SDLC Automation

1. A pipeline in a tooling account must deploy into production, staging, and development accounts. Which solution meets these requirements?

1. A Create an IAM user in each target account and store its access keys in the pipeline.
2. B Create a deployment role in each target account trusted by the pipeline, and share the artifact bucket's KMS key with those accounts.
3. C Duplicate the pipeline in each target account and trigger all three on every commit.
4. D Grant the tooling account administrator access in each target account.

2. A build must retrieve a third-party token without the value appearing in the build log. Which solution meets these requirements?

1. A Store the token in AWS Secrets Manager and reference it as a secrets manager environment variable so the value is masked in the log.
2. B Pass the token as a command line argument to the build command.
3. C Store the token as a plaintext environment variable on the build project.
4. D Commit the token to the repository in an encrypted file and decrypt it during the build.

3. A monorepo builds five services, and only the service whose files changed should be built and deployed. Which solution meets these requirements?

1. A Split the repository into five repositories before any further work.
2. B Rebuild and redeploy all five services on every commit to the repository.
3. C Run the pipeline on a nightly schedule so changes are batched.
4. D Detect the changed paths in the source stage and run only the affected service's build and deploy actions.

4. Builds have slowed because each run downloads the same dependency set from scratch. Which solution meets these requirements?

1. A Increase the build project's compute type so the download completes faster.
2. B Run the build inside a VPC so network access is more direct.
3. C Enable build caching for the dependency directory so the download is skipped between runs.
4. D Split the build into two projects that run in parallel.

5. Deployments to production must be blocked outside an agreed change window. Which solution meets these requirements?

1. A Create a CloudWatch alarm on deployment frequency outside the window.
2. B Apply a service control policy denying all actions outside the change window.
3. C Record the change window in the team's runbook for engineers to observe.
4. D Control the production stage transition in the pipeline so promotion is disabled outside the window.

6. A pull request must trigger the full test suite automatically, with the result visible to reviewers before merge. Which solution meets these requirements?

1. A Run the test suite on a nightly schedule and review the results each morning.
2. B Require reviewers to run the test suite locally before approving.
3. C Run the test suite as a post-deployment step after the change is merged.
4. D Trigger a build project on pull request events and report the build status back to the request.

7. A pipeline must run a load test against a deployed environment and fail the stage if latency exceeds an agreed threshold. Which solution meets these requirements?

1. A Run the load test against production after deployment and alert on the result.
2. B Increase the instance size of the test environment so latency is unlikely to breach the threshold.
3. C Run the load test as a pipeline action against the deployed test environment and fail the action when the measured latency breaches the threshold.
4. D Record the latency during normal use and review it at the weekly operations meeting.

8. A deployment must be judged successful or failed based on whether the application process started correctly on each instance. Which solution meets these requirements?

1. A Add a validation lifecycle hook that exits with a non-zero status when the application fails to start.
2. B Add a hook that writes the application's status to the deployment log for later review.
3. C Wait a fixed period after deployment and assume success if no alarm fires.
4. D Check the instance's system status check after the deployment completes.

9. Unit test coverage must be reported on every build and must not fall below an agreed percentage. Which solution meets these requirements?

1. A Generate a coverage report and publish it as a build artifact for review.
2. B Measure coverage quarterly and raise a ticket when it has fallen.
3. C Require developers to confirm coverage in the pull request description.
4. D Generate a coverage report in the build and fail the build when coverage falls below the agreed threshold.

10. A security scan must run against the application's dependencies and block promotion when a critical vulnerability is found. Which solution meets these requirements?

1. A Scan the dependencies quarterly and raise tickets for the findings.
2. B Scan the running application in production and alert on findings.
3. C Scan the dependency manifest as a pipeline stage and fail the stage on critical findings.
4. D Add the approved dependency list to the team's coding standards.

11. An internal library must be published so other teams consume it with standard package tooling, with access controlled by IAM. Which solution meets these requirements?

1. A Publish the library to an Amazon S3 bucket with a hand-built package index.
2. B Publish the library to Amazon ECR as a container image.
3. C Commit the built library into each consuming team's repository.
4. D Publish the library to AWS CodeArtifact and grant consuming accounts read access to the repository.

12. A hardened machine image must be produced monthly through a repeatable, testable process. Which solution meets these requirements?

1. A Apply the hardening to running instances monthly with a patch baseline.
2. B Store the hardening script in the repository for engineers to run when building an image.
3. C Launch an instance monthly, apply the hardening manually, and create an image from it.
4. D Create an EC2 Image Builder pipeline with a recipe, test components, and a monthly schedule.

