AWS DevOps Engineer Professional sample questions

Question 1

Which AppSpec hook runs validation after the new Lambda version receives traffic, allowing CodeDeploy to roll back if validation fails?

Accepted Answer

AfterAllowTraffic. Lambda deployments support two hooks, BeforeAllowTraffic and AfterAllowTraffic, each a Lambda function that reports Succeeded or Failed through PutLifecycleEventHookExecutionStatus; AfterAllowTraffic runs once traffic has shifted. ValidateService is a real hook, but only for EC2/on-premises deployments, so it is not available in a Lambda AppSpec.

Question 2

An in-place CodeDeploy deployment targets 10 EC2 instances behind a load balancer. At least 9 instances must serve traffic at all times during the deployment.

Which deployment configuration meets the requirement with the least custom work?

Accepted Answer

CodeDeployDefault.OneAtATime. OneAtATime takes a single instance out of service at a time, so nine of ten stay available throughout the in-place deployment. HalfAtATime is tempting because it is faster, but it allows up to half the fleet (five instances) to be updating at once.

Question 3

A StackSet update to 300 accounts in 4 Regions takes most of a day because it deploys to one account at a time, one Region after another.

Which StackSets operation preferences reduce the rollout time while stopping early if too many accounts fail?

Accepted Answer

Raise the maximum concurrent accounts, set a failure tolerance, and use parallel Region concurrency. Maximum concurrent accounts and Region concurrency control how many stack instances run at once, and failure tolerance sets how many failures are accepted before StackSets stops the operation. Automatic deployment only affects accounts joining OUs later; it does not speed up an update to existing accounts.

Question 4

A risky configuration change must be rolled out with Run Command to 400 instances. The team wants it to reach only a small share of instances at a time and to stop if a couple of instances fail.

Which Run Command settings limit the blast radius?

Accepted Answer

Set MaxConcurrency to 10 percent and MaxErrors to 2. MaxConcurrency limits how many targets run the command at once and MaxErrors stops sending to new targets once that many have failed. MaxErrors of 0 with 100 percent concurrency is the trap: every instance has already received the command before the first error can stop anything.

Question 5

An application runs active-active in two Regions and each Region must be able to write user profiles locally with low latency.

Which DynamoDB feature supports this design?

Accepted Answer

Global tables. Global tables replicate a table across chosen Regions and let applications read and write in every replica Region, which suits active-active designs. A Streams-and-Lambda copier is the tempting do-it-yourself version, but it requires custom conflict handling and operational code that global tables provide natively.

Question 6

An internal invoicing application runs on EC2 with an RDS for MySQL database in eu-west-1. The business sets an RPO of 1 hour and an RTO of 8 hours for a Regional failure, and asks for the most cost-effective design. All infrastructure is already defined in CloudFormation.

Which disaster recovery approach meets these requirements?

Accepted Answer

Backup and restore, with hourly AWS Backup copies to eu-central-1 and the stack redeployed from CloudFormation. With an 8 hour RTO and a 1 hour RPO, hourly backups copied to the recovery Region plus redeploying the stack from templates meets both targets at the lowest running cost. Warm standby and pilot light keep resources running in the second Region for targets this loose. Multi-site is the most expensive strategy and is meant for near-zero RTO.

Question 7

Which of these EC2 metrics requires the CloudWatch agent (or another custom publisher) rather than being available by default?

Accepted Answer

Memory utilization. The hypervisor-level metrics EC2 publishes by default include CPU, network, disk operations for instance store and status checks, but not memory or file-system usage, which require the CloudWatch agent inside the guest OS. CPU utilization is the familiar distractor because it is the headline default metric.

Question 8

How can AWS Config fix a noncompliant resource automatically when a rule evaluates it as NON_COMPLIANT?

Accepted Answer

Attach an automatic remediation action that runs a Systems Manager Automation runbook. AWS Config remediation actions run Systems Manager Automation documents against noncompliant resources, either manually or automatically with retry settings. A periodic trigger only changes how often the rule evaluates; re-evaluating never changes the resource.

Question 9

A role's identity policy allows s3:* on a bucket and all of its objects. The role's permissions boundary allows only s3:GetObject and s3:ListBucket. The account's SCPs allow all actions. There is no bucket policy.

Which S3 actions can the role perform on bucket objects?

Accepted Answer

Only s3:GetObject. Effective permissions are the intersection of what the identity policy, the permissions boundary and the SCPs all allow, and here only s3:GetObject is allowed by all three. All S3 actions is the tempting answer if you forget that a boundary caps the identity policy even when the SCP allows everything.

Question 10

A compliance rule states that all access to a bucket holding customer data must use encrypted connections.

Which bucket policy statement enforces this requirement?

Accepted Answer

Deny all S3 actions when the condition aws:SecureTransport is false. A Deny when aws:SecureTransport is false blocks any request made over plain HTTP, regardless of what other policies allow. The Allow-when-true version is tempting, but other policies can still grant access over HTTP, so an Allow cannot enforce the requirement.

AWS DevOps Engineer Professional sample questions with answers

AWS DevOps Engineer Professional sample questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

More practice