all EC2 instances with deployment version and filter metrics by tag
- Use AWS Config timeline to correlate configuration changes with log events
Correct answer: Add deployment annotations to CloudWatch dashboards and use Logs Insights to query error rates filtered by time
Dashboard annotations mark deployment times visually, and Logs Insights queries can filter log data within those time windows to correlate errors.
AWS DevOps DevOps Monitoring, Testing & Deployment Strategies 5
Which AWS service enables you to continuously assess EC2 instances for software vulnerabilities and unintended network exposure without deploying agents?