Testing and Deployment practice questions

Answer: A) The minimum number or percentage of instances that must stay healthy, which determines how many instances are updated at once

For EC2/On-Premises deployments, a CodeDeploy deployment configuration sets minimum healthy hosts, which controls how many instances are updated at a time. OneAtATime is the default.

• AFor the EC2/On-Premises compute platform, a deployment configuration uses a minimum healthy hosts value to set how many instances must stay available during the deployment. OneAtATime deploys to one instance at a time, HalfAtATime to up to half, and AllAtOnce to as many as possible.
• BLifecycle event hooks are defined in the AppSpec file, and CodeDeploy runs them in a fixed event order. The deployment configuration does not control this order.
• CCanary and linear traffic shifting is how deployment configurations work for the Lambda and Amazon ECS compute platforms. EC2/On-Premises configurations are defined by minimum healthy hosts.
• DAutomatic rollback is set in the deployment group or deployment rollback settings, not in the deployment configuration.

Answer: A) Run retry-stage-execution for the Deploy stage and the current execution ID with --retry-mode FAILED_ACTIONS

CodePipeline can retry a failed stage within the same execution. The FAILED_ACTIONS mode runs only the failed actions again, and ALL_ACTIONS runs the whole stage again. Starting a new execution always begins at the Source stage.

• ACorrect. CodePipeline lets you retry a failed stage without running the pipeline again from the beginning. The FAILED_ACTIONS mode (Retry failed actions in the console) runs only the failed actions in that stage again, and the pipeline continues if they succeed.
• BIncorrect. start-pipeline-execution creates a new execution that starts from the Source stage, so Source and Build would run again. It does not resume a failed execution.
• CIncorrect. ALL_ACTIONS (Retry stage) runs every action in the stage again, starting from the first one, including the action that succeeded. Only FAILED_ACTIONS limits the retry to the failed actions.
• DIncorrect. Stage transitions control whether executions can move into a stage. Turning a transition off and on again does not retry the failed actions of an execution that already ran in that stage.

Answer: A) Create a StackSet with service-managed permissions that targets the OU, and turn on automatic deployment

Only StackSets with service-managed permissions support automatic deployment. When it is turned on, CloudFormation deploys stack instances to accounts as they join a target OU. Self-managed StackSets, nested stacks, and modules do not cover new accounts automatically.

• ACorrect. With service-managed permissions, StackSets deploy to accounts managed by AWS Organizations and create the required IAM roles for you. When automatic deployment is turned on, CloudFormation deploys a stack to any account that is added to a target OU.
• BIncorrect. With self-managed permissions, you must create the IAM roles in each target account yourself, and the StackSet deploys only to the accounts you list. Automatic deployment to new Organizations accounts is a feature of the service-managed model.
• CIncorrect. Nested stacks split one template into reusable pieces that are created as part of a parent stack. They are not a way to deploy across multiple accounts, and they do not respond to accounts being added to an OU.
• DIncorrect. Modules are reusable, versioned resource configurations that you include in your own templates. Each account would still have to deploy a stack that uses the module, so registering a module deploys nothing to new accounts.

Answer: A) It shifts 10% of traffic to the new function version immediately, waits 5 minutes while monitoring for errors, then shifts the remaining 90% if no alarm triggers

• AThis is one of SAM/CodeDeploy's predefined canary deployment presets: an initial small traffic shift (10%), a defined bake time (5 minutes) to observe health via any configured CloudWatch alarms, followed by a full shift to 100% if nothing triggered a rollback.
• BThat describes an all-at-once deployment preference, not a Canary10Percent5Minutes configuration, which is specifically a gradual, monitored rollout.
• CThis setting is about traffic shifting between Lambda function versions within one deployment, not multi-Region deployment distribution.
• DA canary deployment preference like this shifts traffic automatically according to its defined percentages and timing; manual approval is a separate, optional gate (like a CodePipeline approval action), not what this specific setting does.

Answer: C) ApplicationStop → DownloadBundle → BeforeInstall → Install → AfterInstall → ApplicationStart → ValidateService

For an in-place deployment the order is ApplicationStop, DownloadBundle, BeforeInstall, Install, AfterInstall, ApplicationStart, ValidateService. DownloadBundle and Install are reserved for the CodeDeploy agent and can't run scripts.

• AWrong. ApplicationStop runs even before the new revision is downloaded. Its scripts come from the last successfully deployed revision, so it can't come after DownloadBundle.
• BWrong. BeforeInstall runs after DownloadBundle. The agent first copies the revision to a temporary location (DownloadBundle), then BeforeInstall runs pre-install tasks such as decrypting files or backing up the current version.
• CCorrect. This is the documented in-place order. The old application is stopped, the agent downloads the revision, BeforeInstall runs, the agent copies files to their destination (Install), AfterInstall configures the application, ApplicationStart restarts services, and ValidateService runs last. DownloadBundle and Install are reserved for the CodeDeploy agent and can't run scripts.
• DWrong. AfterInstall runs before ApplicationStart. It's meant for tasks such as configuring the application or changing file permissions before the services are started.

