DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 4 — Questions and Answers
Question 1: A team uses Terraform to manage AWS infrastructure. They want to enforce that only approved Terraform module versions are used across the organization. Which approach best enforces this in a DevOps pipeline?
- Store modules in S3 and use S3 bucket policies
- Use AWS Service Catalog to publish approved Terraform configurations
- Use a private Terraform registry in Terraform Cloud/Enterprise with version constraints (Correct answer)
- Scan Terraform plan output with AWS Config
Correct answer: Use a private Terraform registry in Terraform Cloud/Enterprise with version constraints
A private Terraform registry with pinned version constraints in module sources ensures only approved, versioned modules are consumed across teams.
Question 2: Which AWS X-Ray feature allows a DevOps engineer to identify the slowest downstream calls across a distributed microservices application?
- X-Ray sampling rules
- X-Ray service map (Correct answer)
- X-Ray analytics filter expressions
- X-Ray groups
Correct answer: X-Ray service map
The X-Ray service map provides a visual representation of all service connections and highlights latency and error rates for each downstream call.
Question 3: A Lambda function is deployed with an alias pointing to two versions: 90% to v5 and 10% to v6. This is an example of which deployment strategy?
- Blue/green deployment
- Rolling deployment
- Canary deployment (Correct answer)
- Immutable deployment
Correct answer: Canary deployment
Routing a small percentage of traffic to a new version while the majority stays on the stable version is a canary deployment strategy.
Question 4: An engineering team wants automatic rollback when a new CodeDeploy deployment causes a CloudWatch alarm to breach. Which CodeDeploy feature enables this?
- Deployment lifecycle hooks
- Rollback on alarm configuration in the deployment group (Correct answer)
- CloudWatch Events rule targeting CodeDeploy
- AWS Systems Manager automation documents
Correct answer: Rollback on alarm configuration in the deployment group
CodeDeploy deployment groups support alarm-based automatic rollback, where a breached CloudWatch alarm during deployment triggers an immediate rollback.
Question 5: A DevOps team wants to detect configuration drift on EC2 instances compared to their desired SSM State Manager association. Which Systems Manager capability continuously evaluates and reports this drift?
- Systems Manager Compliance (Correct answer)
- Systems Manager Explorer
- Systems Manager OpsCenter
- Systems Manager Inventory
Correct answer: Systems Manager Compliance
Systems Manager Compliance aggregates patch compliance and State Manager association compliance data to show which instances have drifted from their desired state.
Question 6: When building a multi-stage CodePipeline that spans two AWS accounts, how should cross-account artifact access be granted?
- Use public S3 buckets for artifacts
- Add a cross-account IAM role and update the artifact bucket policy and KMS key policy to allow the target account (Correct answer)
- Enable S3 Cross-Region Replication between accounts
- Use CodeArtifact as the shared artifact store
Correct answer: Add a cross-account IAM role and update the artifact bucket policy and KMS key policy to allow the target account
Cross-account CodePipeline setups require a cross-account IAM role in the target account, plus S3 bucket and KMS key policies that grant the target account access.
Question 7: A company wants to implement GitOps for EKS workloads. Which tool, available natively in AWS, provides continuous delivery by reconciling the desired Git state with the live cluster state?
- AWS CodeDeploy with AppSpec
- Amazon EKS Blueprints
- AWS Controllers for Kubernetes (ACK)
- Amazon EKS with Flux or ArgoCD via AWS Marketplace (Correct answer)
Correct answer: Amazon EKS with Flux or ArgoCD via AWS Marketplace
GitOps on EKS is typically implemented with Flux or ArgoCD, both available through AWS Marketplace, which continuously reconcile Git repo state with cluster state.
DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 4
A team uses Terraform to manage AWS infrastructure.
They want to enforce that only approved Terraform module versions are used across the organization.
Which approach best enforces this in a DevOps pipeline?