DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 2 — Questions and Answers
Question 1: A team wants to enforce that all Lambda functions deployed via CloudFormation must have reserved concurrency set. Which service can automatically block non-compliant deployments before they reach production?
- AWS Config with auto-remediation
- AWS CloudFormation Guard (cfn-guard) (Correct answer)
- AWS Trusted Advisor
- Amazon Inspector
Correct answer: AWS CloudFormation Guard (cfn-guard)
CloudFormation Guard (cfn-guard) is a policy-as-code tool that validates CloudFormation templates against custom rules before deployment.
Question 2: During a blue/green deployment on ECS with CodeDeploy, the health check on the replacement task set fails repeatedly. What is the FIRST action CodeDeploy takes?
- It rolls back immediately to the original task set
- It retries the health check for the configured wait time then rolls back (Correct answer)
- It sends an SNS alert and waits for manual intervention
- It terminates both task sets and redeploys from scratch
Correct answer: It retries the health check for the configured wait time then rolls back
CodeDeploy waits the configured health check grace period and retry interval before triggering an automatic rollback to the original task set.
Question 3: Which AWS service provides built-in source control integration, automated build triggers, and artifact storage as a fully managed end-to-end CI/CD service?
- AWS CodePipeline
- AWS CodeStar
- AWS Amplify
- AWS CodeCatalyst (Correct answer)
Correct answer: AWS CodeCatalyst
AWS CodeCatalyst is a unified software development service that includes source repositories, CI/CD workflows, and project management in one place.
Question 4: An application deployed across three AWS Regions needs a single global endpoint with automatic failover. Traffic should shift to a healthy region within seconds. Which service best meets this requirement?
- Amazon Route 53 with latency-based routing
- AWS Global Accelerator (Correct answer)
- Amazon CloudFront with origin failover
- Elastic Load Balancing with cross-region replication
Correct answer: AWS Global Accelerator
AWS Global Accelerator uses AWS edge locations and health checks to route traffic to healthy endpoints within seconds using anycast IPs.
Question 5: A DevOps team needs to store sensitive database credentials and rotate them automatically every 30 days. Which AWS service is the BEST fit?
- AWS Systems Manager Parameter Store (SecureString)
- AWS Secrets Manager (Correct answer)
- AWS Key Management Service (KMS)
- AWS Certificate Manager
Correct answer: AWS Secrets Manager
AWS Secrets Manager supports automatic rotation of secrets on a defined schedule with built-in Lambda rotation functions for common databases.
Question 6: In a CodePipeline with a manual approval action, the pipeline has been waiting for approval for 7 days. What happens by default?
- The pipeline continues automatically
- The pipeline fails and sends an SNS notification
- The approval action expires and the pipeline execution is abandoned (Correct answer)
- The pipeline retries from the previous stage
Correct answer: The approval action expires and the pipeline execution is abandoned
Manual approval actions in CodePipeline expire after 7 days by default, causing that execution to be abandoned.
Question 7: A company wants to ensure their EC2 AMIs are patched monthly and any instance using an outdated AMI is flagged automatically. Which combination of services achieves this?
- EC2 Image Builder + AWS Config (Correct answer)
- AWS Systems Manager Patch Manager + CloudWatch Events
- AWS Inspector + EC2 Auto Scaling
- AWS Trusted Advisor + CloudTrail
Correct answer: EC2 Image Builder + AWS Config
EC2 Image Builder automates AMI creation and patching pipelines, while AWS Config rules can detect instances using non-compliant AMIs.
DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 2
A team wants to enforce that all Lambda functions deployed via CloudFormation must have reserved concurrency set.
Which service can automatically block non-compliant deployments before they reach production?