How ECS clusters are deleted<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. How configuration changes reach targets<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An AWS AppConfig deployment strategy controls how a configuration change is gradually delivered to the applications or environments using that configuration. Instead of immediately exposing every target to a new configuration, a strategy can define how much configuration is deployed initially, how quickly the rollout expands, and how long the system waits between deployment steps. This controlled approach reduces the potential impact of a faulty configuration. Teams can combine deployment strategies with CloudWatch alarms so that problematic changes can be detected during rollout. If monitoring identifies unacceptable behavior, the deployment can be stopped or rolled back according to the configured process, providing a safer method for managing runtime configuration changes.<\/span><\/p>\nQuestion 342. Which AppConfig feature can validate configuration before deployment?<\/b><\/h3>\n\n- <\/b> Validators<\/span>
\n<\/span>2.<\/b> ECS capacity providers<\/span>
\n<\/span>3.<\/b> ECR lifecycle rules<\/span>
\n<\/span>4.<\/b> IAM access keys<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Validators<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS AppConfig validators help verify that configuration data meets defined requirements before it is deployed. Validation can help identify malformed, incomplete, or otherwise unacceptable configuration values before they reach running applications. Validators can be based on supported validation mechanisms, allowing organizations to establish automated checks as part of the configuration management process. This is especially useful for production environments where a configuration mistake could cause application failures even though the application code itself has not changed. Validation should be designed to check meaningful requirements without unnecessarily rejecting valid configurations. Combining validators with staged deployment and monitoring provides multiple safeguards against configuration-related incidents.<\/span><\/p>\nQuestion 343. What does a CloudFormation change set show?<\/b><\/h3>\n\n- <\/b> Proposed stack changes before execution<\/span>
\n<\/span>2.<\/b> Current IAM passwords<\/span>
\n<\/span>3.<\/b> ECR vulnerability reports<\/span>
\n<\/span>4.<\/b> ECS container logs<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Proposed stack changes before execution<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A CloudFormation change set provides a preview of how a proposed stack update is expected to affect resources before the change set is executed. It can help identify resources that will be added, modified, or removed as a result of a template or parameter change. This preview is valuable for infrastructure review because teams can examine the intended changes before applying them to an environment. Change sets are particularly useful in production workflows where infrastructure changes should be reviewed before execution. However, a change set represents CloudFormation’s planned operations and should not be treated as a guarantee that every runtime consequence will be visible before deployment.<\/span><\/p>\nQuestion 344. Why use CloudFormation stack rollback triggers?<\/b><\/h3>\n\n- <\/b> To monitor resources and trigger rollback when specified alarms fire<\/span>
\n<\/span>2.<\/b> To create IAM users<\/span>
\n<\/span>3.<\/b> To scan ECR repositories<\/span>
\n<\/span>4.<\/b> To increase Lambda memory<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To monitor resources and trigger rollback when specified alarms fire<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CloudFormation rollback triggers allow stack operations to monitor specified Amazon CloudWatch alarms during a deployment. If a configured alarm enters the specified unhealthy state during the monitoring period, CloudFormation can roll back the stack operation. This is useful when infrastructure deployment succeeds from CloudFormation’s perspective but the resulting application environment becomes unhealthy. For example, an application deployment might cause error rates or latency to increase even though all infrastructure resources were created successfully. Integrating deployment health signals with CloudFormation provides an additional safety layer. Alarm selection is important because poorly chosen metrics can either fail to detect real problems or cause unnecessary rollbacks during normal temporary fluctuations.<\/span><\/p>\nQuestion 345. What is a CloudFormation custom resource used for?<\/b><\/h3>\n\n- <\/b> Custom provisioning logic not directly supported by CloudFormation<\/span>
\n<\/span>2.<\/b> Automatic ECR image scanning<\/span>
\n<\/span>3.<\/b> ECS task scaling only<\/span>
\n<\/span>4.<\/b> IAM password storage<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Custom provisioning logic not directly supported by CloudFormation<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CloudFormation custom resources allow stack deployments to invoke custom provisioning logic when the required operation is not directly represented by a native CloudFormation resource type. The custom logic can be implemented using supported mechanisms such as AWS Lambda and can respond to CloudFormation create, update, and delete events. This provides flexibility for integrating external systems or performing specialized setup tasks. However, custom resources should be designed carefully because failures in the custom implementation can affect stack operations. The implementation should handle retries, timeouts, idempotency, and cleanup correctly. Organizations should prefer native CloudFormation resources when they provide the required functionality because native resources generally reduce custom operational complexity.<\/span><\/p>\nQuestion 346. What do CloudFormation Hooks enforce?<\/b><\/h3>\n\n- <\/b> Rules before resource operations proceed<\/span>
