DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification MCQ 3 — Questions and Answers
Question 1: A DevOps team wants to store application secrets such as database passwords in a way that supports automatic rotation. Which AWS service is best suited for this requirement?
- AWS Systems Manager Parameter Store (Standard)
- AWS Secrets Manager (Correct answer)
- AWS Key Management Service (KMS)
- Amazon S3 with server-side encryption
Correct answer: AWS Secrets Manager
AWS Secrets Manager natively supports automatic secret rotation using Lambda functions and integrates directly with RDS, Redshift, and DocumentDB.
Question 2: Which AWS CodeBuild environment variable type stores the value in AWS Systems Manager Parameter Store and retrieves it at build time without exposing it in build logs?
- PLAINTEXT
- SECRETS_MANAGER
- PARAMETER_STORE (Correct answer)
- ENCRYPTED
Correct answer: PARAMETER_STORE
The PARAMETER_STORE environment variable type in CodeBuild retrieves values from SSM Parameter Store at build time so they never appear in the buildspec or console.
Question 3: A company uses AWS Organizations and wants to prevent member accounts from disabling AWS CloudTrail. Which mechanism enforces this across all accounts?
- IAM permission boundaries on the root user in each account
- A Service Control Policy (SCP) attached to the organization root (Correct answer)
- AWS Config rule deployed via a StackSet
- CloudTrail organization trail with SNS alerting
Correct answer: A Service Control Policy (SCP) attached to the organization root
SCPs attached to the organization root act as guardrails that deny CloudTrail-disabling API calls even for account administrators in all member accounts.
Question 4: When designing a CI/CD pipeline for a microservices architecture on Amazon EKS, which tool is commonly used to package, version, and deploy Kubernetes manifests?
- AWS Elastic Beanstalk
- Helm (Correct answer)
- AWS SAM CLI
- AWS CDK Pipelines
Correct answer: Helm
Helm is the de facto Kubernetes package manager that templates manifests into versioned charts, enabling repeatable and parameterized deployments to EKS clusters.
Question 5: A Lambda-based application experiences intermittent throttling during traffic spikes. Which configuration change best reduces throttling without increasing function concurrency limits?
- Enable provisioned concurrency on the Lambda function (Correct answer)
- Increase the function timeout to handle queued requests
- Enable X-Ray active tracing on the function
- Switch the function runtime to a compiled language
Correct answer: Enable provisioned concurrency on the Lambda function
Provisioned concurrency pre-initializes execution environments so they are ready to respond immediately, eliminating cold starts and reducing the chance of throttling during spikes.
Question 6: Which AWS service provides a managed Git repository with built-in pull request workflows, branch permissions, and integration with CodePipeline?
- AWS CodeStar
- Amazon S3 versioned buckets
- AWS CodeCommit (Correct answer)
- AWS Cloud9
Correct answer: AWS CodeCommit
AWS CodeCommit is a fully managed source control service hosting private Git repositories and integrating natively with other AWS Developer Tools services.
Question 7: A DevOps engineer wants to capture all API calls made to AWS services in an account for audit purposes. Which service and feature should be enabled?
- Amazon CloudWatch Logs with VPC Flow Logs
- AWS CloudTrail with a trail logging to an S3 bucket (Correct answer)
- AWS Config with a delivery channel
- Amazon GuardDuty with S3 protection enabled
Correct answer: AWS CloudTrail with a trail logging to an S3 bucket
AWS CloudTrail records all API calls as events and a trail persists them to an S3 bucket, providing a complete audit log of account activity.
DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification MCQ 3
A DevOps team wants to store application secrets such as database passwords in a way that supports automatic rotation.
Which AWS service is best suited for this requirement?