DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 3 — Questions and Answers
Question 1: A microservice on EKS needs to access an S3 bucket without storing credentials in the pod. Which mechanism enables this using IAM?
- Attach an IAM role to the EC2 node group
- Use IAM Roles for Service Accounts (IRSA) (Correct answer)
- Store credentials in a Kubernetes Secret
- Use AWS Systems Manager Parameter Store with the AWS CLI inside the pod
Correct answer: Use IAM Roles for Service Accounts (IRSA)
IRSA allows a Kubernetes service account to assume an IAM role via OIDC federation, scoping permissions to specific pods without node-level credentials.
Question 2: When using AWS CodeBuild, which environment variable is automatically provided and can be used to tag Docker images with the current build ID?
- $BUILD_NUMBER
- $CODEBUILD_BUILD_ID (Correct answer)
- $CODEBUILD_RESOLVED_SOURCE_VERSION
- $CI_BUILD_ID
Correct answer: $CODEBUILD_BUILD_ID
CodeBuild automatically injects $CODEBUILD_BUILD_ID as an environment variable containing the unique identifier for the current build.
Question 3: A pipeline artifact stored in CodePipeline's default S3 bucket must be encrypted with a customer-managed KMS key. Where is this KMS key association configured?
- In the CodeBuild project settings
- In the pipeline's artifact store configuration (Correct answer)
- In the S3 bucket policy
- In the CodeDeploy deployment group
Correct answer: In the pipeline's artifact store configuration
The artifact store in a CodePipeline pipeline definition specifies both the S3 bucket and an optional encryption key for pipeline artifacts.
Question 4: A CloudFormation stack update fails midway and rolls back. Which CloudFormation feature allows a DevOps engineer to investigate the failed resources without losing them during rollback?
- Stack policies
- Rollback triggers
- DisableRollback flag (Correct answer)
- Drift detection
Correct answer: DisableRollback flag
Setting DisableRollback=true when creating or updating a stack preserves the failed resources in place so engineers can troubleshoot before retrying.
Question 5: An SQS-based worker fleet processes messages and must scale EC2 instances based on the number of messages per instance. Which CloudWatch metric combination drives this custom scaling policy?
- SQS ApproximateNumberOfMessagesVisible / Auto Scaling group desired capacity (Correct answer)
- SQS NumberOfMessagesSent / EC2 CPUUtilization
- SQS ApproximateAgeOfOldestMessage alone
- EC2 NetworkIn / SQS ApproximateNumberOfMessagesNotVisible
Correct answer: SQS ApproximateNumberOfMessagesVisible / Auto Scaling group desired capacity
Dividing ApproximateNumberOfMessagesVisible by the current desired capacity gives a backlog-per-instance metric ideal for target tracking scaling policies.
Question 6: In a multi-account AWS environment, which service acts as the central hub for sharing CodePipeline pipeline execution events across accounts using event-based triggers?
- AWS Service Catalog
- Amazon EventBridge (CloudWatch Events) (Correct answer)
- AWS Organizations
- AWS Control Tower
Correct answer: Amazon EventBridge (CloudWatch Events)
EventBridge event buses can be configured to accept events from other AWS accounts, enabling cross-account pipeline triggers and orchestration.
Question 7: A DevOps engineer needs to run a pre-deployment smoke test against a canary portion of production traffic before shifting 100% of load. Which CodeDeploy hook lifecycle event supports this?
- BeforeInstall
- AfterInstall
- AfterAllowTestTraffic (Correct answer)
- ValidateService
Correct answer: AfterAllowTestTraffic
The AfterAllowTestTraffic lifecycle hook fires after CodeDeploy routes test traffic to the replacement environment, making it ideal for automated smoke tests.
DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 3
A microservice on EKS needs to access an S3 bucket without storing credentials in the pod.
Which mechanism enables this using IAM?