Answers & explanations
Practice Set 1: every answer explained.
All 5 questions from this set, with the correct answer marked and a full explanation of why it is right — and why each plausible alternative is not. 2 of them are multi-answer, which the AWS DevOps Engineer exam uses heavily.Read it as a study sheet, or take the set under timed conditions first and come back.
Every question here is original, written for this site to match the style and difficulty of the real exam. None are reproduced from an actual exam — that would breach the certification agreement and would not teach you anything.
- Q1
A company controls the source code for an application in AWS CodeCommit. The company is creating a CI/CD pipeline for the application by using AWS CodePipeline. The pipeline must start automatically when changes occur to the main branch of the CodeCommit repository. Changes occur frequently every day, so the pipeline must be as responsive as possible.
What should a DevOps engineer do to meet these requirements?
- AConfigure the pipeline to periodically check the repository’s main branch for changes. Start the pipeline when changes are detected.
- BConfigure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect changes to the repository’s main branch. Configure the pipeline to start in response to the changes.Correct
- CConfigure the repository to periodically run an AWS Lambda function. Configure the function to check the repository’s main branch and to start the pipeline when the function detects changes.
- DConfigure the repository to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when changes occur to the repository’s main branch. Subscribe the pipeline to the SNS topic.
Why B
Option B is the recommended solution and is the most responsive of the given options. The change will directly produce the event, and the event will directly start the pipeline. The periodic checks in option A will work, but they will not launch the pipeline until the next periodic check occurs. Option C is not a feature that AWS CodeCommit supports. Option D is not a valid method to start the pipeline.
- Q2Choose 3
A DevOps team has an application that stores critical company assets in an existing Amazon S3 bucket. The team uses a single AWS Region. A new company policy requires the team to deploy the application to multiple Regions. The assets must always be accessible. Users must use the same endpoint to access the assets.
Which combination of steps should the team take to meet these requirements in the MOST operationally efficient way? (Select THREE.)
- AUse AWS CloudFormation StackSets to create a new S3 bucket that has versioning enabled in each required Region. Copy the assets from the existing S3 bucket to the new S3 buckets. Create an AWS Lambda function to copy files that are added to the new S3 bucket in the primary Region to the additional Regions.
- BUse AWS CloudFormation StackSets to create a new S3 bucket that has versioning enabled in each required Region. Create multiple S3 replication rules on the new S3 bucket in the primary Region to replicate all its contents to the additional Regions. Copy the assets from the existing S3 bucket to the new S3 bucket in the primary Region.Correct
- CCreate an Amazon CloudFront distribution. Configure new origins for each S3 bucket. Create an origin group that contains all the newly created origins. Update the default behavior of the distribution to use the new origin group.Correct
- DCreate an Amazon CloudFront distribution. Configure new origins for each S3 bucket. Create a Lambda@Edge function to validate the availability of the origin and to route the viewer request to an available nearby origin.
- ECreate an Amazon Route 53 alias record. Configure a failover routing policy that uses the newly created S3 buckets as a target.
- FCreate an Amazon Route 53 alias record. Configure a simple routing policy that uses the Amazon CloudFront distribution as a target.Correct
Why B and C and F
There are three parts to this question. Part 1 is how to deploy the workload to multiple AWS Regions. Part 2 is how to provide access from a single endpoint for multiple deployments. Part 3 is how to handle failover events by using DNS. Part 1: For option B, AWS CloudFormation StackSets provides an operationally efficient multi-Region deployment strategy for the Region-specific Amazon S3 buckets. S3 replication copies new and existing objects in the primary Region to multiple deployment Regions. Option A is incorrect because it is less operationally efficient. The AWS Lambda function is unnecessary because S3 replication can provide the appropriate functionality without custom code. Part 2: For option C, you can use an Amazon CloudFront distribution to make a single endpoint available to resolve to multiple origins. You can configure CloudFront custom origins to create high availability origin failover that requires a shorter connection timeout, fewer connection attempts, or both. Option D is feasible but is less operationally efficient because it involves custom code within the Lambda@Edge function. The custom code is unnecessary because of native handling within the origin configurations. Part 3: For option F, because the CloudFront origin configurations are handling the failover, Route 53 is providing a simple routing policy user-friendly domain name to the CloudFront distribution. Option E is incorrect because there are not multiple records to benefit from failover routing.
- Q3
A company is using AWS CodeBuild to build an application. Company policy requires all build artifacts to be encrypted at rest. The company must limit access to the artifacts to IAM users in an operations IAM group that have permission to assume an operations IAM role.
Which solution will meet these requirements?
- AAdd a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Set a bucket policy that prevents upload to the bucket unless the request includes the x-amz-server-side-encryption header. Add a Deny statement for all actions with a NotPrincipal element that references the operations IAM group.
