Deployment

91. A developer must invoke an AWS Lambda function locally with a simulated Amazon API Gateway event before deploying it. Which AWS SAM CLI command meets these requirements?

1. A Run sam validate to check the template for syntax errors.
2. B Run sam deploy --guided to deploy the stack and test the deployed endpoint.
3. C Run sam local start-api to serve the function behind a local HTTP endpoint.
4. D Run sam package to upload artifacts and rewrite the template.

92. An AWS CodePipeline deployment must not proceed to production until a named reviewer approves it. Which solution meets these requirements?

1. A Add an AWS CodeBuild action that pauses for a fixed period before the production stage.
2. B Enable cross-Region replication on the pipeline's artifact bucket.
3. C Add a manual approval action before the production stage and configure an Amazon SNS topic to notify the reviewer.
4. D Add a CloudWatch alarm on the production deployment stage that notifies the reviewer.

93. A container image must be scanned on every push, and the pipeline must fail if any critical vulnerability is found. Which solution meets these requirements?

1. A Enable basic scanning on the Amazon ECR repository and review the findings before each release.
2. B Enable enhanced scanning on the Amazon ECR repository and add a pipeline action that reads the findings and fails on critical severity.
3. C Restrict which IAM principals can push images to the repository.
4. D Add an AWS CodeBuild step that lists the packages installed in the image.

94. Several AWS Lambda functions share the same libraries, and a dependency update must not require repackaging each function. Which solution meets these requirements?

1. A Publish the libraries as a Lambda layer and attach the layer to each function.
2. B Mount an Amazon EFS access point containing the libraries in each function.
3. C Store the libraries in Amazon S3 and download them at the start of each invocation.
4. D Package the libraries into a container image for each function.

95. An AWS CodeBuild project must produce an artifact that AWS CodePipeline passes to a later deployment stage. Which solution meets these requirements?

1. A Declare the output files in the appspec file used by AWS CodeDeploy.
2. B Declare the output files as parameters in the CloudFormation template.
3. C Declare the output files in the artifacts section of the buildspec file.
4. D Declare the output files in the Amazon ECR repository policy.

96. A developer must define AWS infrastructure in TypeScript and have it synthesized into an AWS CloudFormation template. Which solution meets these requirements?

1. A Define the infrastructure with the AWS Cloud Development Kit and run cdk synth.
2. B Define the infrastructure with AWS SAM and run sam build.
3. C Define the infrastructure in an AWS Systems Manager Automation document and run it.
4. D Define the infrastructure in an AWS CodeBuild buildspec and run the build.

97. The same AWS Lambda deployment package must behave differently in test and production without being rebuilt. Which solution meets these requirements?

1. A Build a separate deployment package for each environment from the same source.
2. B Hardcode the environment name in the function code and branch on it.
3. C Deploy the function on a different runtime version in each environment.
4. D Externalize the configuration into environment variables set per alias, or read it from Systems Manager Parameter Store at run time.

98. An artifact that passed testing in staging must be the exact artifact deployed to production. Which solution meets these requirements?

1. A Rebuild the artifact from the same commit during the production stage.
2. B Re-run the build scripts in production and compare checksums after deployment.
3. C Promote the tested artifact through the pipeline without rebuilding it in the production stage.
4. D Rebuild the container image in the production account from the same Dockerfile.

99. A team must shift traffic to a new AWS Lambda version gradually and revert automatically if the error rate rises. Which solution meets these requirements?

1. A Create a second function with the new code and change the API Gateway stage to point at it.
2. B Deploy the function with AWS CodeDeploy using a canary configuration on a Lambda alias, and associate a CloudWatch alarm with the deployment group.
3. C Update the $LATEST version of the function so all invocations receive the new code.
4. D Publish a new version and update the function name referenced by each client application.

100. The same AWS CloudFormation stack must be deployed into twelve accounts across three Regions, and accounts added later must receive it automatically. Which solution meets these requirements?

1. A Create nested stacks in the management account that reference each target account.
2. B Create a CloudFormation StackSet targeting the organizational unit with automatic deployment enabled.
3. C Create the stack manually in each account and Region during onboarding.
4. D Add a CodePipeline stage for each account that deploys the stack.

101. An Amazon API Gateway REST API must expose development and production endpoints that invoke different Lambda aliases and enforce different throttling limits. Which solution meets these requirements?

1. A Create a stage for each environment and use stage variables to select the Lambda alias, with per-stage throttling settings.
2. B Create a single stage and select the environment from a query string parameter.
3. C Create a separate API for each environment with duplicated resources and methods.
4. D Create a separate AWS account for each environment with an identical API in each.