\n<\/span>2.<\/b> Lambda concurrency limits<\/span>
\n<\/span>3.<\/b> ECR image retention<\/span>
\n<\/span>4.<\/b> ECS service discovery<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Rules before resource operations proceed<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CloudFormation Hooks provide a mechanism for applying governance or validation logic to CloudFormation resource operations. They can help organizations enforce standards before resources are created or modified. For example, an organization might require certain security settings or configuration properties on specific resource types. This helps move infrastructure governance closer to the deployment process instead of relying entirely on manual review after resources have been created. Hooks can therefore support consistent compliance across multiple teams and accounts. Their rules should be carefully designed so that legitimate deployments are not unnecessarily blocked. They work particularly well alongside IAM controls, CloudFormation policies, AWS Config, and automated security checks.<\/span><\/p>\nQuestion 347. What can StackSets automatic deployment simplify?<\/b><\/h3>\n\n- <\/b> Deploying stacks to newly added accounts or organizational units<\/span>
\n<\/span>2.<\/b> Rotating application passwords<\/span>
\n<\/span>3.<\/b> Scanning Docker images<\/span>
\n<\/span>4.<\/b> Managing Lambda memory<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Deploying stacks to newly added accounts or organizational units<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS CloudFormation StackSets can use automatic deployment capabilities to simplify deployment of stack instances across accounts and organizational units. In an AWS Organizations environment, this can help standardize infrastructure when new accounts become part of a targeted organizational unit. Instead of requiring an administrator to manually initiate a stack deployment for every newly added account, StackSets can apply the configured template according to the organization’s deployment settings. This is useful for centrally managed resources such as baseline security configurations, logging infrastructure, or standardized operational components. Proper permission models and deployment preferences remain important because a centrally managed template can affect many accounts and should therefore be tested before broad rollout.<\/span><\/p>\nQuestion 348. What does Systems Manager Automation concurrency control?<\/b><\/h3>\n\n- <\/b> How many targets run an automation simultaneously<\/span>
\n<\/span>2.<\/b> How many IAM users can log in<\/span>
\n<\/span>3.<\/b> How many ECR images exist<\/span>
\n<\/span>4.<\/b> How many CloudFormation templates are stored<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. How many targets run an automation simultaneously<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Systems Manager Automation concurrency settings control how many targets an automation run can process at the same time. This is important when an automation document is applied across many instances or resources because executing every operation simultaneously could place excessive load on systems or exceed operational capacity. By controlling concurrency, teams can roll out changes gradually and maintain better control over the deployment. Automation can also use error thresholds to stop or limit processing when too many targets fail. These controls are valuable for patching, configuration changes, remediation, and other operational workflows where changes need to be distributed safely across a large fleet rather than executed everywhere at once.<\/span><\/p>\nQuestion 349. What does a Systems Manager Automation error threshold provide?<\/b><\/h3>\n\n- <\/b> A limit that can stop processing after failures<\/span>
\n<\/span>2.<\/b> An ECR image tag<\/span>
\n<\/span>3.<\/b> A Lambda alias<\/span>
\n<\/span>4.<\/b> A CodeBuild cache<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. A limit that can stop processing after failures<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A Systems Manager Automation error threshold helps control an automation run by defining how many target failures can occur before the operation is stopped or otherwise prevented from continuing to additional targets. This provides an important safety mechanism for fleet-wide changes. For example, if an automation is updating configuration across hundreds of instances and several early targets fail, continuing without restriction could increase the impact of a faulty procedure. An error threshold allows the organization to establish a predefined failure tolerance. When combined with concurrency controls, it provides two important safeguards: one limits how many targets are changed simultaneously, while the other limits how much failure can occur before intervention is required.<\/span><\/p>\nQuestion 350. Which Systems Manager feature stores hierarchical configuration parameters?<\/b><\/h3>\n\n- <\/b> Parameter Store<\/span>
\n<\/span>2.<\/b> CodeArtifact<\/span>
\n<\/span>3.<\/b> ECR<\/span>
