DevOps Engineering on AWS Certification Flashcards

A team wants to enforce that all Lambda functions deployed via CloudFormation must have reserved concurrency set. Which service can automatically block non-compliant deployments before they reach production?

Answer: AWS CloudFormation Guard (cfn-guard)

CloudFormation Guard (cfn-guard) is a policy-as-code tool that validates CloudFormation templates against custom rules before deployment.

During a blue/green deployment on ECS with CodeDeploy, the health check on the replacement task set fails repeatedly. What is the FIRST action CodeDeploy takes?

Answer: It retries the health check for the configured wait time then rolls back

CodeDeploy waits the configured health check grace period and retry interval before triggering an automatic rollback to the original task set.

Which AWS service provides built-in source control integration, automated build triggers, and artifact storage as a fully managed end-to-end CI/CD service?

Answer: AWS CodeCatalyst

AWS CodeCatalyst is a unified software development service that includes source repositories, CI/CD workflows, and project management in one place.

An application deployed across three AWS Regions needs a single global endpoint with automatic failover. Traffic should shift to a healthy region within seconds. Which service best meets this requirement?

Answer: AWS Global Accelerator

AWS Global Accelerator uses AWS edge locations and health checks to route traffic to healthy endpoints within seconds using anycast IPs.

A DevOps team needs to store sensitive database credentials and rotate them automatically every 30 days. Which AWS service is the BEST fit?

Answer: AWS Secrets Manager

AWS Secrets Manager supports automatic rotation of secrets on a defined schedule with built-in Lambda rotation functions for common databases.

In a CodePipeline with a manual approval action, the pipeline has been waiting for approval for 7 days. What happens by default?

Answer: The approval action expires and the pipeline execution is abandoned

Manual approval actions in CodePipeline expire after 7 days by default, causing that execution to be abandoned.

A company wants to ensure their EC2 AMIs are patched monthly and any instance using an outdated AMI is flagged automatically. Which combination of services achieves this?

Answer: EC2 Image Builder + AWS Config

EC2 Image Builder automates AMI creation and patching pipelines, while AWS Config rules can detect instances using non-compliant AMIs.