102. A developer must understand the relationship between an AWS Lambda version and an alias. Which statement is correct?

1. A Publish a version and an alias interchangeably, because the two constructs behave identically.
2. B Publish a version to create a mutable pointer, and create an immutable alias that references it.
3. C Publish a version to create an immutable snapshot, and point a mutable alias at it that can also split traffic between two versions.
4. D Publish a version that can reference several aliases simultaneously.

103. A pipeline must run unit tests, deploy to a test environment, run integration tests against it, and then deploy to production. Which solution meets these requirements?

1. A Create a single build action that runs unit and integration tests before any deployment.
2. B Instruct developers to run integration tests locally before committing changes.
3. C Create stages that run integration tests after the production deployment completes.
4. D Create sequential stages that place the integration test stage after the test deployment and before the production deployment.

104. An AWS CodeDeploy blue/green deployment to Amazon ECS must let the team exercise the replacement task set before production traffic is shifted. Which solution meets these requirements?

1. A Configure a test listener on the load balancer and add a validation lifecycle hook that runs before traffic is allowed.
2. B Configure a canary traffic shifting configuration with a one-minute interval.
3. C Add a manual approval action to the pipeline before the deployment stage begins.
4. D Add an AfterAllowTraffic hook that validates the replacement task set.

105. A build must not proceed if a template would create an Amazon S3 bucket with public access. Which solution meets these requirements?

1. A Add a CloudTrail alarm that fires when a public bucket is created.
2. B Add an AWS Config rule that reports public buckets after the stack is deployed.
3. C Add a policy-as-code scanning stage that evaluates the templates and fails the build on a violation.
4. D Add a manual approval action so a reviewer can inspect the template.

106. An AWS CloudFormation template must receive a database password at deployment without the value appearing in the template or the console. Which solution meets these requirements?

1. A Define the password as a template parameter with a Default value containing the password.
2. B Define the password as an entry in the template's Mappings section.
3. C Define the password as a template parameter with NoEcho set to true, or resolve it with a dynamic reference to AWS Secrets Manager.
4. D Define the password as an entry in the template's Outputs section and export it.

107. An AWS SAM template defines eight functions that share the same runtime, timeout, and environment variables. Which solution expresses this most concisely?

1. A Declare the shared properties once in the template's Globals section.
2. B Define the shared properties in the template's Mappings section keyed by function name.
3. C Create a nested stack for each function that defines the shared properties.
4. D Declare the shared properties in each function's Properties section.

108. An AWS CloudFormation template has grown large, and several sections are reused across projects. Which solution meets these requirements?

1. A Extract the reusable sections into nested stacks that the parent template instantiates.
2. B Move the reusable sections into the template's Metadata section.
3. C Replace the template's parameters with hardcoded values to shorten it.
4. D Duplicate the reusable sections into each project's template.

109. An AWS CloudFormation template must read a value from AWS Secrets Manager at deployment without the value appearing in the template or its parameters. Which solution meets these requirements?

1. A Add the secret to the template's Outputs section and export it for other stacks.
2. B Define a template parameter with a Default value containing the secret.
3. C Use a dynamic reference with the secretsmanager resolver in the resource property.
4. D Add the secret to the template's Mappings section keyed by environment.

110. A pipeline must run integration tests against an Amazon API Gateway API that has been deployed to a test stage, using the same test suite for every environment. Which solution meets these requirements?

1. A Run the test suite against the production stage after the production deployment completes.
2. B Run the test suite against a mock integration configured on the production stage.
3. C Deploy the API to the test stage, then run the test suite against the stage's invoke URL supplied as a pipeline variable.
4. D Run the test suite locally on each developer's workstation before committing.

111. An automated test must invoke an AWS Lambda function with a representative Amazon S3 event during the pipeline's test stage. Which solution meets these requirements?

1. A Create a JSON test event that matches the S3 event schema and invoke the function with it from the test stage.
2. B Upload a file to the production bucket so the function is invoked by a real event.
3. C Invoke the function with an empty payload and assert that it does not raise an error.
4. D Deploy the function and wait for the next scheduled production event to occur.

112. An AWS Elastic Beanstalk environment must be updated with no reduction in capacity and no downtime, and the team accepts paying for extra instances during the deployment. Which deployment policy meets these requirements?

1. A Configure the environment to use an all at once deployment policy.
2. B Configure the environment to use a rolling deployment policy.
3. C Configure the environment to use an immutable deployment policy with a shared Auto Scaling group.
4. D Configure the environment to use a rolling with additional batch deployment policy.