13. An artifact promoted from staging to production must be the same artifact that was tested. Which practice meets these requirements?

1. A Recreate the artifact in production and compare checksums after deployment.
2. B Promote the built artifact through the pipeline stages without rebuilding it in the production stage.
3. C Rebuild the container image in the production account from the same Dockerfile.
4. D Rebuild the artifact from the same commit during the production stage.

14. An AWS Lambda deployment must shift ten percent of traffic for five minutes, then complete, rolling back automatically on elevated errors. Which solution meets these requirements?

1. A Configure an all-at-once deployment with a post-deployment validation hook.
2. B Configure a blue/green deployment with an Application Load Balancer in front of the function.
3. C Configure a canary traffic shifting configuration on the function alias with a CloudWatch alarm attached to the deployment group.
4. D Configure a linear traffic shifting configuration that moves ten percent each minute.

15. An Amazon ECS blue/green deployment must let the team exercise the replacement task set on a separate port before production traffic shifts. Which solution meets these requirements?

1. A Add a manual approval action to the pipeline before the deployment stage.
2. B Add an after-allow-traffic hook that validates the replacement task set.
3. C Configure a test listener on the load balancer and add a validation hook that runs before traffic is allowed.
4. D Configure a canary traffic shifting configuration with a one-minute interval.

16. A deployment must replace instances entirely rather than updating software in place, so a failed release can be discarded. Which deployment pattern meets these requirements?

1. A Adopt a rolling deployment that updates instances in batches.
2. B Adopt an all-at-once deployment during a maintenance window.
3. C Adopt an immutable deployment pattern that launches replacement instances and discards them if the release fails.
4. D Adopt a mutable deployment pattern that updates the software on existing instances.

17. A deployment to Amazon EC2 fails on some instances with an error indicating the deployment agent is unreachable. Which cause should be investigated first?

1. A Check whether the deployment agent is installed and running on the failing instances and whether its role permits the deployment service.
2. B Check whether the load balancer's health check interval is too short.
3. C Check whether the application's configuration file contains a syntax error.
4. D Check whether the artifact bucket's lifecycle policy has expired the artifact.

18. A pipeline must build once and deploy the same artifact to three environments. Which structure meets these requirements?

1. A A build stage that produces an environment-specific artifact for each target.
2. B A build stage in each environment's pipeline producing its own artifact.
3. C A manual build step performed before each environment deployment.
4. D A single build stage producing one artifact, followed by deploy stages that each reference it.

19. A pipeline stage must be prevented from starting until a security team member approves. Which solution meets these requirements?

1. A Schedule the stage to run only during hours when the security team is available.
2. B Notify the security team when the stage begins and continue automatically.
3. C Add a manual approval action before the stage and restrict who may approve it with IAM.
4. D Require the security team to monitor the pipeline dashboard.

20. A build must access a private artifact repository in a VPC. Which configuration is required?

1. A Copy the artifacts to Amazon S3 before each build.
2. B Route the build's traffic through a NAT gateway to reach the repository.
3. C Make the repository publicly accessible and restrict it by source IP address.
4. D Configure the build project with VPC settings specifying subnets and a security group the repository permits.

21. A team must choose where to store a value that changes per environment and is not sensitive. Which solution is appropriate?

1. A An environment variable set manually on each build project.
2. B A hardcoded value in the build specification, changed per environment.
3. C AWS Secrets Manager with rotation enabled.
4. D AWS Systems Manager Parameter Store as a String parameter referenced by the pipeline.

22. A test suite takes 40 minutes and delays feedback on every commit. Which improvement is appropriate?

1. A Run the suite on a larger build compute type.
2. B Split the suite so fast tests gate the commit and slower tests run later in the pipeline.
3. C Run the full suite nightly instead of on every commit.
4. D Reduce the number of tests until the suite completes quickly.

23. An integration test requires a database that must not be shared between concurrent pipeline runs. Which approach is appropriate?

1. A Skip integration tests when another run is in progress.
2. B Use a single shared database and have each test clean up after itself.
3. C Provision an isolated database per run and destroy it when the run completes.
4. D Use a single shared database and run the pipeline serially.

24. A pipeline must verify that a deployed environment serves requests correctly before traffic is shifted to it. Which approach is appropriate?

1. A Run a synthetic transaction against the new environment's test endpoint and fail the stage if it does not succeed.
2. B Check that the new instances passed their EC2 status checks.
3. C Wait a fixed period after deployment before shifting traffic.
4. D Check that the deployment reported success.

