DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 5

Question 1

A DevOps engineer needs to prevent any IAM user in a member account from disabling AWS CloudTrail logging. Which mechanism enforces this across all accounts in an AWS Organization?

Accepted Answer

An SCP (Service Control Policy) attached at the root or OU level

Answer

SCPs attached at the root or OU level enforce guardrails that even account root users cannot override, including denying cloudtrail:StopLogging.

Question 2

A CodeBuild project intermittently fails with 'BUILD_GENERAL1_SMALL out of memory' errors during large test suites. What is the MOST appropriate fix?

Accepted Answer

Switch to a larger compute type such as BUILD_GENERAL1_MEDIUM or LARGE

Answer

CodeBuild compute types have fixed RAM allocations; upgrading to a larger compute type (MEDIUM or LARGE) directly increases available memory for the build environment.

Question 3

Which CloudFormation resource type allows you to run custom provisioning logic during stack create, update, and delete operations using a Lambda function?

Accepted Answer

AWS::CloudFormation::CustomResource

Answer

AWS::CloudFormation::CustomResource (or Custom::MyType) invokes a Lambda function during stack lifecycle events for arbitrary custom provisioning logic.

Question 4

A team wants to ensure that every push to the main branch triggers a security scan using Amazon Inspector before allowing a CodePipeline stage to proceed. What is the correct integration pattern?

Accepted Answer

Add an Amazon Inspector scan as a CodeBuild build step in the pipeline

Answer

Running the Amazon Inspector CLI or API call inside a CodeBuild step integrates scanning into the pipeline and fails the build if critical findings are detected.

Question 5

An Auto Scaling group uses a step scaling policy. The CloudWatch alarm fires when CPU exceeds 70%. What happens if CPU jumps to 95% while a previous scaling activity is still in cooldown?

Accepted Answer

Step scaling overrides the cooldown and adds instances immediately based on the step adjustment for the 95% breach

Answer

Step scaling policies bypass cooldown periods when a new alarm breach maps to a different (higher) step, allowing aggressive scale-out during rapidly increasing load.

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification Practice Test

DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification 5