113. An AWS CodeDeploy blue/green deployment to Amazon EC2 must stop and roll back if any instance fails application validation. Which solution meets these requirements?

1. A Add a BeforeInstall hook to the appspec file that logs the version being deployed.
2. B Configure the deployment group to use an AllAtOnce configuration with no lifecycle hooks.
3. C Instruct an operator to trigger a rollback if validation fails after the deployment.
4. D Add a ValidateService hook to the appspec file that exits non-zero on failure, and enable automatic rollback on deployment failure.

114. An AWS Elastic Beanstalk deployment must be reversible by discarding the new instances, without touching the instances currently serving traffic. Which deployment policy meets these requirements?

1. A Configure the environment to use an immutable deployment policy.
2. B Configure the environment to use an all at once deployment policy.
3. C Configure the environment to use a rolling deployment policy.
4. D Configure the environment to use a rolling with additional batch deployment policy.

115. An Amazon ECS service must be updated to a new task definition while never dropping below its current healthy task count. Which solution meets these requirements?

1. A Set the service's minimum healthy percent to 0 and the maximum percent to 100.
2. B Disable the service's deployment circuit breaker before starting the deployment.
3. C Increase the service's desired count permanently before starting the deployment.
4. D Set the service's minimum healthy percent to 100 and the maximum percent above 100.

116. An Amazon API Gateway stage must pass an environment-specific value to the AWS Lambda function it invokes, without changing the function code between environments. Which solution meets these requirements?

1. A Define an environment variable on the Lambda function and update it during each deployment.
2. B Encode the environment name in the request path and branch on it inside the function.
3. C Create a separate Lambda function for each environment and change the integration target.
4. D Define a stage variable on each stage and reference it in the integration configuration so the correct Lambda alias is invoked.

117. A team must trigger build, test, and deployment actions automatically whenever code is merged into the main branch. Which solution meets these requirements?

1. A Configure the pipeline's source action to watch every branch in the repository.
2. B Configure the pipeline's source action to watch the main branch so a merge starts an execution.
3. C Configure the pipeline to run on a fixed schedule and pick up whatever has been merged.
4. D Instruct developers to start the pipeline manually after each merge.

118. A release must be identifiable so that a specific deployed version can be traced back to the exact commit that produced it. Which solution meets these requirements?

1. A Record the developer who started the pipeline in the deployment notes.
2. B Name the artifact after the pipeline execution identifier only.
3. C Tag the commit with a release version and propagate that tag to the built artifact and the deployed resource.
4. D Record the deployment date and time in the pipeline execution history.

119. An existing AWS SAM template must be updated to add a new function without redeploying unrelated resources in the stack. Which solution meets these requirements?

1. A Delete the stack and recreate it from the updated template.
2. B Add the function to the template and deploy a change set so only the new and modified resources are acted upon.
3. C Deploy the new function in a separate stack that duplicates the shared resources.
4. D Edit the deployed resources directly in the console and update the template afterwards.

120. A deployment strategy must expose a new version to a small percentage of production traffic for a fixed period before completing the shift. Which deployment configuration meets these requirements?

1. A Configure a canary deployment that shifts a fixed percentage, holds for the configured interval, and then shifts the remainder.
2. B Configure a linear deployment that shifts an equal percentage at regular intervals until complete.
3. C Configure an all-at-once deployment that shifts the whole of the traffic in a single step.
4. D Configure a blue/green deployment that keeps both environments serving traffic indefinitely.

121. A developer must define a serverless application's Lambda functions, API, and table in a template with shorthand syntax. Which solution meets these requirements?

1. A Write a shell script calling the AWS CLI for each resource.
2. B Define the resources in an AWS SAM template and deploy with the SAM CLI.
3. C Create the resources manually and export a CloudFormation template.
4. D Define each resource in the console and document the settings.

122. A container image must be stored so Amazon ECS can pull it during deployment. Which solution meets these requirements?

1. A Push the image to Amazon ECR and reference its URI in the task definition.
2. B Store the image in AWS CodeArtifact.
3. C Store the image in an EBS snapshot.
4. D Store the image as an object in Amazon S3.

123. A build must produce an artifact whose dependencies are resolved from a private repository and a public one. Which solution meets these requirements?

1. A Disable dependency resolution and bundle everything manually.
2. B Configure the build to download from both repositories separately.
3. C Configure AWS CodeArtifact with an upstream connection to the public repository so both resolve through one endpoint.
4. D Vendor all dependencies into the source repository.

124. A developer must test a Lambda function locally before deploying it. Which solution meets these requirements?

1. A Test the function in production with a feature flag.
2. B Deploy the function and invoke it in the console.
3. C Write unit tests only and skip integration testing.
4. D Invoke the function locally with the AWS SAM CLI using a sample event.

