Route 53 health checks<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Artifact encryption and integrity controls<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CodePipeline artifacts can contain source packages, compiled application files, deployment templates, and other data that moves between pipeline stages. Protecting these artifacts is important because an unauthorized modification could cause an untrusted or incorrect package to reach production. Artifact stores can use encryption, including AWS KMS keys, to protect data at rest, while appropriate IAM permissions and bucket policies restrict who can access or modify the artifacts. Pipelines should also use controlled artifact locations and tightly scoped permissions. These practices help maintain the integrity of artifacts throughout the CI\/CD process and reduce the possibility of unauthorized changes being introduced between stages.<\/span><\/p>\nQuestion 202. What does a CodeBuild batch build allow?<\/b><\/h3>\n\n- <\/b> Running only one command per build<\/span>
\n<\/span>2.<\/b> Disabling build logs<\/span>
\n<\/span>3.<\/b> Running multiple related builds as one build operation<\/span>
\n<\/span>4.<\/b> Automatically creating IAM users<\/span><\/li>\n<\/ol>\nCorrect Answer: 3. Running multiple related builds as one build operation<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS CodeBuild batch builds allow multiple build executions to be coordinated as part of a single batch operation. This is useful when a project needs to build several configurations, platforms, environments, or test variations at the same time. Instead of manually starting separate builds and tracking them independently, a batch build can coordinate the related executions and report their results together. This capability is particularly useful for large CI workflows where different combinations need to be tested. Batch builds can improve automation and reduce unnecessary orchestration logic while still allowing each individual build to use its own commands, environment settings, and artifacts when configured appropriately.<\/span><\/p>\nQuestion 203. Which cache type can store CodeBuild dependencies in Amazon S3?<\/b><\/h3>\n\n- <\/b> S3 cache<\/span>
\n<\/span>2.<\/b> DNS cache<\/span>
\n<\/span>3.<\/b> Route 53 cache<\/span>
\n<\/span>4.<\/b> IAM cache<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. S3 cache<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CodeBuild supports caching to reduce build times by reusing files from previous builds instead of downloading or recreating them every time. An S3 cache stores cached build data in an Amazon S3 location. This can be useful for dependencies, package manager files, and other reusable content that changes less frequently than the application source code. During later builds, CodeBuild can restore the cache before executing the build commands, allowing the process to reuse available files. Cache configuration should be designed carefully because stale or unnecessary cached content can increase storage usage or cause unexpected build behavior. Proper cache paths and invalidation practices help maintain reliable build performance.<\/span><\/p>\nQuestion 204. Why is Docker layer caching useful in CodeBuild?<\/b><\/h3>\n\n- <\/b> It creates IAM policies automatically<\/span>
\n<\/span>2.<\/b> It disables Docker commands<\/span>
\n<\/span>3.<\/b> It replaces Amazon ECR<\/span>
\n<\/span>4.<\/b> It can reuse unchanged Docker layers between builds<\/span><\/li>\n<\/ol>\nCorrect Answer: 4. It can reuse unchanged Docker layers between builds<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Docker images are constructed from multiple layers, and many layers may remain unchanged between builds. Docker layer caching allows CodeBuild to reuse previously created layers instead of rebuilding every layer from scratch. This can significantly reduce the time and resources required to create container images, especially when the Dockerfile contains stable dependency or operating-system layers followed by frequently changing application files. When implementing Docker builds in CodeBuild, the build environment must be configured appropriately for Docker operations, and the cache must be managed so that it remains useful without introducing stale content. Effective layer caching is especially valuable in frequent container-based CI workflows.<\/span><\/p>\nQuestion 205. What does an ECR pull-through cache provide?<\/b><\/h3>\n\n- <\/b> Automatic EC2 patching<\/span>
\n<\/span>2.<\/b> Cached access to images from an upstream public registry<\/span>
\n<\/span>3.<\/b> Lambda function versioning<\/span>
\n<\/span>4.<\/b> CloudFormation stack recovery<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Cached access to images from an upstream public registry<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon Elastic Container Registry pull-through cache rules allow an ECR repository to retrieve container images from supported upstream registries and cache them in an AWS-managed location. When an image is requested through the configured ECR path, ECR can retrieve it from the upstream registry when necessary and then make the image available through the ECR repository. Subsequent requests can use the cached image instead of repeatedly accessing the external registry. This can improve reliability, simplify network access, and provide better control over container image consumption. Organizations can also apply their existing ECR permissions, encryption, monitoring, and repository governance practices to the cached images.<\/span><\/p>\nQuestion 206. Which setting protects ECR images from being replaced by another image using the same tag?<\/b><\/h3>\n\n- <\/b> Tag immutability<\/span>