- BAdd a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Configure an S3 event notification to invoke an AWS Lambda function to get the object, encrypt the object, and put the object back into the S3 bucket with a tag key of Encrypted and a tag value of True. Set a bucket policy with a Deny statement for all actions with a NotPrincipal element that references the operations IAM group. Include in the policy a Condition element that references the Encrypted tag.
- CAdd a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket that has S3 default encryption enabled. Set a bucket policy that contains a Deny statement for all actions with a NotPrincipal element that references the operations IAM role.Correct
- DAdd a post-build command to the CodeBuild build specification to call the AWS Key Management Service (AWS KMS) Encrypt API operation and pass the artifact to AWS KMS for encryption with a specified KMS key. Push the encrypted artifact to an Amazon S3 bucket. Set up the operations IAM group as the only user for the specified KMS key.
Why C
Amazon S3 default encryption ensures that the artifacts are encrypted at rest. The Deny statement with the NotPrincipal element set to the operations IAM role will deny access to the S3 bucket except for requests that use the role. The scenario implies that the operations role has a permissions policy that allows access to the bucket. Options A and B are incorrect because the bucket policy is referencing the IAM group and not the role. Option A is also incorrect because AWS recommends the use of default encryption over a bucket policy to enforce encryption. Option B also allows artifacts to be stored at rest briefly without encryption. Option D is incorrect because AWS Key Management Service (AWS KMS) Encrypt API operations would be useful for encryption of plaintext values such as a password, but not for encryption of a build artifact file, archive, or object.
- Q4Choose 3
A DevOps engineer needs to implement a blue/green deployment process for an application on AWS. The DevOps engineer must gradually shift the traffic between the environments.
The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group. The application stores data on an Amazon RDS Multi-AZ DB instance. Amazon Route 53 provides external DNS.
Which combination of steps should the DevOps engineer take to meet these requirements? (Select THREE.)
- ACreate a second Auto Scaling group behind the same ALB.
- BCreate a second Auto Scaling group behind a second ALB.Correct
- CIn Route 53, create a second alias record that points to the new environment. Use a failover routing policy to choose between the two records.
- DIn Route 53, create a second alias record that points to the new environment. Use a weighted routing policy to choose between the two records.Correct
- EConfigure the new EC2 instances to use the primary RDS DB instance.Correct
- FConfigure the new EC2 instances to use the standby RDS DB instance.
Why B and D and E
A blue/green deployment consists of two separate environments. The blue environment contains Amazon EC2 instances in an Auto Scaling group that run the current production version of the application. The green environment contains EC2 instances in another Auto Scaling group that run the new version of the application. Each Auto Scaling group is behind its own Application Load Balancer (ALB), so you can configure two alias records as endpoints in Amazon Route 53 and use a weighted routing policy to gradually shift traffic from the ALB for the blue environment to the ALB for the green environment. Unless schema changes are necessary for the new release, it is best to point both environments to the same database so that the data remains consistent during the cutover. Option A is incorrect because you need two ALBs as endpoints so that you can use Route 53 to gradually shift the traffic. Option C is incorrect because a failover routing policy sends all traffic to a single endpoint unless a health check detects a failure. Therefore, this option cannot gradually shift the traffic. Option F is incorrect because the standby instance in an Amazon RDS Multi-AZ DB instance is a hot standby and is not available for reads or writes.
- Q5
A development team is designing an application that has a large customer base spread across three AWS Regions. The application will use an Amazon DynamoDB table that must be available in all three Regions to deliver low-latency data access. When the table is updated in one Region, the changes must seamlessly propagate to the other Regions.
How should a DevOps engineer configure the table to meet these requirements with the LEAST operational overhead?
- ACreate a DynamoDB table in each of the three Regions. Give each table the same name.
- BConfigure three DynamoDB tables in each of the three Regions. Use the AWS SDK for DynamoDB to synchronize data changes among the tables.
- CConfigure a multi-Region, multi-active DynamoDB global table that includes the three Regions.Correct
- DUse DynamoDB global tables to configure a primary table in one Region and a read replica in each of the other Regions.
Why C
Amazon DynamoDB global tables start as single-Region tables that you can make available for multi-Region and multi-active workloads. Global tables provide Region-specific workloads with low-latency data access without requiring you to configure or manage a replication solution. Option A is incorrect because the use of a separate table in each Region would require an additional replication solution. Option B is incorrect because the development and management of a synchronization process across the tables would be unnecessary operational overhead. Option D is incorrect because global tables are multi-Region, multi-active tables that do not have read replicas.
Ready to try it without the answers in front of you?