Free DevOps Engineering on AWS Certification Trivia Questions and Answers — Questions and Answers
Question 1: In AWS Code Commit, a corporation has control over the source code for an application. Using AWS CodePipeline, the firm is developing a CI/CD pipeline for the application. When modifications are made to the main branch of the CodeCommit repository, the pipeline must begin automatically. Because changes occur on a daily basis, the pipeline must be as responsive as feasible. <br> What should a DevOps engineer do to achieve these requirements?
- Configure the repository to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when changes occur to the repository's main branch. Subscribe the pipeline to the SNS topic.
- Configure the repository to periodically run an AWS Lambda function. Configure the function to check the repository's main branch and to start the pipeline when the function detects changes.
- Configure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect changes to the repository's main branch. Configure the pipeline to start in response to the changes. (Correct answer)
- Configure the pipeline to periodically check the repository's main branch for changes. Start the pipeline when changes are detected.
Correct answer: Configure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect changes to the repository's main branch. Configure the pipeline to start in response to the changes.
The update will generate the event, and the event will initiate the pipeline. Option D's periodic checks will work, but they won't start the pipeline until the next periodic check takes place. Option B is not an attribute supported by AWS Code Commit. Option A is not a valid way to begin the pipeline.
Question 2: A business is building an application with AWS CodeBuild. All build artifacts must be encrypted at rest per company policy. Access to the artifacts must be limited to IAM users in an operations IAM group who have authority to take an operations IAM role. <br> Which solution fits these standards?
- Add a post-build command to the CodeBuild build specification to call the AWS key Management Service (AWS KMS) Encrypt API operation and pass the artifact to AWS KMS for encryption with a specified KMS key. Push the encrypted artifact to an Amazon S3 bucket. Set up the operations IAM group as the only user for the specified KMS key.
- Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket that has S3 default encryption enabled. Set a bucket policy that contains a Deny statement for all actions with a NotPrincipal element that references the operations IAM role. (Correct answer)
- Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Configure an S3 event notification to invoke an AWS Lambda function to get the object, encrypt the object, and put the object back into the S3 bucket with a tag key of Encrypted and a tag value of True. Set a bucket policy with a Deny statement for all actions with a NotPrincipal element that references the operations IAM group. Include in the policy a Condition element that references the encrypted tag.
- Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Set a bucket policy that prevents upload to the bucket unless the request includes the x-amz-server-side-encryption header. Add a Deny statement for all actions with a NotPrincipal element that references the operations IAM group.
Correct answer: Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket that has S3 default encryption enabled. Set a bucket policy that contains a Deny statement for all actions with a NotPrincipal element that references the operations IAM role.
Except for requests that apply for the role, the Deny statement with the NotPrincipal element set to the operations IAM role will deny access to the S3 bucket. According to the scenario, the operations role has a permissions policy that permits access to the bucket. <br> Options C and D are inappropriate because the bucket policy refers to an IAM group rather than a role. Option D is likewise wrong since AWS suggests using default encryption rather than a bucket policy to enforce encryption. Option C also permits artifacts to be temporarily kept at rest without encryption. Option A is wrong because AWS Key Management Service (AWS KMS) Encrypt API actions are helpful for encrypting plaintext values like passwords but not for encrypting a build artifact file, archive, or object.
Question 3: On AWS, a DevOps engineer must create a blue/green deployment procedure for an application. The traffic between the environments must be gradually shifted by the DevOps engineer. <br> The application operates on Amazon EC2 instances and is managed by an Application Load Balancer (ALB). The instances are run as part of an Amazon EC2 Auto Scaling group. Data is stored on an Amazon RDS Multi-AZ DB instance. External DNS is provided by Amazon Route 53. <br> To achieve these criteria, which combination of steps should the DevOps engineer take?
- Configure the new EC2 instances to use the primary RDS DB instance.
- Create a second Auto Scaling group behind a second ALB.
- In Route 53, create a second alias record that points to the new environment. Use a weighted routing policy to choose between the two records.
- All of the above (Correct answer)
Correct answer: All of the above
A blue/green deployment has two distinct settings. The blue environment has Amazon EC2 instances running the current production version of the application in an Auto Scaling group. The green environment comprises EC2 instances from a different Auto Scaling group that are running the updated version of the application. Because each Auto Scaling group is behind its own Application Load Balancer (ALB), you may create two Alias records as endpoints in Amazon Route 53 and use a weighted routing strategy to progressively move traffic from the blue ALB to the green ALB. Unless schema modifications are required for the new release, it is advisable to point both environments to the same database to ensure data consistency throughout the cutover. <br> Option F is wrong since it requires two ALBs as endpoints in order to utilize Route 53 to progressively transfer traffic. Option D is wrong because until a health check detects a failure, a failover routing strategy transmits all traffic to a single endpoint. As a result, this option cannot progressively shift traffic. Option A is wrong since the hot standby instance in an Amazon RDS Multi-AZ DB instance is not available for reads or writes.