25. A pipeline must prevent a commit that lowers code quality below an agreed standard. Which combination of steps meets these requirements? (Select TWO.)

1. A Record quality metrics in a dashboard for monthly review.
2. B Measure test coverage and fail the build when it falls below the threshold.
3. C Run the analysis after deployment and raise tickets for violations.
4. D Run static analysis in the build and fail on violations of the agreed rules.
5. E Ask reviewers to check quality during code review.

26. Container images must be scanned for vulnerabilities as they are pushed to the registry. Which solution meets these requirements?

1. A Enable enhanced scanning on the Amazon ECR repository so images are assessed on push and continuously afterwards.
2. B Scan the running containers in production weekly.
3. C Scan the images manually before each release.
4. D Rebuild the images weekly so dependencies are refreshed.

27. An artifact repository must retain only the most recent versions of each package to control storage growth. Which approach is appropriate?

1. A Retain every version indefinitely.
2. B Delete all versions older than 30 days regardless of use.
3. C Ask teams to delete versions they no longer need.
4. D Apply a retention policy that removes older versions while keeping those referenced by active deployments.

28. An image pipeline must produce images for two processor architectures from one definition. Which approach is appropriate?

1. A Build for each architecture and publish a manifest list so clients pull the image matching their platform.
2. B Build for the architecture used by most instances and accept the limitation.
3. C Maintain a separate pipeline and image name per architecture.
4. D Build for one architecture and emulate it on the other.

29. An Amazon EKS deployment must roll out gradually with automatic rollback if error rates rise. Which approach is appropriate?

1. A Use a progressive delivery controller that shifts traffic in increments and reverts when its analysis fails.
2. B Use a rolling update with a maxSurge of one pod.
3. C Delete the existing deployment and apply the new one.
4. D Scale the deployment to zero and back up with the new image.

30. A deployment to Lambda must complete immediately with no traffic shifting, and the team accepts full exposure. Which configuration is appropriate?

1. A An all-at-once deployment configuration on the function alias.
2. B A linear configuration shifting ten percent each minute.
3. C A canary configuration shifting ten percent for five minutes.
4. D A blue/green configuration with a test listener.

31. A deployment agent on an instance cannot retrieve the application revision from Amazon S3. Which cause should be investigated first?

1. A Whether the instance profile grants read access to the bucket and decrypt access to its KMS key.
2. B Whether the instance's security group permits inbound traffic on port 443.
3. C Whether the load balancer's health check is passing.
4. D Whether the deployment group's configuration specifies the correct instance tags.

32. An immutable deployment must be able to revert instantly after traffic has shifted to the new environment. Which approach is appropriate?

1. A Terminate the previous environment as soon as the shift completes.
2. B Record the previous AMI identifier so the environment can be rebuilt.
3. C Take a snapshot of the previous environment before terminating it.
4. D Keep the previous environment running for a defined period after the shift so traffic can be returned to it.

33. A pipeline's source stage must trigger only when changes land on the main branch. Which configuration is appropriate?

1. A Trigger the pipeline on every push and exit early when the branch is not main.
2. B Configure the source action's branch filter to main so other branches do not start the pipeline.
3. C Create a separate pipeline for each branch.
4. D Run the pipeline on a schedule instead of on change.

34. A build must fail when a dependency has a known critical vulnerability. Which configuration is appropriate?

1. A Run the scan weekly outside the pipeline.
2. B Scan the deployed application after release.
3. C Run a dependency scan in the build and return a non-zero exit code on critical findings.
4. D Run the scan and write the findings to the build log.

35. A pipeline must deploy to production only after a successful deployment to staging. Which structure is appropriate?

1. A Place the staging deploy and its validation in a stage preceding the production stage, so production runs only on success.
2. B Run both deploys in parallel to save time.
3. C Deploy to production first and to staging afterwards.
4. D Run the staging deploy in a separate pipeline triggered manually.

36. A build project must produce an artifact consumed by a later pipeline stage. Which configuration is required?

1. A Declare the build's output artifacts so the pipeline passes them to the next stage.
2. B Write the artifact to a hardcoded S3 path the next stage reads.
3. C Email the artifact to the deployment team.
4. D Rebuild the artifact in the next stage.

37. A test suite must run against several runtime versions in parallel within one build. Which configuration is appropriate?

1. A Create a separate build project per version.
2. B Define a batch build with a matrix of runtime versions so each combination runs as a separate build.
3. C Run the versions sequentially in one build specification.
4. D Test only the newest runtime version.