125. An integration test must run against AWS services without affecting other developers' resources. Which approach is appropriate?

1. A Deploy an isolated stack per developer or per test run and tear it down afterwards.
2. B Skip integration tests and rely on unit tests.
3. C Run the tests against production resources with a read-only role.
4. D Share a single development environment between all developers.

126. A developer must mock AWS service responses in unit tests without calling the services. Which approach is appropriate?

1. A Inject a mocked client into the code under test so the AWS SDK is not called.
2. B Call the real services with test credentials.
3. C Deploy the code and observe its behaviour.
4. D Skip unit testing for code that calls AWS services.

127. A Lambda function must be updated so that a percentage of invocations use the new version while the rest use the previous one. Which solution meets these requirements?

1. A Create a second function and route in the application.
2. B Publish a new version and configure weighted routing on the alias between the two versions.
3. C Change the function's environment variables.
4. D Update the function code in place.

128. A deployment to Amazon ECS must shift traffic to a new task set and roll back automatically if errors rise. Which solution meets these requirements?

1. A Stop the service and start it with the new task definition.
2. B Scale the service to zero and back up.
3. C Update the service's task definition in place.
4. D Use a blue/green deployment with CloudWatch alarms configured on the deployment group for automatic rollback.

129. An application's configuration must change without redeploying the code, with a gradual rollout. Which solution meets these requirements?

1. A Hardcode the configuration in the application.
2. B Store the configuration in environment variables and redeploy.
3. C Store the configuration in the deployment package.
4. D Manage the configuration in AWS AppConfig with a deployment strategy and a monitor alarm.

130. A CloudFormation stack update must replace a resource, and the developer must know this before applying it. Which indication does a change set provide?

1. A The change set reports only the count of resources affected
2. B The change set reports the estimated cost of the update
3. C The change set reports the time the update will take
4. D The change set reports the replacement as a Replace action on that resource, showing it will be recreated rather than modified

131. A serverless application's deployment package exceeds the size limit for inline editing. Which approach is appropriate?

1. A Split the function into several smaller functions.
2. B Upload the package to Amazon S3 and reference it from the function's configuration.
3. C Increase the function's memory allocation.
4. D Remove dependencies until the package fits.

132. A developer must reproduce a defect that occurs only with production-like data volumes. Which approach is appropriate?

1. A Reproduce the defect in production with additional logging.
2. B Test with a small sample and infer the behaviour.
3. C Increase the test environment's instance size.
4. D Populate a test environment with anonymized production-scale data and reproduce the defect there.

133. An integration test must verify behaviour against a service the team does not control and which rate limits requests. Which approach is appropriate?

1. A Call the live service in every test run.
2. B Request a higher rate limit from the service owner.
3. C Skip testing that integration.
4. D Record the service's responses once and replay them in tests, with a smaller live suite run on a schedule.

134. A deployment must be rolled back automatically if the application's error rate rises after traffic shifts. Which configuration is appropriate?

1. A Associate a CloudWatch alarm on the error rate with the deployment group and enable automatic rollback on alarm.
2. B Deploy during a low-traffic period to limit exposure.
3. C Increase the deployment's wait time before completion.
4. D Monitor the error rate and roll back manually if it rises.

135. A Lambda alias must be updated to a new version while keeping the previous version available for immediate rollback. Which approach is appropriate?

1. A Publish the new version, shift the alias to it, and retain the previous version so the alias can be repointed.
2. B Overwrite the function's code without publishing a version.
3. C Create a second function for the new version.
4. D Delete the previous version after shifting the alias.

136. An application's configuration change must be rolled out gradually with automatic reversion on error. Which approach is appropriate?

1. A Update the configuration and monitor the application manually.
2. B Update the configuration in all environments simultaneously.
3. C Deploy the configuration through AWS AppConfig with a deployment strategy and a monitor alarm attached.
4. D Redeploy the application with the new configuration embedded.

137. A CloudFormation stack update must be prevented from replacing a database resource. Which approach is appropriate?

1. A Apply a stack policy denying Update:Replace on that logical resource.
2. B Remove the resource from the template.
3. C Set a DeletionPolicy of Retain on the resource.
4. D Enable termination protection on the stack.

138. A deployment must verify the application is serving correctly before the previous environment is removed. Which approach is appropriate?

1. A Wait a fixed period before terminating the previous environment.
2. B Run a validation hook against the new environment and only terminate the previous one after it passes.
3. C Terminate the previous environment as soon as traffic shifts.
4. D Terminate the previous environment and monitor for errors.