Question 4: A business runs an application on Amazon EC2 instances using the most recent version of the Amazon Linux 2 AMI. When server administrators implement new security updates, they manually remove impacted instances from service, patch the instances, and reinstall the instances. <br> A new security policy mandates that the corporation implement security updates within 7 days of their release. The company's security staff must ensure that all EC2 instances follow this policy. The patching must take place at the least disruptive period for users. <br> Which solution will ensure that these needs are met automatically?
- Create a sript to apply any availabe security patches. Create a cron job to schedule the script to run during a maintenance window. Install the script and cron job on the application AMI. Redeploy the application.
- Use AWS Systems Manager Patch Manager to create a patch baseline. Create a script on the EC2 instances to use the AWS CLI to pull the latest patches from Patch Manager. Create a cron job to schedule the script to run during a maintenance window.
- Enlist all the EC2 instances in an AWS Systems Manager Patch Manager patch group. Use patch Manager to create a patch baseline. Configure a maintenance window to apply the patch baseline. (Correct answer)
- Configure an AWS CodeBuild project to download and apply patches to all the instances over SSH. Use an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule to run the Codebuild project during a maintenance window.
Correct answer: Enlist all the EC2 instances in an AWS Systems Manager Patch Manager patch group. Use patch Manager to create a patch baseline. Configure a maintenance window to apply the patch baseline.
Patch Manager, an AWS Systems Manager function, will automatically run security fixes during a maintenance window based on a list of acceptable patches that you designate in a patch baseline. The company's security staff may check the patch compliance of the instances in the Systems Manager console or extract a summary using the AWS CLI. <br> Option D is wrong since AWS CodeBuild generates artifacts from your source code. Patches are not deployed to instances via CodeBuild. Option B is wrong since the Amazon Linux 2 preinstalled Systems Manager Agent (SSM Agent) does not need to be scheduled to fetch the fixes. Only a Systems Manager maintenance window has to be associated with the patching configuration. Option A is wrong because it lacks a method for the security team to verify patch compliance. The cron job also has a single point of failure as an option.
Question 5: All of a company's AWS accounts utilize AWS CloudTrail, which delivers all trails to the same Amazon S3 bucket. The organization uses S3 event notifications and an AWS Lambda code to deliver defined events to a third-party logging solution. <br> A security services provider has been asked by the business to set up a security operations center. The security services provider would want to receive CloudTrail logs via an Amazon Simple Queue Service (Amazon SQS) queue. <br> To send events to the third-party logging solution, the business must continue to use S3 event notifications and the Lambda function. What is the MOST EFFECTIVE strategy to achieve these requirements?
- Configure the trail to send logs to Amazon CloudWatch Logs. Subscribe the SQS queue to the CloudWatch Logs log group.
- Replace the existing S3 event notification destination with an Amazon Kinesis data stream. Create consumers for the Lambda function and the SQS queue.
- Replace the existing S3 event notification destination with an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the Lambda function and the SQS queue to the topic. (Correct answer)
- Add an additional notification to the S3 bucket for all CreateObject events to send all objects to the SQS queue.
Correct answer: Replace the existing S3 event notification destination with an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the Lambda function and the SQS queue to the topic.
You can change the S3 event notification destination to an Amazon Simple Notification Service (Amazon SNS) subject to build a fanout messaging scenario for Amazon S3 event notifications of one event to multiple consumers. You may subscribe to the subject with numerous consumers, including the AWS Lambda function and the Amazon Simple Queue Service (Amazon SQS) queue, without modifying the Lambda function code. <br> Because of overlapping notification event prefixes and suffixes, Option D is not acceptable and will result in a "Configuration is ambiguously defined" problem. Because Amazon Kinesis Data Streams is not a viable S3 event notification destination, Option B is invalid. Option A is unacceptable since it provides an insufficient solution. You cannot subscribe a SQS queue to an Amazon CloudWatch Logs log group directly.
