Deployment, Provisioning, and Automation practice questions

Answer: A) Fn::ImportValue with the export name prod-net-SubnetID

Fn::ImportValue consumes a value that another stack exported in the same account and Region. It creates a strong reference, so the exporting stack can't be deleted, and the exported value can't be changed, while the import exists.

• ACorrect. Fn::ImportValue returns the value of an output that another stack has exported. After a stack imports a value, CloudFormation blocks deletion of the exporting stack, and changes to the exported value, until all imports are removed.
• BIncorrect. Ref resolves parameters and resources declared in the same template only. It can't reach a resource that another stack's template defines.
• CIncorrect. Fn::GetAtt returns attributes of resources declared in the same template. It can't read resources or outputs from a separate stack.
• DIncorrect. Fn::FindInMap reads values from the Mappings section of the current template. It has no access to other stacks' exports.

Answer: A) Create a one-time action for the group that raises the minimum and desired capacity shortly before 09:00 UTC on Friday

For a known, one-time event with a fixed start time, a scheduled action raises capacity ahead of time. Predictive scaling needs historical patterns, and dynamic policies (target tracking, step) react only after load rises.

• ACorrect. A scheduled action changes the group's desired, minimum and maximum capacity at a date and time you choose, and it can run just once. Raising capacity shortly before the start means the instances are initialized when traffic arrives. A second action can lower capacity afterward, and any existing scaling policies keep working within the new limits.
• BIncorrect. Predictive scaling forecasts load from historical data that shows daily or weekly cycles. A one-time promotion with no earlier occurrence leaves no pattern to learn from, so the forecast would not predict this surge.
• CIncorrect. Target tracking is still reactive: it scales only after the metric rises. A lower target also keeps extra capacity running all the time, and new instances would still need several minutes to initialize after the surge starts.
• DIncorrect. Step scaling responds to a CloudWatch alarm that fires only after the load increases. Larger steps add more instances per action, but the instances still launch after the promotion has begun, not before.

Answer: A) Configure a project cache (Amazon S3 or local) and list the dependency directory under the buildspec cache paths

CodeBuild caching (Amazon S3, or local with source, Docker layer, or custom modes) keeps dependency directories between builds so they don't have to be downloaded again each time. Artifacts, larger compute types, and batch builds don't reuse anything between builds.

• ACorrect. CodeBuild caching stores reusable parts of the build environment and reuses them across builds. The cache type can be Amazon S3, or local with source, Docker layer, or custom cache modes. You specify the dependency directories to keep under the buildspec cache section, so later builds can reuse them instead of downloading them again.
• BIncorrect. Artifacts are build outputs uploaded to a destination. CodeBuild does not restore them into later builds, so the dependencies would still be downloaded every time.
• CIncorrect. A larger compute type can speed up CPU-bound work, but every build would still download the same dependencies from scratch. Nothing would be reused between builds.
• DIncorrect. Batch builds run related builds together, for example in parallel or as a build matrix, but each build still fetches its own dependencies. Batch builds do not keep dependencies between runs.

Answer: A) Give the critical task a lower Priority value than the other registered tasks

Each maintenance window task has a Priority value. Lower numbers are scheduled first, and tasks with the same priority run in parallel. Cutoff behavior and MaxConcurrency don't control the order of tasks.

• ACorrect. Maintenance window tasks are scheduled in priority order, and a lower number means a higher priority. Tasks with the same priority are scheduled in parallel, so giving the critical task the lowest value makes it run first.
• BIncorrect. Cutoff behavior only controls what happens to tasks once the window's cutoff time is reached, such as not starting new invocations. It doesn't decide which task starts first.
• CIncorrect. MaxConcurrency sets how many targets one task runs on at the same time. It doesn't change the order in which the window's tasks are scheduled.
• DIncorrect. Registration order doesn't determine execution order. Tasks are scheduled by their Priority value.

Answer: A) Set it to '{{resolve:secretsmanager:ProdDbSecret:SecretString:password}}'

Use a secretsmanager dynamic reference ({{resolve:secretsmanager:secret-id:SecretString:json-key}}) to pull a stored secret into a resource property when the stack is deployed, without hardcoding the value or passing it as a parameter.

• ACorrect. A secretsmanager dynamic reference with the pattern secret-id:SecretString:json-key gets the value of the 'password' key from the secret when the resource is created or updated. Neither CloudFormation nor Secrets Manager logs keep the resolved value.
• BIncorrect. NoEcho masks the value in the console, but operators still pass the plaintext password in as a stack parameter. This approach also never reads the value already stored in Secrets Manager.
• CIncorrect. Mappings are literal values written into the template, so the password would be hardcoded in the template and its version history.
• DIncorrect. The secret value would have to be published as a stack output, which anyone who can describe the stack or list exports can see. This breaks the requirement.

Answer: A) Use the AWS Cloud Development Kit (AWS CDK) to define stacks with constructs and deploy them through CloudFormation

The AWS CDK lets teams define infrastructure in general-purpose languages such as TypeScript, using reusable constructs, and deploys it through CloudFormation. CloudFormation (even with Fn::ForEach) and SAM templates remain declarative YAML or JSON.