\n<\/span>4.<\/b> CodePipeline<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Parameter Store<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Systems Manager Parameter Store provides centralized storage for configuration values and parameters, including support for hierarchical parameter naming. A hierarchy can organize parameters according to application, environment, or other logical structures. For example, parameters can be arranged under paths representing development, staging, and production environments. Parameter Store supports different parameter types, including SecureString for values that require encryption. IAM policies can then restrict which principals can read or modify specific parameters. This approach reduces the need to hard-code configuration values into application source code or deployment scripts. Proper naming, permissions, and encryption practices help make Parameter Store a useful component of automated deployment architectures.<\/span><\/p>\nQuestion 351. What does EventBridge retry behavior help provide?<\/b><\/h3>\n\n- <\/b> Another delivery attempt when a target invocation fails<\/span>
\n<\/span>2.<\/b> Automatic IAM user creation<\/span>
\n<\/span>3.<\/b> ECR repository encryption<\/span>
\n<\/span>4.<\/b> CloudFormation template compilation<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Another delivery attempt when a target invocation fails<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon EventBridge retry behavior allows an event to be delivered again when invocation of a target fails. Temporary service interruptions or transient target errors do not necessarily require an event to be permanently discarded. Retry settings can define how EventBridge attempts delivery over an appropriate period. For workflows where an event must not be lost, retry behavior can be combined with a dead-letter queue so that events that cannot be successfully delivered after the configured attempts can be retained for later investigation. Retry policies should be designed according to the target’s behavior because repeated invocations can have consequences if the target operation is not idempotent. Reliable event-driven systems therefore consider retries, idempotency, and failure handling together.<\/span><\/p>\nQuestion 352. Why use an EventBridge dead-letter queue?<\/b><\/h3>\n\n- <\/b> To retain events that cannot be successfully delivered<\/span>
\n<\/span>2.<\/b> To increase ECS task count<\/span>
\n<\/span>3.<\/b> To store Docker layers<\/span>
\n<\/span>4.<\/b> To replace CloudTrail<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To retain events that cannot be successfully delivered<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An EventBridge dead-letter queue can retain events that could not be successfully delivered to a configured target after the available delivery attempts have been exhausted. This provides a valuable failure-handling mechanism because an event is not simply lost when the target remains unavailable or rejects the invocation. Operations teams can inspect the retained messages and determine whether remediation or replay is appropriate. Dead-letter queues are particularly useful for important automation events, deployment notifications, and integration workflows. The queue itself should also be monitored because accumulating messages can indicate a persistent problem with the target. Event-driven architectures should combine retries and dead-letter handling with appropriate alerting and operational procedures.<\/span><\/p>\nQuestion 353. What does EventBridge archive and replay enable?<\/b><\/h3>\n\n- <\/b> Retaining events and sending selected events again later<\/span>
\n<\/span>2.<\/b> Encrypting Lambda code automatically<\/span>
\n<\/span>3.<\/b> Creating ECS task definitions<\/span>
\n<\/span>4.<\/b> Updating IAM passwords<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Retaining events and sending selected events again later<\/b><\/p>\n
Explanation:<\/b><\/p>\n
EventBridge event archives allow events to be retained for later use, while replay functionality can send selected archived events back to a supported event bus. This can be useful for testing event-driven applications, recovering from processing problems, or validating new consumers against historical event data. Replay should be used carefully because downstream systems may process the events again, potentially causing duplicate effects if operations are not idempotent. Teams should understand the event time range and filtering criteria used for replay and should monitor downstream services during the process. This capability can reduce operational risk when recovering event-driven workflows because teams do not necessarily need to recreate the original events manually.<\/span><\/p>\nQuestion 354. What can a CloudWatch metric filter create?<\/b><\/h3>\n\n- <\/b> Metrics from matching log patterns<\/span>
\n<\/span>2.<\/b> ECS task definitions<\/span>
\n<\/span>3.<\/b> IAM roles<\/span>
\n<\/span>4.<\/b> ECR repositories<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Metrics from matching log patterns<\/b><\/p>\n
Explanation:<\/b><\/p>\n
CloudWatch Logs metric filters can examine incoming log events for patterns and publish corresponding CloudWatch metrics when matching entries are found. This allows teams to transform useful information embedded in application or infrastructure logs into numerical metrics that can be monitored and alarmed on. For example, an organization could create a metric based on occurrences of an application error string and then configure a CloudWatch alarm when the count exceeds an expected threshold. Metric filters are useful when the required signal is available in logs but is not already exposed as a native metric. The filter pattern should be carefully designed so that it accurately represents the condition being monitored.<\/span><\/p>\nQuestion 355. What is CloudWatch Logs Insights used for?<\/b><\/h3>\n\n- <\/b> Querying and analyzing log data<\/span>
\n<\/span>2.<\/b> Creating IAM policies<\/span>
\n<\/span>3.<\/b>