\n<\/span>2.<\/b> CloudWatch Logs<\/span>
\n<\/span>3.<\/b> ECS desired count<\/span>
\n<\/span>4.<\/b> Lambda concurrency<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Tag immutability<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon ECR tag immutability prevents an existing image tag from being overwritten by another image. Without immutability, a tag such as <\/span>production<\/span> or <\/span>release<\/span> could potentially be moved to a different image, making deployments less predictable. With immutable tags, once a tag is associated with an image, another image cannot reuse that same tag in the repository. This supports safer CI\/CD practices because deployment systems can rely on a tag maintaining its original association. However, teams should still consider using image digests when they require an exact immutable reference to a specific image. Tag immutability is particularly helpful for preventing accidental or unauthorized image replacement.<\/span><\/p>\nQuestion 207. What is the purpose of ECR repository encryption?<\/b><\/h3>\n\n- <\/b> To automatically deploy ECS services<\/span>
\n<\/span>2.<\/b> To change Dockerfile instructions<\/span>
\n<\/span>3.<\/b> To protect container images stored in the repository<\/span>
\n<\/span>4.<\/b> To increase task count<\/span><\/li>\n<\/ol>\nCorrect Answer: 3. To protect container images stored in the repository<\/b><\/p>\n
Explanation:<\/b><\/p>\n
ECR repository encryption protects container images and associated data while they are stored in Amazon Elastic Container Registry. ECR supports encryption using AWS-managed or customer-managed AWS KMS keys depending on the repository configuration and requirements. Encryption helps protect image contents against unauthorized access to stored data, while IAM permissions and repository policies determine who can access or perform actions on the repository. In regulated or security-sensitive environments, customer-managed KMS keys can provide additional control over encryption-related permissions and key lifecycle management. Encryption is one part of a broader container security strategy that should also include access controls, vulnerability scanning, image lifecycle management, and secure deployment practices.<\/span><\/p>\nQuestion 208. Which ECS feature can automatically stop a failing deployment and roll it back?<\/b><\/h3>\n\n- <\/b> ECS deployment circuit breaker<\/span>
\n<\/span>2.<\/b> Route 53 hosted zone<\/span>
\n<\/span>3.<\/b> S3 versioning<\/span>
\n<\/span>4.<\/b> IAM Access Analyzer<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. ECS deployment circuit breaker<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The Amazon ECS deployment circuit breaker can help detect deployments that are unable to reach a stable state. When configured with rollback behavior, ECS can stop a failing deployment and return the service to the last deployment that reached a stable condition. This is useful for automated deployment pipelines because a failed application deployment does not necessarily need to remain active while engineers manually intervene. The circuit breaker works with ECS service deployments and evaluates whether tasks successfully progress toward a stable service. It should be combined with meaningful health checks, appropriate task configuration, and monitoring so that deployment failures are detected accurately and rollback behavior protects service availability.<\/span><\/p>\nQuestion 209. Which ECS setting delays health evaluation after a task starts?<\/b><\/h3>\n\n- <\/b> Maximum healthy percentage<\/span>
\n<\/span>2.<\/b> Health check grace period<\/span>
\n<\/span>3.<\/b> Desired count<\/span>
\n<\/span>4.<\/b> Capacity provider weight<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Health check grace period<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The ECS service health check grace period gives newly started tasks time to initialize before the ECS service scheduler begins considering container health checks when determining whether a task should be considered unhealthy. This is useful for applications that require several seconds or minutes to start, establish connections, load configuration, or become ready to accept traffic. Without an appropriate grace period, ECS might interpret temporary startup failures as permanent health problems and repeatedly replace otherwise healthy tasks. The grace period should be long enough to accommodate normal startup behavior but not excessively long, because an overly large value can delay detection of genuinely failed deployments or unhealthy applications.<\/span><\/p>\nQuestion 210. What do ECS capacity providers help manage?<\/b><\/h3>\n\n- <\/b> Distribution of tasks across compute capacity<\/span>
\n<\/span>2.<\/b> CloudFormation template syntax<\/span>
\n<\/span>3.<\/b> IAM password policies<\/span>
