Deployment, Provisioning, and Automation practice questions

Answer: A) An entry in the Outputs section whose Value is !Ref of the VPC and that includes an Export with a Name

For a cross-stack reference, the producing stack declares an Outputs entry with an Export Name, and the consuming stack retrieves the value with Fn::ImportValue in the same account and Region.

• ACorrect. Fn::ImportValue can only retrieve values that another stack has exported. A stack exports a value through the Export field (with a Name) on an entry in its Outputs section, and the export name must be unique in the account and Region.
• BIncorrect. Without an Export, the output can only be viewed (for example, with describe-stacks). It isn't published as an export, so Fn::ImportValue in another stack can't resolve it.
• CIncorrect. Parameters are input values a stack receives when it is created or updated. They don't publish anything for other stacks to import.
• DIncorrect. Mappings are static lookup tables that only the same template can read, using Fn::FindInMap. They aren't shared with other stacks.

Answer: A) Turn on Default Host Management Configuration in Fleet Manager for us-east-1 and select the default EC2 instance management role

Default Host Management Configuration, turned on separately in each Region, uses a default IAM role so that Systems Manager can manage EC2 instances without an instance profile on each one. Instances must use IMDSv2 and SSM Agent 3.2.582.0 or later.

• ACorrect. Default Host Management Configuration applies a default IAM role so that Systems Manager can manage EC2 instances in the account and Region where it is turned on, with no instance profile needed. It must be turned on in each Region separately, and instances must use IMDSv2 and SSM Agent 3.2.582.0 or later. These conditions are met here.
• BIncorrect. SSM Agent on the instance needs credentials of its own to register with Systems Manager. Giving permissions to the person or role that launches the instances doesn't give the instances any credentials.
• CIncorrect. A State Manager association only runs on instances that are already managed by Systems Manager. Updating SSM Agent doesn't give unmanaged instances the permissions they need to register.
• DIncorrect. VPC endpoints give instances private network access to Systems Manager, but they don't give SSM Agent any IAM permissions. Without an instance profile or Default Host Management Configuration, the instances still can't register.

Answer: A) Create a CloudFormation service role that has the permissions to manage the stacks' resources and that CloudFormation can assume; B) Give the developers CloudFormation stack permissions and iam:PassRole for that service role only

A CloudFormation service role, plus iam:PassRole limited to that role, lets users deploy stacks without having the resource permissions themselves.

• ACorrect. With a service role, CloudFormation makes resource calls with the role's permissions instead of the caller's, so developers don't need those permissions themselves.
• BCorrect. To use a service role, the user must be allowed to pass it to CloudFormation. Limiting iam:PassRole to that one role stops developers from passing more powerful roles.
• CIncorrect. This gives developers direct access to everything, which is exactly what the security team wants to avoid.
• DIncorrect. Termination protection only prevents stacks from being deleted. It has nothing to do with which permissions are used to create resources.
• EIncorrect. A stack policy protects stack resources from unintended updates. It doesn't grant or remove permissions to create resources.

Answer: A) An ECR pull through cache rule for Docker Hub

ECR pull through cache rules cache images from upstream registries (Docker Hub needs credentials in Secrets Manager), avoiding upstream rate limits.

• ACorrect. A pull through cache rule lets clients pull an upstream image through a private ECR namespace. ECR caches it and refreshes it from the upstream registry. Docker Hub requires authentication, so the rule uses a Secrets Manager secret with the credentials.
• BIncorrect. Replication copies images between Regions and accounts of ECR registries. It can't pull from Docker Hub.
• CIncorrect. Immutability stops tags from being overwritten. It doesn't fetch images from Docker Hub.
• DIncorrect. Lifecycle policies only expire images already in ECR. They don't bring images in from another registry.

Answer: A) A tag-based group in AWS Resource Groups whose query matches the App=Payroll tag

A tag-based group in AWS Resource Groups automatically includes every resource in a Region that matches its tag query. It gives one page to view the application's resources and can be used as a target for bulk operational tasks.

• ACorrect. A tag-based resource group gets its members from a query on resource types and tags, so matching resources in that Region are included automatically. The group gives one page to view and manage the resources, and integrated services can run bulk actions, such as patching, against the group.
• BIncorrect. Organizational units hold AWS accounts, not individual resources such as EC2 instances or RDS databases. They are used to apply policies to accounts, not to manage one application's resources together.
• CIncorrect. Inventory collects software and configuration metadata from managed nodes. It doesn't create a named collection that includes resources such as RDS instances and load balancers.
• DIncorrect. A Config aggregator gathers configuration and compliance data from multiple accounts and Regions. It doesn't create a tag-defined collection of resources that can be targeted for bulk operational tasks.

