How CloudFormation creates stacks<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. When a secret should be rotated<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Secrets Manager rotation schedules determine how frequently a secret should undergo its configured rotation process. Regular rotation reduces the amount of time that a compromised credential could remain useful. Secrets Manager can work with supported rotation mechanisms to generate a new credential, update the underlying service, and make the new version available to applications. The exact rotation implementation depends on the secret and the associated service. Applications should retrieve the current secret dynamically rather than embedding credentials in source code. Rotation schedules should also account for application behavior because systems that cache credentials for long periods may experience authentication failures if they do not refresh the secret appropriately.<\/span><\/p>\nQuestion 362. Which S3 feature protects pipeline artifacts from accidental overwrite?<\/b><\/h3>\n\n- <\/b> Versioning<\/span>
\n<\/span>2.<\/b> Security groups<\/span>
\n<\/span>3.<\/b> IAM groups<\/span>
\n<\/span>4.<\/b> ECS service discovery<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Versioning<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon S3 versioning maintains multiple versions of objects in a bucket, helping protect important pipeline artifacts from accidental overwrites or deletions. In a CI\/CD architecture, artifacts may include packaged application files, deployment bundles, templates, or other release components. Versioning provides a history of object versions, making it possible to identify or recover an earlier version when supported recovery procedures are used. It does not by itself prevent every form of deletion or unauthorized access, so appropriate bucket policies, IAM permissions, encryption, and lifecycle management should also be configured. For production pipelines, versioning can provide an additional layer of resilience and traceability for artifact storage.<\/span><\/p>\nQuestion 363. Why encrypt CodePipeline artifacts in S3?<\/b><\/h3>\n\n- <\/b> To protect stored artifact data<\/span>
\n<\/span>2.<\/b> To increase ECS capacity<\/span>
\n<\/span>3.<\/b> To create Lambda aliases<\/span>
\n<\/span>4.<\/b> To enable CodeBuild caching<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To protect stored artifact data<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Pipeline artifacts can contain application packages, configuration files, deployment templates, and other information that should not be exposed to unauthorized users. Encrypting artifacts stored in Amazon S3 helps protect their confidentiality while they are at rest. AWS Key Management Service can be used to provide controlled encryption-key management and access policies. Encryption should be combined with restrictive S3 bucket policies, least-privilege IAM permissions, and appropriate artifact-store access controls. In cross-account or cross-Region pipelines, teams should also ensure that the required principals and services can use the encryption key correctly. Protecting artifact storage is an important part of securing the software delivery supply chain.<\/span><\/p>\nQuestion 364. What does an S3 bucket policy control?<\/b><\/h3>\n\n- <\/b> Access to resources in the bucket<\/span>
\n<\/span>2.<\/b> Lambda execution duration<\/span>
\n<\/span>3.<\/b> ECS deployment percentages<\/span>
\n<\/span>4.<\/b> CodeBuild compute size<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Access to resources in the bucket<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An Amazon S3 bucket policy is a resource-based policy that can define who is allowed or denied access to objects and operations associated with the bucket. Bucket policies are commonly used to control access for AWS accounts, IAM principals, services, or specific conditions. In a DevOps environment, an artifact bucket policy might allow a CI\/CD service to read and write pipeline artifacts while denying unrelated principals. Policies can include conditions that restrict access based on factors such as encryption requirements or secure transport. Careful policy design is important because overly broad permissions can expose sensitive artifacts, while overly restrictive policies can interrupt automated deployments.<\/span><\/p>\nQuestion 365. What is an immutable artifact?<\/b><\/h3>\n\n- <\/b> An artifact that is not modified after creation<\/span>
\n<\/span>2.<\/b> An artifact deleted after deployment<\/span>
\n<\/span>3.<\/b> A temporary IAM credential<\/span>
\n<\/span>4.<\/b> A CloudWatch alarm<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. An artifact that is not modified after creation<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An immutable artifact is a release artifact that remains unchanged after it has been created and validated. Instead of rebuilding or modifying the same package between environments, a DevOps pipeline promotes the exact artifact from development through testing and eventually into production. This improves consistency because the artifact tested in an earlier environment is the same artifact deployed later. Immutable artifacts can also strengthen software supply-chain controls by making release contents easier to identify and verify. Container image digests, versioned packages, and uniquely identified deployment bundles are common examples of approaches that support immutability. This strategy reduces uncertainty caused by rebuilding software separately for each environment.<\/span><\/p>\nQuestion 366. Why promote the same artifact across environments?<\/b><\/h3>\n\n- <\/b> To ensure tested code is deployed unchanged<\/span>