Question 6: A development team is working on an application that will serve a huge number of customers across three AWS Regions. To provide low-latency data access, the application will use an Amazon DynamoDB database that must be accessible in all three Regions. When one Region updates the database, the changes must be smoothly propagated to the other Regions. <br> What is the LEAST operational overhead a DevOps engineer should do when configuring the table to match these requirements?
- Use DynamoDB global tables to configure a primary table in one Region and a read replica in each of the other Regions.
- Configure a multi-Region, multi-active DynamoDB global table that includes the three Regions. (Correct answer)
- Configure three DynamoDB tables in each of the three regions. Use the AWS SDK for DynamoDB to synchronize data changes among the tables.
- Create a DynamoDB table in each of the three Regions. Give each table the same name.
Correct answer: Configure a multi-Region, multi-active DynamoDB global table that includes the three Regions.
Amazon DynamoDB global tables begin as single-region tables and may be expanded to support multi-region and multi-active workloads. Global tables allow low-latency data access to Region-specific workloads without having you to build or manage a replication solution. <br> Option D is inappropriate since using a distinct table in each Region would need the adoption of an additional replication solution. Option C is inappropriate because creating and managing a synchronization mechanism across the tables would be an unnecessary operational overhead. Option A is incorrect because global tables are multi-regional, multi-active tables without read replicates.
Question 7: A business has a legacy API that is served by a fleet of Amazon EC2 machines behind a public Application Load Balancer (ALB). The ALB supports access logging and saves the logs on Amazon S3. The API may be accessed using the hostname api.example.com. The firm manages the hostname via Amazon Route 53. <br> Developers rebuilt five API endpoints using a distinct AWS Lambda function for each endpoint. A DevOps engineer want to test the new Lambda functions with a small number of random consumers. To guarantee compatibility with an existing log processing service, the test must not change the ALB access logs. <br> To achieve these objectives, how should the DevOps engineer conduct the test?
- Create a new target group for each Lambda function. On the ALB, create new listener rules that include a path condition that matches each of the different endpoints. Set the rules to be weighted between the Lambda function target group for that endpoint and the instance-based target group. (Correct answer)
- Create a new ALB and a new target group for each Lambda function. Create a new listener rule that includes a host header condition that matches each of the endpoints and forwards traffic to the traget groups. Create a new Route 53 alias record with a weight of 10. Update the existing Route 53 record for the api.example.com hostname with a weight of 90.
- Create a single target group that includes all the Lambda functions as individual targets. On the ALB, create a new listener rule that includes a host header condition that matches the API endpoint's hostname. Add the target group to the listener rule. Specify a lower weight for the new target group than the weight of the default rule's target group.
- Add the five Lambda functions as targets to the existing target group for the EC2 instances. Set the weight in the target group of each Lambda function target to be less than the EC2 instance targets. Amend the default rule on the ALB to enable target group-level stickiness.
Correct answer: Create a new target group for each Lambda function. On the ALB, create new listener rules that include a path condition that matches each of the different endpoints. Set the rules to be weighted between the Lambda function target group for that endpoint and the instance-based target group.
Adding a weighted target group for each Lambda function to the existing ALB lets the engineer split traffic per endpoint while keeping the same ALB — so the access logs to S3 stay unchanged and the log processor keeps working. Path-condition listener rules route each endpoint to the right pair of target groups (Lambda vs. EC2), and weighting sends only a small, random share to the new functions. The Route 53 options are wrong because a new ALB or alias record would create separate logs and break the existing log pipeline. A single target group mixing all Lambdas, or adding Lambdas to the EC2 target group, can't route per-endpoint or weight traffic correctly.
Free DevOps Engineering on AWS Certification Trivia Questions and Answers
In AWS Code Commit, a corporation has control over the source code for an application.
Using AWS CodePipeline, the firm is developing a CI/CD pipeline for the application.
When modifications are made to the main branch of the CodeCommit repository, the pipeline must begin automatically.
Because changes occur on a daily basis, the pipeline must be as responsive as feasible.
What should a DevOps engineer do to achieve these requirements?
What Practice Test Geeks adds beyond an AI chat for DevOps Engineering on AWS Certification
An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:
- A fixed DevOps Engineering on AWS Certification question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
- Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
- A printable DevOps Engineering on AWS Certification cheat sheet you can print or save as a PDF.
- DevOps Engineering on AWS Certification flashcards built from the same question bank.
These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- docs.aws.amazon.com — Exam information · verified Oct 2026
- pearsonvue.com — Eligibility · verified Oct 2026
- aws.amazon.com — Test delivery, fees, exam format, time limit, score validity, renewal, passing score, retake policy, score release, exam information · verified Oct 2026