AWS DevOps Serverless Deployment 4 — Questions and Answers
Question 1: A DevOps engineer wants to automatically roll back a Lambda deployment if CloudWatch alarms trigger. Which CodeDeploy feature enables this?
- Deployment hooks
- Automatic rollback on alarm (Correct answer)
- Rollback triggers in buildspec.yml
- Lambda versioning aliases
Correct answer: Automatic rollback on alarm
CodeDeploy supports automatic rollback configuration that reverts a deployment when specified CloudWatch alarms enter the ALARM state.
Question 2: Which environment variable is automatically set by Lambda and provides the name of the current function's CloudWatch log group?
- AWS_LAMBDA_LOG_STREAM_NAME
- AWS_LAMBDA_LOG_GROUP_NAME (Correct answer)
- AWS_LAMBDA_FUNCTION_NAME
- LOG_GROUP_NAME
Correct answer: AWS_LAMBDA_LOG_GROUP_NAME
AWS_LAMBDA_LOG_GROUP_NAME is a reserved environment variable automatically injected by Lambda with the function's log group path.
Question 3: In a serverless CI/CD pipeline, a Lambda function needs read access to an S3 bucket. What is the most secure way to grant this access?
- Embed AWS credentials in environment variables
- Attach an IAM role with least-privilege S3 read policy to the function (Correct answer)
- Use an S3 bucket ACL granting public read
- Store credentials in AWS Secrets Manager and retrieve at runtime
Correct answer: Attach an IAM role with least-privilege S3 read policy to the function
Attaching an IAM execution role with a least-privilege policy is the AWS-recommended approach, as Lambda automatically assumes the role without static credentials.
Question 4: What happens to in-flight Lambda invocations during a CodeDeploy traffic-shifting deployment when automatic rollback is triggered?
- They are immediately terminated
- They complete on the version they started on; no new invocations go to the new version (Correct answer)
- They are retried on the previous version automatically
- CodeDeploy pauses all invocations until rollback completes
Correct answer: They complete on the version they started on; no new invocations go to the new version
In-flight invocations complete normally on the version they started; CodeDeploy simply stops routing new traffic to the new version and reverts the alias.
Question 5: A team uses AWS SAM to deploy a Lambda function triggered by EventBridge. Which SAM event source type should they use?
- Schedule
- CloudWatchEvent
- EventBridgeRule (Correct answer)
- CloudWatch
Correct answer: EventBridgeRule
The EventBridgeRule event type in SAM creates an EventBridge rule that triggers the Lambda function based on the specified event pattern or schedule.
Question 6: Which Lambda feature allows a DevOps engineer to test a new version of a function with a small percentage of live traffic before full promotion?
- Lambda layers
- Alias routing configuration (weighted aliases) (Correct answer)
- Reserved concurrency
- Lambda destinations
Correct answer: Alias routing configuration (weighted aliases)
Lambda weighted aliases allow traffic to be split between two function versions by assigning routing weights, enabling canary testing in production.
Question 7: When deploying a containerized Lambda function, which base image registry does AWS recommend using to ensure compatibility?
- Docker Hub official images
- AWS-provided base images from Amazon ECR Public Gallery (Correct answer)
- Google Container Registry
- GitHub Container Registry
Correct answer: AWS-provided base images from Amazon ECR Public Gallery
AWS provides official Lambda base images in Amazon ECR Public Gallery that include the Lambda runtime interface client, ensuring full compatibility.
AWS DevOps Serverless Deployment 4
A DevOps engineer wants to automatically roll back a Lambda deployment if CloudWatch alarms trigger.
Which CodeDeploy feature enables this?