Answer: A) Store the password in AWS Secrets Manager and map it to a variable under env/secrets-manager in buildspec.yml

For sensitive values, CodeBuild recommends the buildspec parameter-store or secrets-manager mappings, so only a reference is in source control and the value is resolved and masked at build time. Plaintext or merely encoded environment variables can be read by anyone with access to the repository, console or CLI.

• ACodeBuild recommends the secrets-manager (or parameter-store) mapping for sensitive values. Only the secret's name is in the buildspec. CodeBuild gets the value at build time, and Secrets Manager values are masked in build logs. The service role needs permission to read the secret.
• Benv/variables holds plaintext values. Putting the password there commits it to the Git repository, and AWS strongly discourages storing sensitive values in plaintext environment variables.
• CThis keeps the password out of Git, but plaintext environment variables can still be shown in clear text in the CodeBuild console and AWS CLI. AWS recommends Parameter Store or Secrets Manager for sensitive values.
• DBase64 is an encoding, not encryption. Anyone with repository access can decode the value. Also, a transformed value doesn't match a stored secret, so CodeBuild won't mask it in logs.

Answer: A) The ECS deployment controller with the rolling update strategy

If the defaults are kept, an ECS service uses the ECS deployment controller with a rolling update. Tasks are replaced within the minimumHealthyPercent and maximumPercent limits. Blue/green, CodeDeploy and external controllers all have to be selected explicitly.

• ACorrect. The ECS controller with a rolling update is the default for ECS services. The service scheduler replaces running tasks with new ones, and the minimumHealthyPercent and maximumPercent settings control how many tasks are started or stopped at a time.
• BIncorrect. CodeDeploy blue/green deployments need the CODE_DEPLOY controller to be selected explicitly, along with CodeDeploy resources such as an application and deployment group. It is not the default.
• CIncorrect. The EXTERNAL controller hands deployment control to a third-party tool and has to be configured explicitly. It is not used by default.
• DIncorrect. Native ECS blue/green runs the blue and green service revisions side by side and shifts traffic between them. It must be chosen as the deployment strategy. Rolling update is the default strategy.

Answer: A) Set timeoutInMinutes to 120 in the manual approval action's declaration in the pipeline structure

In CodePipeline, you can set a per-action timeout (timeoutInMinutes) only on manual approval actions, where it overrides the 7-day default. Timeouts for other action types, such as the CodeBuild build action, are fixed service values, and timeouts configured in other services don't change how long an approval waits.

• ACorrect. The ActionDeclaration timeoutInMinutes attribute overrides the default timeout (7 days at the account level) for a single action. It works only for the manual approval action type and accepts values from 5 to 86400 minutes.
• BIncorrect. A CodeBuild project timeout only limits how long that project's builds run. It has no effect on how long a separate approval action waits for a response.
• CIncorrect. The SNS delivery policy controls retries for notification delivery. It doesn't change how long CodePipeline keeps the approval action waiting before marking it failed.
• DIncorrect. That option only controls how long the local CLI waits for a socket read. It doesn't affect any timeout inside the pipeline.

Answer: A) Push the image to an Amazon ECR repository, set the image URI in the project's environment settings, and grant CodeBuild pull access to the repository

CodeBuild can run builds in a custom Docker image that the project's environment configuration references, usually from Amazon ECR (or a private registry with credentials in Secrets Manager). The ECR repository policy must allow CodeBuild to pull the image when CodeBuild credentials or a cross-account image is used.

• AA CodeBuild project's environment can reference a custom image URI in Amazon ECR. If the project pulls with CodeBuild credentials, or the image is in another account, the ECR repository policy must allow the pull actions (ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, ecr:BatchCheckLayerAvailability) for the codebuild.amazonaws.com service principal or the project's account.
• BThe runtime-versions section picks language runtimes that are already in the CodeBuild-managed images. It cannot replace the build environment's container image with a custom Docker image.
• CCodeArtifact stores software packages such as npm, PyPI, and Maven artifacts. It is not a container image registry that CodeBuild can pull its build environment from.
• DThe project's source location holds the code to build, not the build environment. CodeBuild does not load a container image from a source tarball. The image must come from a registry such as Amazon ECR, or from a private registry with credentials in Secrets Manager.

Answer: A) Create an EventBridge rule whose event pattern matches source aws.codepipeline, the pipeline execution state-change detail type, and state FAILED, with the Lambda function as the target

CodePipeline natively publishes pipeline, stage, and action execution state-change events to EventBridge. A rule matching source aws.codepipeline with state FAILED can invoke a Lambda target that posts to Slack, which gives near-real-time alerts without polling.

• ACodePipeline emits 'CodePipeline Pipeline Execution State Change' events to EventBridge, including a FAILED state. A rule that matches this pattern invokes the Lambda target in near real time, with no polling and no changes to the pipeline.
• BPolling on a schedule adds delay (up to the polling interval), extra code, and extra invocations. It can also miss or repeat failures between polls. The native state-change event already gives this information when the failure happens.
• CStartPipelineExecution records when an execution starts, not how it ends. A pipeline failure is not an API call made by a user, so this rule would fire on every start and never report the failure.
• DWhen a pipeline is an EventBridge target, the rule starts the pipeline; the rule does not receive events from it. Pipeline actions also run in order as stages succeed. You cannot set a final action to run only when an earlier stage fails.