\n<\/span>2.<\/b> To increase IAM permissions<\/span>
\n<\/span>3.<\/b> To disable deployment monitoring<\/span>
\n<\/span>4.<\/b> To remove version tracking<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To ensure tested code is deployed unchanged<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Promoting the same artifact across development, testing, staging, and production environments helps ensure that the software validated earlier in the pipeline is the software ultimately released. Rebuilding an application independently for each environment can introduce differences caused by dependency changes, build-time settings, or inconsistent tooling. A controlled artifact-promotion model avoids this problem by creating a versioned artifact once and then moving that exact artifact through progressively stricter environments. Environment-specific configuration can still be supplied separately when required. This approach supports reproducibility, traceability, and reliable rollback because previous artifacts remain identifiable. It is an important DevOps practice for reducing uncertainty during production releases.<\/span><\/p>\nQuestion 367. What is a deployment quality gate?<\/b><\/h3>\n\n- <\/b> A condition that must pass before deployment continues<\/span>
\n<\/span>2.<\/b> An ECS network interface<\/span>
\n<\/span>3.<\/b> An ECR image layer<\/span>
\n<\/span>4.<\/b> An S3 lifecycle rule<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. A condition that must pass before deployment continues<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A deployment quality gate is a condition that must be satisfied before a pipeline is allowed to proceed to a later deployment stage. Quality gates can include automated unit tests, integration tests, security scans, infrastructure validation, code-quality checks, or application health measurements. In a mature CI\/CD pipeline, these checks help prevent known problems from reaching production. Gates can be implemented through CodeBuild results, CodePipeline actions, approval steps, or monitoring-driven deployment controls. The goal is not simply to add more checks, but to establish meaningful criteria that provide confidence in the release. Gates should be automated wherever practical so that deployment remains repeatable and does not depend unnecessarily on manual intervention.<\/span><\/p>\nQuestion 368. Why use automated security scanning in CI\/CD?<\/b><\/h3>\n\n- <\/b> To identify security issues before release<\/span>
\n<\/span>2.<\/b> To increase application memory<\/span>
\n<\/span>3.<\/b> To disable CloudTrail<\/span>
\n<\/span>4.<\/b> To create ECS clusters<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To identify security issues before release<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Automated security scanning integrates security checks directly into the software delivery process so that potential problems can be identified before an application reaches production. Depending on the pipeline, scans can evaluate source code, dependencies, container images, infrastructure definitions, or other release components. Early detection allows teams to address vulnerabilities before they become operational incidents. A security scan should be treated as one component of a broader security program because automated tools can produce false positives, miss certain classes of problems, or depend on vulnerability databases that change over time. Integrating meaningful findings into pipeline quality gates can nevertheless reduce the likelihood of knowingly promoting vulnerable software.<\/span><\/p>\nQuestion 369. What does deployment observability provide?<\/b><\/h3>\n\n- <\/b> Visibility into application and deployment behavior<\/span>
\n<\/span>2.<\/b> Automatic IAM administrator access<\/span>
\n<\/span>3.<\/b> ECR repository deletion<\/span>
\n<\/span>4.<\/b> CloudFormation template compression<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Visibility into application and deployment behavior<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Deployment observability provides information about how an application and its infrastructure behave before, during, and after a release. Useful signals can include request errors, latency, CPU or memory usage, logs, traces, application-specific metrics, and deployment events. These signals help teams determine whether a new release is operating normally or introducing unexpected behavior. In automated deployments, observability can also be connected to alarms that influence rollout or rollback decisions. Effective observability requires meaningful instrumentation and appropriately configured monitoring thresholds. Without reliable operational signals, a pipeline may report that a deployment completed successfully even though users are experiencing application failures.<\/span><\/p>\nQuestion 370. What is the purpose of an automated rollback?<\/b><\/h3>\n\n- <\/b> Restore a previously working release after failure<\/span>
\n<\/span>2.<\/b> Increase build duration<\/span>
\n<\/span>3.<\/b> Disable application monitoring<\/span>
