DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification MCQ 5 — Questions and Answers
Question 1: Which AWS service provides automated recommendations to improve application availability, performance, security, and cost by analyzing your AWS environment?
- Amazon Inspector
- AWS Trusted Advisor (Correct answer)
- AWS Compute Optimizer
- Amazon DevOps Guru
Correct answer: AWS Trusted Advisor
AWS Trusted Advisor analyzes your AWS environment across five pillars and provides actionable recommendations to align with AWS best practices.
Question 2: A DevOps engineer wants to deploy infrastructure across multiple AWS accounts and regions using a single CloudFormation template. Which feature supports this?
- CloudFormation nested stacks
- CloudFormation StackSets (Correct answer)
- CloudFormation change sets
- AWS Service Catalog
Correct answer: CloudFormation StackSets
CloudFormation StackSets extend the concept of stacks by deploying the same template to multiple accounts and regions in a single operation.
Question 3: Which AWS CodePipeline action type allows a pipeline to pause and wait for manual approval before proceeding to the next stage?
- Source action with a manual gate
- Invoke action calling a Lambda approval function
- Approval action in a pipeline stage (Correct answer)
- Deploy action with a rollback condition
Correct answer: Approval action in a pipeline stage
The Approval action type pauses pipeline execution and sends an optional notification, requiring a designated reviewer to approve or reject before the pipeline continues.
Question 4: A Lambda function deployed in a VPC cannot reach the internet to call an external API. The function has no errors related to security groups or NACLs. What is the most likely missing configuration?
- The Lambda function lacks an execution role with AWSLambdaVPCAccessExecutionRole
- A NAT Gateway or NAT Instance is not configured in the VPC for the function's subnet (Correct answer)
- The Lambda function timeout is too short for network calls
- VPC Flow Logs are not enabled to diagnose the connection issue
Correct answer: A NAT Gateway or NAT Instance is not configured in the VPC for the function's subnet
Lambda functions inside a VPC route outbound internet traffic through a NAT Gateway or NAT Instance in a public subnet; without it, they cannot reach the public internet.
Question 5: Which AWS service continuously monitors machine learning models in production for data drift and model quality degradation, and can trigger retraining pipelines?
- Amazon SageMaker Model Monitor (Correct answer)
- Amazon Rekognition quality checks
- AWS Glue Data Quality
- Amazon Comprehend model evaluator
Correct answer: Amazon SageMaker Model Monitor
Amazon SageMaker Model Monitor automatically monitors deployed models for data quality, model quality, bias drift, and feature attribution drift in real time.
Question 6: A DevOps engineer needs to enforce a tagging policy so that every EC2 instance launched in an account has a 'CostCenter' tag. Which approach is most scalable for enforcement at launch time?
- Send daily SNS emails listing untagged instances
- Use an AWS Config rule with manual remediation to tag instances after launch
- Apply an SCP that denies ec2:RunInstances when the CostCenter tag is absent (Correct answer)
- Enable AWS Cost Explorer tag enforcement reporting
Correct answer: Apply an SCP that denies ec2:RunInstances when the CostCenter tag is absent
An SCP with a Condition key checking for the required tag denies the RunInstances API call at the moment of launch, preventing untagged instances from ever being created.
Question 7: When using Amazon ECR as a container registry in a CI/CD pipeline, which ECR lifecycle policy action helps control storage costs by automatically removing old or untagged images?
- Setting image scanning on push for all images
- Enabling cross-region replication for disaster recovery
- Configuring a lifecycle policy rule with countType expireByCount or sinceImagePushed (Correct answer)
- Enabling immutable image tags on the repository
Correct answer: Configuring a lifecycle policy rule with countType expireByCount or sinceImagePushed
ECR lifecycle policies with rules based on countType or sinceImagePushed automatically expire and delete images that match the criteria, reducing storage costs.
DevOps Engineering on AWS Certification DevOps Engineering on AWS Certification MCQ 5
Which AWS service provides automated recommendations to improve application availability, performance, security, and cost by analyzing your AWS environment?