AWS DevOps Safety Systems & Standards 5 — Questions and Answers
Question 1: Which AWS service should a DevOps team use to implement a Web Application Firewall that protects applications deployed behind an Application Load Balancer?
- AWS Shield Standard
- AWS WAF (Correct answer)
- Amazon GuardDuty
- AWS Network Firewall
Correct answer: AWS WAF
AWS WAF integrates with Application Load Balancers and CloudFront to filter HTTP traffic using customizable rules that block common web exploits.
Question 2: A pipeline deploys a Lambda function that will process sensitive PII data. Which AWS tool should be used to assess the function's permissions for least-privilege compliance?
- AWS Config Lambda rules
- IAM Access Analyzer (Correct answer)
- AWS Trusted Advisor
- Amazon Inspector
Correct answer: IAM Access Analyzer
IAM Access Analyzer analyzes resource-based policies and IAM policies to identify overly permissive access and generate least-privilege policy recommendations.
Question 3: Which deployment strategy minimizes risk by keeping the old environment live while the new version serves a small percentage of production traffic for validation?
- Rolling update
- Canary deployment (Correct answer)
- Recreate deployment
- Shadow deployment
Correct answer: Canary deployment
Canary deployments route a small fraction of production traffic to the new version, allowing real-world validation with limited blast radius before full rollout.
Question 4: AWS CodePipeline integrates with AWS CloudTrail. What specific safety benefit does this integration provide in a DevOps context?
- It accelerates pipeline execution speed
- It provides a tamper-evident audit trail of all pipeline actions and approvals (Correct answer)
- It automatically tests pipeline stages
- It encrypts pipeline artifacts
Correct answer: It provides a tamper-evident audit trail of all pipeline actions and approvals
CloudTrail records every CodePipeline API call with actor identity and timestamp, creating an immutable audit log for compliance and incident investigation.
Question 5: A security team requires that all data in transit between microservices in an ECS cluster is encrypted. Which approach enforces this at the infrastructure level?
- Enabling ECS task-level logging
- Configuring AWS App Mesh with TLS between service proxies (Correct answer)
- Using SSM Parameter Store for service configs
- Enabling ECS Exec for secure shell access
Correct answer: Configuring AWS App Mesh with TLS between service proxies
AWS App Mesh manages service-to-service communication and can enforce mutual TLS (mTLS) encryption between all Envoy proxies in an ECS cluster.
Question 6: Which CloudFormation Stack Policy feature helps prevent accidental deletion or replacement of critical production resources during stack updates?
- Stack termination protection only
- Stack policies that deny Update:Replace and Update:Delete on specified resources (Correct answer)
- CloudFormation change sets
- AWS Config managed rules
Correct answer: Stack policies that deny Update:Replace and Update:Delete on specified resources
Stack policies define what update actions are allowed on specific resources, preventing destructive actions like replacement or deletion on critical production resources.
Question 7: When implementing immutable infrastructure in AWS, what is the key safety advantage over mutable (in-place update) deployments?
- Immutable deployments use less compute resources
- Immutable deployments eliminate configuration drift and enable instant rollback by switching traffic back to old instances (Correct answer)
- Immutable deployments skip testing stages
- Immutable deployments reduce IAM permission requirements
Correct answer: Immutable deployments eliminate configuration drift and enable instant rollback by switching traffic back to old instances
Because immutable deployments never modify running instances, every deployment starts from a known-good base, eliminating configuration drift and enabling fast rollback by routing traffic back.
AWS DevOps Safety Systems & Standards 5
Which AWS service should a DevOps team use to implement a Web Application Firewall that protects applications deployed behind an Application Load Balancer?