\n<\/span>4.<\/b> Delete deployment history<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Restore a previously working release after failure<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Automated rollback provides a mechanism for returning an application or infrastructure environment to a previously known working state when a deployment causes unacceptable behavior. Rollback can be triggered by failed deployment actions, health checks, CloudWatch alarms, or other predefined conditions depending on the deployment service. The goal is to reduce the duration and impact of production incidents by avoiding prolonged manual recovery. A successful rollback strategy requires that previous versions or configurations remain available and identifiable. Teams should also monitor rollback operations because the rollback itself can fail. Testing rollback procedures in realistic environments is important because an untested recovery mechanism may not behave as expected during an incident.<\/span><\/p>\nQuestion 371. What does a canary deployment initially expose?<\/b><\/h3>\n\n- <\/b> A small portion of traffic to the new version<\/span>
\n<\/span>2.<\/b> All production traffic immediately<\/span>
\n<\/span>3.<\/b> Only development users permanently<\/span>
\n<\/span>4.<\/b> No users under any condition<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. A small portion of traffic to the new version<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A canary deployment initially directs a limited portion of traffic to a new application version while the existing version continues serving the majority of users. The deployment team can then observe metrics such as error rates, latency, resource consumption, and business-specific indicators before expanding traffic. This approach reduces the blast radius of a faulty release because only a subset of users is initially exposed. If the new version behaves correctly, traffic can gradually increase until the new version becomes the primary release. Canary deployments require meaningful monitoring and clear rollback criteria. Without effective observability, the limited exposure does not provide much protection because failures may remain undetected.<\/span><\/p>\nQuestion 372. What distinguishes blue\/green deployment?<\/b><\/h3>\n\n- <\/b> Two environments support controlled traffic switching<\/span>
\n<\/span>2.<\/b> Only one environment can ever exist<\/span>
\n<\/span>3.<\/b> Every deployment requires rebuilding the operating system<\/span>
\n<\/span>4.<\/b> No rollback is possible<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Two environments support controlled traffic switching<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A blue\/green deployment maintains two environments or versions so that traffic can be switched between them in a controlled manner. One environment represents the currently serving version while the other hosts the candidate release. After the new environment has been validated, traffic can be shifted to it. If serious problems are detected, traffic can potentially be redirected to the previous environment, providing a relatively fast recovery mechanism. The exact implementation can vary depending on the AWS services involved. Blue\/green deployment can require additional infrastructure capacity because both environments may need to exist during the transition. Teams should also consider database compatibility and state management.<\/span><\/p>\nQuestion 373. What does a rolling deployment change gradually?<\/b><\/h3>\n\n- <\/b> The number of instances or tasks running the new version<\/span>
\n<\/span>2.<\/b> The AWS account root password<\/span>
\n<\/span>3.<\/b> The S3 bucket name<\/span>
\n<\/span>4.<\/b> The KMS key identifier<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. The number of instances or tasks running the new version<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A rolling deployment gradually replaces instances or tasks running the old application version with instances or tasks running the new version. Instead of switching the entire environment at once, the deployment proceeds in controlled batches. This can reduce infrastructure requirements compared with maintaining two complete environments, although some old and new capacity will coexist during the deployment. ECS deployment parameters such as minimum and maximum healthy percentages influence how many tasks can be stopped and started during the process. Health checks are especially important because they help determine whether new tasks are ready to receive traffic. Rolling deployments should be monitored closely because failures can affect multiple batches if not detected early.<\/span><\/p>\nQuestion 374. What does ECS minimum healthy percentage control?<\/b><\/h3>\n\n- <\/b> The minimum proportion of desired tasks kept healthy during deployment<\/span>
\n<\/span>2.<\/b> The maximum number of IAM users<\/span>
\n<\/span>3.<\/b> The ECR storage quota<\/span>
\n<\/span>4.<\/b> The CloudWatch log retention period<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. The minimum proportion of desired tasks kept healthy during deployment<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The ECS deployment minimum healthy percentage influences how many tasks ECS attempts to keep running and healthy during a rolling deployment. It is expressed relative to the service’s desired task count and helps balance availability against deployment speed. A higher minimum percentage generally places greater emphasis on maintaining running capacity while replacing old tasks, whereas a lower value can allow more old tasks to be stopped before new ones become healthy. The exact deployment behavior also depends on the maximum healthy percentage and available capacity. These settings should be selected according to application availability requirements, cluster capacity, and the characteristics of the deployment process.<\/span><\/p>\nQuestion 375. What does ECS maximum healthy percentage influence?<\/b><\/h3>\n\n- <\/b> How many tasks may run during a deployment<\/span>
\n<\/span>2.<\/b> How many CloudTrail logs are retained<\/span>
\n<\/span>3.<\/b> How many IAM policies exist<\/span>