38. A pipeline must verify that a deployed API returns correct responses before promoting the release. Which test type is appropriate?

1. A An integration test invoking the deployed API's endpoints and asserting on the responses.
2. B A static analysis scan of the API's source code.
3. C A unit test of the API's internal functions.
4. D A load test measuring the API's throughput.

39. Test reports from a build must be visible in the build history rather than only in the log output. Which configuration is appropriate?

1. A Declare a reports section in the build specification pointing at the test result files.
2. B Upload the results to Amazon S3 manually.
3. C Email the results to the team after each build.
4. D Print the test results to standard output.

40. An ECR repository must prevent an image tag from being overwritten once pushed. Which configuration is appropriate?

1. A Apply a repository policy denying the push action.
2. B Scan images on push.
3. C Enable tag immutability on the repository so an existing tag cannot be reassigned.
4. D Enable lifecycle policies on the repository.

41. A CodeArtifact repository must serve both internal packages and packages from a public registry. Which configuration is appropriate?

1. A Disable the public registry and vendor all dependencies.
2. B Copy the public packages into the internal repository manually.
3. C Configure an upstream connection to an external connection for the public registry so both resolve through one endpoint.
4. D Configure two separate repositories and two client configurations.

42. An EC2 Image Builder pipeline must verify that the produced image boots and passes checks before distribution. Which configuration is appropriate?

1. A Test the image manually after each build.
2. B Rely on the build components completing successfully.
3. C Distribute the image and test it in the target account.
4. D Include test components in the recipe so the image is validated before it is distributed.

43. A CodeDeploy deployment to Lambda must run a validation before traffic shifts and another after it completes. Which hooks are appropriate?

1. A BeforeAllowTraffic for the pre-shift validation and AfterAllowTraffic for the post-shift validation.
2. B BeforeInstall and AfterInstall.
3. C ApplicationStart and ApplicationStop.
4. D ValidateService only.

44. An EC2 deployment must keep the fleet at full capacity throughout a rolling update. Which configuration is appropriate?

1. A Use an all-at-once configuration during a maintenance window.
2. B Reduce the desired capacity before deploying.
3. C Use a deployment configuration that adds instances before removing any, so capacity never drops.
4. D Use a configuration that replaces half the fleet at a time.

45. A deployment must be halted automatically if a CloudWatch alarm enters the ALARM state during rollout. Which configuration is appropriate?

1. A Set a longer deployment timeout.
2. B Check the alarm manually after deployment completes.
3. C Create the alarm and notify the on-call engineer.
4. D Associate the alarm with the deployment group and enable automatic rollback on alarm.

46. An ECS blue/green deployment must keep the original task set running for a period after traffic shifts. Which configuration is appropriate?

1. A Scale the original task set to zero after the shift.
2. B Terminate the original task set immediately on success.
3. C Delete the original task definition after the shift.
4. D Set a termination wait time on the deployment so the original task set is retained before being terminated.

47. A pipeline must fail fast when a required environment variable is missing. Which approach is appropriate?

1. A Log a warning and continue with a default value.
2. B Validate the required variables at the start of the build and exit with a non-zero status when any is absent.
3. C Allow the build to proceed and fail at the deployment stage.
4. D Check the variables manually before each run.

48. A pipeline must be reusable across several applications with different repository sources. Which approach is appropriate?

1. A Define the pipeline as a parameterized template so each application instantiates it with its own source and settings.
2. B Copy the pipeline definition for each application.
3. C Create one pipeline with a stage per application.
4. D Maintain the pipeline manually in the console for each application.

49. A pipeline must run contract tests confirming a service still satisfies its consumers' expectations. Which placement is appropriate?

1. A Run the tests after the service reaches production.
2. B Rely on integration tests within the service's own suite.
3. C Have each consumer test independently on their own schedule.
4. D Run the consumer contract tests against the service in the pipeline before it is promoted.

50. A flaky test intermittently fails the pipeline without indicating a real defect. Which approach is appropriate?

1. A Increase the pipeline's timeout.
2. B Quarantine the test so it does not block the pipeline, and fix or remove it within a defined period.
3. C Retry the test until it passes.
4. D Delete the test immediately.

51. A pipeline must verify that a deployed infrastructure change produced the intended configuration. Which approach is appropriate?

1. A Review the resources in the console after deployment.
2. B Review the CloudFormation template before deployment.
3. C Run automated assertions against the deployed resources' actual configuration after the deployment stage.
4. D Check the stack's status is CREATE_COMPLETE.