Answer: B) CloudFormation Git sync for the stack, with a connection to the repository and a stack deployment file on the main branch

CloudFormation Git sync keeps a stack in sync with a template and stack deployment file in GitHub, GitLab or Bitbucket, with no separate pipeline.

• AIncorrect. A webhook can't sign AWS API requests by itself, so something would still have to receive the event and call CloudFormation. That's the custom pipeline the team wants to avoid.
• BCorrect. With Git sync, CloudFormation watches a branch through an AWS CodeConnections connection. When the template or the stack deployment file changes on that branch, CloudFormation updates the stack automatically.
• CIncorrect. A schedule doesn't read the repository, and redeploying on a timer whether or not anything changed would still need custom code.
• DIncorrect. StackSet automatic deployment adds stacks to accounts that join an organizational unit. It isn't triggered by changes in a Git repository.

Answer: C) Config automatic remediation with an SSM Automation runbook

AWS Config auto remediation runs a Systems Manager Automation runbook (AWS-owned or custom) against each noncompliant resource, with no custom code.

• AIncorrect. A notification still leaves the fix to a person.
• BIncorrect. State Manager associations run against managed nodes, not S3 buckets. It also wouldn't be tied to Config's evaluations.
• CCorrect. AWS Config remediation actions run Systems Manager Automation runbooks against noncompliant resources. With automatic remediation, Config runs the runbook as soon as a bucket is flagged, using the role you provide.
• DIncorrect. A conformance pack groups rules for deployment and reporting. Without a remediation action, it still only reports noncompliance.

Answer: A) A custom SSM document of the Command type that defines the steps and their parameters

When no Amazon-owned SSM document fits, create a custom SSM document (a Command document for Run Command). State Manager and maintenance windows only schedule and target existing documents.

• ACorrect. An SSM document defines the actions that Systems Manager performs on managed instances. Run Command uses Command documents. Teams can create their own documents in JSON or YAML, and Systems Manager versions them automatically.
• BIncorrect. A State Manager association applies an existing SSM document to targets on a schedule. It does not define new steps, so a custom document would still be needed.
• CIncorrect. A maintenance window sets when tasks run and which targets they run on. The tasks still call documents, so the window does not define the procedure's steps.
• DIncorrect. AWS Config rules check whether resource configurations are compliant. They do not define a reusable set of commands for Run Command to execute.

Answer: A) A blue/green deployment that reroutes load balancer traffic to the replacement instances and keeps the original instances running

For EC2, a CodeDeploy blue/green deployment installs the revision on a replacement environment and shifts traffic through the load balancer. Keeping the original instances running lets you roll back by routing traffic back to them. An in-place deployment can only roll back by redeploying the previous revision.

• ACorrect. In a blue/green deployment, the revision is installed on a replacement environment, which you can test during an optional wait time. Traffic then moves through the load balancer. If the original instances are kept running, traffic can be routed back to them, which is faster and more reliable than redeploying.
• BIncorrect. An in-place deployment stops the application and installs the new revision on the existing instances, so there is no separate environment to test first. Rolling back means redeploying the previous revision, not rerouting traffic.
• CIncorrect. Automatic rollback on an in-place deployment redeploys the last known good revision onto the same instances. It doesn't provide a separate test environment or a way to roll back by switching traffic.
• DIncorrect. This setup does test on separate instances. But once the original instances are terminated, traffic can't be routed back to them, so it doesn't meet the rollback requirement.

Answer: D) EventBridge notifications on the bucket, with one rule per team

S3 event notifications can't overlap on prefix and event type. EventBridge for S3 allows many rules on the same events with richer filtering, such as object size.

• AIncorrect. Replicating to more buckets adds cost and complexity just to work around notification limits.
• BIncorrect. Each message would be processed by only one consumer, so the three teams wouldn't all receive every event.
• CIncorrect. This couples the teams' functions together, and a failure in the first function would block the others.
• DCorrect. S3 event notifications don't allow overlapping prefixes for the same event type. With EventBridge enabled, S3 sends all events to EventBridge, where several rules can match the same event and filter on fields such as the key and object size.