\n<\/span>4.<\/b> CodePipeline artifact encryption<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Distribution of tasks across compute capacity<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon ECS capacity providers help control how ECS services and tasks use available compute capacity. Depending on the architecture, capacity providers can be associated with Amazon EC2 capacity or AWS Fargate and can be used with capacity provider strategies to influence how tasks are distributed. This allows organizations to design more flexible compute strategies instead of relying only on a fixed launch approach. For example, a service can use a capacity provider strategy to influence task placement across available capacity types. Capacity providers are especially useful when teams want ECS services to integrate more directly with their underlying compute capacity management and scaling approach.<\/span><\/p>\nQuestion 211. What does Lambda reserved concurrency primarily control?<\/b><\/h3>\n\n- <\/b> Function log retention<\/span>
\n<\/span>2.<\/b> Maximum concurrent executions for a function<\/span>
\n<\/span>3.<\/b> S3 object versioning<\/span>
\n<\/span>4.<\/b> API Gateway cache size<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Maximum concurrent executions for a function<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Lambda reserved concurrency establishes a dedicated concurrency limit for a specific function. It limits the maximum number of simultaneous executions that the function can consume and also reserves that amount of concurrency for the function from the account’s available concurrency pool. This can help prevent one function from consuming excessive account-level concurrency and affecting other functions. Reserved concurrency is different from provisioned concurrency, which keeps execution environments initialized to reduce startup latency. When configuring reserved concurrency, administrators should consider expected traffic, downstream service limits, and the function’s role within the application. Proper concurrency controls can protect both Lambda capacity and dependent services.<\/span><\/p>\nQuestion 212. What is the main benefit of Lambda provisioned concurrency?<\/b><\/h3>\n\n- <\/b> It removes IAM permissions<\/span>
\n<\/span>2.<\/b> It stores container images<\/span>
\n<\/span>3.<\/b> It keeps execution environments initialized to reduce startup latency<\/span>
\n<\/span>4.<\/b> It creates CloudFormation stacks<\/span><\/li>\n<\/ol>\nCorrect Answer: 3. It keeps execution environments initialized to reduce startup latency<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Lambda provisioned concurrency keeps a configured number of execution environments initialized and ready to process requests. This can reduce the startup latency that may occur when Lambda needs to initialize a new execution environment, which is particularly important for latency-sensitive applications and APIs. Provisioned concurrency can be configured for specific Lambda function versions or aliases and can be adjusted according to expected demand. It does not eliminate the need for correct function configuration, monitoring, or concurrency management. Teams should balance the desired latency characteristics against the additional cost of keeping execution environments prepared. Provisioned concurrency is therefore a useful deployment and performance feature when predictable low-latency invocation behavior is important.<\/span><\/p>\nQuestion 213. Which AppConfig component validates configuration before deployment?<\/b><\/h3>\n\n- <\/b> Validator<\/span>
\n<\/span>2.<\/b> Artifact store<\/span>
\n<\/span>3.<\/b> Capacity provider<\/span>
\n<\/span>4.<\/b> Deployment group<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Validator<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS AppConfig validators can check configuration data before it is deployed to an application. Validators help identify invalid configuration values or structures before those values reach running workloads. AppConfig supports validation approaches such as JSON Schema validation and Lambda-based validation, depending on the configuration requirements. This provides an important safety mechanism for configuration-driven deployments because a syntactically or logically incorrect configuration can potentially cause application failures even when the application code itself has not changed. Using validators as part of the deployment process helps enforce configuration quality and reduces the risk of publishing malformed or unacceptable settings to production environments.<\/span><\/p>\nQuestion 214. What does an AppConfig deployment strategy control?<\/b><\/h3>\n\n- <\/b> IAM user creation<\/span>
\n<\/span>2.<\/b> ECR repository encryption<\/span>
\n<\/span>3.<\/b> CloudTrail log storage<\/span>
\n<\/span>4.<\/b> How configuration changes are gradually deployed<\/span><\/li>\n<\/ol>\nCorrect Answer: 4. How configuration changes are gradually deployed<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An AWS AppConfig deployment strategy determines how quickly a new configuration is made available to application clients. Instead of immediately exposing every client to a new configuration, AppConfig can use controlled deployment strategies that gradually increase the percentage of clients receiving the new configuration. This approach can reduce deployment risk because teams can observe application behavior as the configuration rollout progresses. Deployment strategies can include different growth rates and bake times depending on the desired rollout pattern. When combined with monitoring and deployment alarms, controlled configuration rollout can help detect problems early and support automatic rollback before a faulty configuration reaches the entire application population.<\/span><\/p>\nQuestion 215. Which CloudFormation policy controls what happens to a resource after stack deletion?<\/b><\/h3>\n\n- <\/b> UpdatePolicy<\/span>
\n<\/span>2.<\/b> CreationPolicy<\/span>