Mixed Deck — All DevOps Engineering on AWS Certification Topics Flashcards

A CloudFormation template uses Fn::ImportValue. What happens if the exporting stack is deleted first?

Answer: CloudFormation prevents deletion of the exporting stack while the import exists

CloudFormation prevents you from deleting an exporting stack as long as another stack is importing its exported output values.

Which AWS service provides a fully managed source control hosting service that uses Git?

Answer: AWS CodeCommit

AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories.

A DevOps team needs to store sensitive database credentials and rotate them automatically every 30 days. Which AWS service is the BEST fit?

Answer: AWS Secrets Manager

AWS Secrets Manager supports automatic rotation of secrets on a defined schedule with built-in Lambda rotation functions for common databases.

Which AWS service captures network traffic flow information for VPCs and can be used to detect anomalous traffic?

Answer: VPC Flow Logs

VPC Flow Logs capture information about IP traffic going to and from network interfaces in your VPC, stored in CloudWatch Logs or S3.

In AWS CodeBuild, what file defines the build commands and related settings?

Answer: buildspec.yml

The buildspec.yml file is a collection of build commands and related settings used by CodeBuild to run a build.

Which CloudFormation section maps keys to values, often used for environment-specific configuration like AMI IDs?

Answer: Mappings

The Mappings section defines static lookup tables keyed by region, environment, or other variables, commonly used to select region-specific AMI IDs.

Which CodeDeploy component defines the deployment rules, success conditions, and failure conditions?

Answer: Deployment Configuration

A Deployment Configuration in CodeDeploy specifies the minimum number of healthy instances and the pace at which instances are deployed.

Which AWS CodeDeploy hook runs validation tests after traffic is shifted to the new instances in a blue/green deployment?

Answer: AfterAllowTraffic

The AfterAllowTraffic hook runs after the load balancer routes traffic to the replacement instances, allowing post-deployment validation.

A table in an Amazon RDS MySQL DB instance must be dropped and repopulated at each deployment for an n-tier application. This procedure can take several minutes, and the web tier cannot be accessed until it is completed. The web layer is currently set up as an Amazon EC2 Auto Scaling group, with instances terminated and replaced at each deployment. An AWS CodeBuild task does a SQL query to populate the MySQL table. What steps should be taken to make sure that the web tier does not go online before the database is fully configured?

Answer: Use an EC2 Auto Scaling lifecycle hook to pause the configuration of the web tier until the table is populated.

Amazon EC2 Auto Scaling lets you add lifecycle hooks to your Auto Scaling groups. These hooks enable you to design solutions that are aware of Auto Scaling instance lifecycle events and then conduct a custom action on instances when the correct lifecycle event happens. A lifecycle hook allows the instance to wait for a given period of time (one hour by default) for the action to finish before moving on to the next stage.

You have recently been assigned to manage the Automated resources that your organization has set up in AWS. You want to leverage some of the company's chef recipes for the existing OpsWorks stacks that are already set up in AWS. However, when you get to the recipes area, there is no possibility to add any recipes. What may be the cause of this?

Answer: The stacks were created without the custom cookbooks option. Just change the stack settings accordingly.

AWS OpsWorks for Chef Automate allows you establish AWS-managed Chef servers with Chef Automate premium capabilities and manage them with the Chef DK and other Chef tools. A Chef server controls nodes in your environment, records node information, and acts as a central repository for your Chef cookbooks. The cookbooks include recipes that are executed by the Chef Infra client (chef-client) agent on each Chef-managed node. Chef tools such as knife and Test Kitchen may be used to manage nodes and cookbooks on a Chef server under the AWS OpsWorks for Chef Automate service.

Which AWS feature enables an RDS database to automatically fail over to a standby replica in another Availability Zone?

Answer: RDS Multi-AZ

RDS Multi-AZ deployments maintain a synchronous standby replica in a different AZ and automatically fail over to it if the primary instance fails.

Which CloudFormation stack policy action prevents all update actions on a resource?

Answer: Deny

Setting the Effect to Deny in a stack policy prevents the specified CloudFormation update actions from being performed on protected resources.

Which AWS service records API calls made in your AWS account, providing a full audit trail?

Answer: AWS CloudTrail

AWS CloudTrail logs every API call made in your AWS account, including the caller identity, time, source IP, and request/response parameters.

On AWS, a DevOps engineer must create a blue/green deployment procedure for an application. The traffic between the environments must be gradually shifted by the DevOps engineer. The application operates on Amazon EC2 instances and is managed by an Application Load Balancer (ALB). The instances are run as part of an Amazon EC2 Auto Scaling group. Data is stored on an Amazon RDS Multi-AZ DB instance. External DNS is provided by Amazon Route 53. To achieve these criteria, which combination of steps should the DevOps engineer take?

Answer: All of the above

A blue/green deployment has two distinct settings. The blue environment has Amazon EC2 instances running the current production version of the application in an Auto Scaling group. The green environment comprises EC2 instances from a different Auto Scaling group that are running the updated version of the application. Because each Auto Scaling group is behind its own Application Load Balancer (ALB), you may create two Alias records as endpoints in Amazon Route 53 and use a weighted routing strategy to progressively move traffic from the blue ALB to the green ALB. Unless schema modifications are required for the new release, it is advisable to point both environments to the same database to ensure data consistency throughout the cutover. Option F is wrong since it requires two ALBs as endpoints in order to utilize Route 53 to progressively transfer traffic. Option D is wrong because until a health check detects a failure, a failover routing strategy transmits all traffic to a single endpoint. As a result, this option cannot progressively shift traffic. Option A is wrong since the hot standby instance in an Amazon RDS Multi-AZ DB instance is not available for reads or writes.

Which language is not supported while creating custom Ansible modules?

Answer: All of the languages listed are supported

Ansible modules can be written in any language that the target system supports. The sole condition is that the module send its findings to STOUT as JSON for Ansible to ingest.

Which metric should a DevOps engineer monitor in Amazon SQS to determine if consumers are keeping up with the message production rate?

Answer: ApproximateAgeOfOldestMessage

ApproximateAgeOfOldestMessage measures how long the oldest unprocessed message has been in the queue, indicating processing lag when the value grows.

Which AWS service can be used as a source stage in CodePipeline to store and version Git repositories?

Answer: AWS CodeCommit

AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories and integrates as a CodePipeline source.

Which AWS service provides a set of prescriptive security controls and a landing zone to govern a multi-account AWS environment?

Answer: AWS Control Tower

AWS Control Tower automates the setup of a multi-account environment with built-in governance guardrails using AWS Organizations, Config, and other services.

Which CloudFormation resource type is used to define a custom provisioning logic using AWS Lambda?

Answer: AWS::CloudFormation::CustomResource

AWS::CloudFormation::CustomResource invokes a Lambda function (or SNS topic) during stack operations to handle resources CloudFormation doesn't natively support.

Which S3 feature allows you to automatically replicate objects to buckets in other AWS regions for disaster recovery?

Answer: Cross-Region Replication

S3 Cross-Region Replication automatically copies objects to a destination bucket in a different AWS region, supporting disaster recovery and latency reduction.