• ACorrect. With the AWS CDK, you define infrastructure in TypeScript, JavaScript, Python, Java, C#/.NET, or Go. You can use reusable constructs, conditionals, loops, composition, and inheritance. The CDK deploys the app through CloudFormation.
• BIncorrect. Fn::ForEach and Conditions add looping and conditional logic, but the templates are still declarative YAML or JSON. The team couldn't write its infrastructure in TypeScript with classes and inheritance.
• CIncorrect. AWS SAM templates extend CloudFormation with shorthand syntax and are declarative. AWS suggests SAM for teams that prefer a declarative approach, and CDK for teams that want to define infrastructure in a programming language.
• DIncorrect. Service Catalog controls how approved products are distributed and provisioned. The products are still built from templates, so the team couldn't write its infrastructure in TypeScript.

Answer: A) Enable managed platform updates, set the weekly maintenance window start time, and set the update level to minor and patch

Elastic Beanstalk managed platform updates apply patch-only or minor-and-patch platform updates during a weekly two-hour maintenance window using immutable updates. Major-version or platform-branch changes still need to be applied manually.

• ACorrect. Managed platform updates (ManagedActionsEnabled with PreferredStartTime) schedule new platform versions into a weekly two-hour maintenance window. An UpdateLevel of 'minor' applies both minor and patch updates. The updates run as immutable updates, so capacity isn't reduced.
• BIncorrect. UpdateLevel accepts only 'minor' or 'patch'. Managed platform updates don't apply major versions or move to a different platform branch, because those changes can be backward incompatible.
• CIncorrect. A deployment policy controls how application versions and configuration changes are rolled out. It doesn't detect or schedule new platform versions, and a 100 percent batch would take every instance out of service at once.
• DIncorrect. Patch Manager patches the operating system on running instances in place, but it doesn't change the environment's Elastic Beanstalk platform version. Instances that Elastic Beanstalk launches later still use the original platform version.

Answer: A) An execution waiting to enter a locked stage can be overtaken by a newer execution, and the older one does not continue

CodePipeline uses SUPERSEDED mode by default: a newer execution can overtake an older one that is waiting between stages. QUEUED and PARALLEL modes must be set explicitly and require V2 pipelines.

• ACorrect. SUPERSEDED is the default mode. Each stage processes one execution at a time. An execution waiting in front of a locked stage can be overtaken by a more recent execution, and the superseded execution does not continue. Superseding happens only between stages.
• BIncorrect. This describes QUEUED mode, where waiting executions don't overtake earlier ones. It isn't the default, and it requires pipeline type V2.
• CIncorrect. This describes PARALLEL mode. It isn't the default, it requires pipeline type V2, and stage rollback isn't available in it.
• DIncorrect. A stage stays locked while an execution is in progress. Only executions waiting between stages are superseded. An execution that is already inside a stage is not abandoned by a newer one.

Answer: A) Deploy to a cloned environment, then use Swap environment URLs to exchange the two environments' CNAMEs

Blue/green deployment in Elastic Beanstalk means deploying to a separate environment and then swapping environment URLs (CNAMEs). The old environment stays intact for a fast rollback. Immutable, traffic-splitting and rolling policies all update instances inside the same environment.

• ACorrect. This is a blue/green deployment. The new version runs and is tested in its own environment. Swapping environment URLs exchanges the CNAME records, so traffic moves to the new version at once. The original environment keeps running, so swapping back gives an immediate rollback.
• BIncorrect. An immutable deployment launches new instances in a temporary Auto Scaling group, but it does this inside the same environment. It does not use a DNS swap. After a successful deployment, the old instances are replaced, so no separate old environment is left to switch back to.
• CIncorrect. Traffic splitting is a canary deployment inside the same environment. It uses the load balancer to send a percentage of traffic to new instances, not a DNS swap. If the new instances stay healthy, the old instances are terminated, so no separate environment remains.
• DIncorrect. This policy updates the existing environment in batches and adds an extra batch to keep full capacity. It does not create a separate tested environment or use a DNS cutover. When it finishes, no old environment is left to switch back to.

Answer: A) Create a Systems Manager State Manager association that runs the AWS-ApplyChefRecipes document on a schedule with compliance reporting turned on

With OpsWorks retired, the AWS-native way to keep running existing Chef cookbooks is a Systems Manager State Manager association that uses AWS-ApplyChefRecipes. It runs on a schedule to enforce the desired state and reports drift through Systems Manager Compliance.

• ACorrect. State Manager associations can run the AWS-ApplyChefRecipes document against Linux managed nodes. The document installs the Chef client, pulls cookbooks from Git, GitHub, HTTP or Amazon S3, and runs the run list on a cron or rate schedule. It can also report noncompliant Chef resources to Systems Manager Compliance.
• BIncorrect. AWS OpsWorks Stacks, along with the other OpsWorks offerings, has reached end of life and can no longer be used to manage instances. AWS recommends moving these workloads to AWS Systems Manager.
• CIncorrect. AWS Config records resource configurations and checks them against rules. It does not run Chef cookbooks inside the operating system to install packages or manage files on the instances.
• DIncorrect. Image Builder applies configuration only when it builds an image. It does not reapply the cookbooks to instances that are already running, and it does not report drift on them.