139. A CloudFormation template must reference a value stored in Systems Manager Parameter Store at deployment time. Which approach is appropriate?

1. A Declare a parameter of the Systems Manager parameter type so the value is resolved when the stack is deployed.
2. B Pass the value as a plain parameter at each deployment.
3. C Read the value in a custom resource.
4. D Hardcode the value in the template.

140. A CloudFormation stack must expose a value for another stack to consume. Which construct is required?

1. A An Output with an Export name, which another stack imports.
2. B A Mapping entry.
3. C A Parameter with a default value.
4. D An Output without an export.

141. A SAM template must define a Lambda function triggered by an API endpoint. Which construct is appropriate?

1. A A separate API Gateway resource with a manual integration.
2. B An S3 event notification on a bucket.
3. C An Api event source on the function resource, which creates the API and the integration.
4. D A CloudWatch Events rule targeting the function.

142. A CDK stack must be deployed to an account and Region for the first time. Which step is required?

1. A Enable CloudFormation in the Region.
2. B Create an S3 bucket manually for the assets.
3. C Increase the account's CloudFormation stack limit.
4. D Bootstrap the account and Region so the CDK's deployment resources exist.

143. A CloudFormation deployment must create resources in a specific order where the dependency is not implied by a reference. Which attribute is appropriate?

1. A Metadata, which attaches arbitrary information.
2. B Condition, which controls whether a resource is created.
3. C DependsOn, which declares an explicit creation dependency between resources.
4. D DeletionPolicy, which controls deletion behaviour.

144. A CloudFormation template must produce different resource properties per environment without maintaining separate templates. Which construct is appropriate?

1. A A separate template per environment.
2. B An Output exporting the environment name.
3. C A hardcoded value changed before each deployment.
4. D A Mapping keyed by environment, referenced with FindInMap.

145. An application's infrastructure code must be tested before deployment. Which approach is appropriate?

1. A Deploy the stack and inspect the created resources.
2. B Validate the template's syntax only.
3. C Run assertions against the synthesized template to confirm the intended resources and properties are present.
4. D Review the template in a pull request.

146. A SAM application must be tested locally with an API endpoint before deployment. Which command is appropriate?

1. A Deploy the application and invoke the deployed endpoint.
2. B Invoke the function directly with a test event.
3. C Run the function's unit tests only.
4. D Start a local API with the SAM CLI so the endpoints can be invoked against the local functions.

147. A CloudFormation stack must be updated without CloudFormation attempting to change a resource modified outside the stack. Which approach is appropriate?

1. A Update the stack and accept CloudFormation reverting the change.
2. B Recreate the stack from scratch.
3. C Run drift detection, reconcile the template with the actual configuration, and then update.
4. D Delete the resource from the template.

148. An infrastructure template must reference a secret without the value appearing in the template or the stack's events. Which approach is appropriate?

1. A Hardcode the secret in the template.
2. B Reference the secret dynamically from AWS Secrets Manager so the value is resolved at deployment without being stored in the template.
3. C Store the secret in an Output.
4. D Pass the secret as a template parameter.

149. A CDK application must reuse a pattern across several stacks with typed configuration. Which construct is appropriate?

1. A A CloudFormation Mapping in each stack.
2. B A copy of the code in each stack.
3. C A custom construct exposing the variable parts as typed properties.
4. D A shell script generating the stacks.

150. A CloudFormation stack must wait for an application on an instance to report readiness before completing. Which construct is appropriate?

1. A A CreationPolicy with a signal sent from the instance when the application is ready.
2. B A WaitCondition with no handle.
3. C An Output exporting the instance identifier.
4. D A DependsOn attribute on the instance.

151. A template must create a resource only when a parameter has a specific value. Which construct is appropriate?

1. A A Metadata block describing the rule.
2. B A Mapping keyed by the parameter.
3. C A Condition evaluated from the parameter, referenced by the resource's Condition attribute.
4. D A DependsOn attribute referencing the parameter.

152. An application's infrastructure must be deployed through a pipeline rather than from a developer workstation. Which benefit does this provide?

1. A Deployments produce smaller templates
2. B Deployments complete more quickly
3. C Deployments are reproducible, reviewed, and auditable rather than depending on an individual's local state
4. D Deployments require fewer permissions

153. A SAM template must grant a function permission to read from a DynamoDB table with minimal policy authoring. Which approach is appropriate?

1. A Attach an inline policy granting dynamodb:* on all tables.
2. B Attach the AWS managed full access policy for DynamoDB.
3. C Attach a SAM policy template such as the DynamoDB read policy, scoped to the table.
4. D Grant the function administrator permissions.