AWS Certified DevOps Engineer - Professional practice questions

Question 1

A developer is concerned that turning on Lambda code signing will add latency to every function invocation, and is reading the Lambda code signing documentation to confirm when validation runs. What does the documentation state?

Accepted Answer

Signature validation runs at deployment time, so there is no added latency on each function execution

Answer

Signature validation runs on each invocation, adding a verification step before every function cold start

Answer

Signature validation runs in the CodeBuild build phase, blocking deploys of any unsigned code packages

Answer

Signature validation runs on an EventBridge schedule, re-checking signatures of deployed code packages

Question 2

A developer is being asked to provision a resource that does not have a built-in CloudFormation resource type, by running a Lambda function at stack create, update, and delete time. The developer is reading the CloudFormation custom resources documentation. Which capability does that documentation describe?

Accepted Answer

Custom resources provide a way for you to write custom provisioning logic into your CloudFormation templates and have CloudFormation run it anytime you create, update (if you changed the custom resource), or delete a stack, and you define them using AWS::CloudFormation::CustomResource or Custom::MyCustomResourceTypeName.

Answer

Custom resources are a deprecated feature and have been replaced entirely by CloudFormation Hooks. Custom resources and Hooks coexist with distinct purposes — custom resources provision, Hooks validate.

Answer

Custom resources are limited to update events and cannot fire on create or delete. The docs explicitly state custom resources run on create, update, and delete events of a stack.

Answer

Custom resources are only available in the CloudFormation Registry as third-party types and cannot be defined inline in a template. The docs describe inline definition via AWS::CloudFormation::CustomResource or Custom::* in the template directly.

Question 3

A security team is tasked with proving to auditors that CloudTrail log files have not been altered or deleted after delivery to Amazon S3. Which CloudTrail capability gives cryptographic assurance of log file integrity?

Accepted Answer

Enable CloudTrail log file integrity validation, which hashes each log file and signs hourly digest files.

Answer

Enable CloudTrail Insights events so unusual management-activity patterns are detected and written to the trail.

Answer

Turn on S3 server access logging on the trail bucket to record every read and write against the log objects.

Answer

Apply an S3 bucket policy with MFA delete so stored CloudTrail log objects can never be removed from the bucket.

Question 4

A platform team is shipping a service whose application logs print a distinct ERROR token whenever a payment fails, and the team wants to alarm when these failures exceed a rate threshold. Which CloudWatch Logs feature converts the matching log events into a numeric metric that an alarm can watch?

Accepted Answer

A CloudWatch Logs metric filter, which matches the ERROR pattern and emits a numeric CloudWatch metric an alarm can watch

Answer

A CloudWatch Logs subscription filter, which streams the raw matching log events into Kinesis Data Streams for downstream processing

Answer

A CloudWatch Logs Insights scheduled query, which periodically scans the log group and charts the matching result rows

Answer

A CloudWatch Contributor Insights rule, which ranks the top talkers contributing to a high-cardinality log dimension

Question 5

An architect is evaluating disaster recovery strategies for a workload on AWS and must choose between the lowest-cost, lowest-complexity approach and more elaborate options. According to AWS guidance, how are the available DR strategies broadly categorized?

Accepted Answer

Into four approaches ranging from low-cost, low-complexity backups to more complex strategies using multiple active Regions.

Answer

Into two approaches only: a single-Region backup-and-restore tier and a fully active-active deployment across every AWS Region.

Answer

Into three approaches defined strictly by recovery time objective, independent of cost or the number of Regions involved.

Answer

Into a single standardized approach in which every workload must run active-active across at least three AWS Regions.

Question 6

A platform team is designing an event-driven architecture in which several producer services emit events and many consumer services react with optional payload transformation. The platform team is reading the EventBridge event bus documentation. Which description matches an event bus?

Accepted Answer

An event bus is a router that receives events and delivers them to zero or more destinations, or targets, and event buses are well-suited for routing events from many sources to many targets, with optional transformation of events prior to delivery to a target.

Answer

An event bus is a database that persists every event for ad-hoc query and is not a router. The docs frame event buses as routers, not persistent query stores.

Answer

Event buses always deliver to exactly one target and many-to-many routing is not supported. The docs explicitly describe many-source-to-many-target routing in the event bus model. This contradicts the cited AWS documentation page, which describes the documented behavior in the opposite terms and explicitly anchors the supported workflow on the documented primitive instead of on the alternative implied by this distractor.

Answer

Event buses cannot transform event payloads before delivery. The docs explicitly describe optional transformation of events prior to delivery to a target.

Question 7

A developer is creating a CodeDeploy application's deployment group for an ECS service and is reading the CodeDeploy ECS documentation to confirm what must be specified about the target cluster. Which statement matches that documentation?

Accepted Answer

You specify the Amazon ECS cluster that contains your Amazon ECS service when you create your CodeDeploy application's deployment group, and the service maintains and runs specified instances of a task definition in the cluster.

Answer

CodeDeploy automatically discovers ECS clusters by tag and ignores any cluster name in the deployment group. The docs require explicit specification of the ECS cluster at deployment-group creation, not tag-based discovery.

Answer

The deployment group references only the task-definition ARN and never the ECS cluster. The docs require both — the cluster (which contains the service) is specified at deployment-group creation, with the task definition referenced separately.

Answer

CodeDeploy ECS deployment groups span all clusters in the AWS account by default, and there is no per-cluster targeting. The docs describe per-cluster, per-service targeting in the deployment group, not account-wide spans.

Question 8

An organization is standing up a brand-new multi-account AWS environment and wants a prescriptive, governed setup that orchestrates AWS Organizations, AWS Service Catalog, and IAM Identity Center into a landing zone. Which service provides this out of the box?

Accepted Answer

AWS Control Tower, which sets up and governs a multi-account environment landing zone

Answer

AWS Config, which records resource configurations and tracks how they change over time

Answer

Account Factory for Terraform, which provisions accounts from Terraform request files

Answer

AWS Systems Manager, which maintains node state and stores account configuration data

Question 9

A SRE is being asked how access to creating and using an EC2 Instance Connect Endpoint should be governed, and is reading the EC2 Instance Connect Endpoint documentation. What does that documentation describe?

Accepted Answer

You can control access to the creation and use of the EC2 Instance Connect Endpoints to connect to instances using IAM policies and permissions.

Answer

Access to EC2 Instance Connect Endpoints is governed by SSH key files only, with no IAM policy involvement. The docs describe IAM policies as the access control mechanism for EC2 Instance Connect Endpoints.

Answer

EC2 Instance Connect Endpoint access is governed by AWS Cognito user pools and is unrelated to IAM. The docs describe IAM as the access-control mechanism, not Cognito.

Answer

Anyone in the AWS account can create and use EC2 Instance Connect Endpoints, and access cannot be restricted. The docs explicitly support IAM-policy-based restriction on creation and use.

Question 10

Which Amazon CloudWatch feature provides a unified, shareable visualization of metrics and logs in a single location, including curated automatic views that AWS builds for many services so teams do not have to construct them by hand?

Accepted Answer

CloudWatch dashboards, a shareable unified view that visualizes metrics and logs, including curated automatic ones

Answer

CloudWatch Logs Insights, a query interface for interactively searching and analyzing stored log events

Answer

CloudWatch anomaly detection, which models a metric's expected value range to flag points outside the normal band

Answer

CloudWatch cross-account observability, which links source accounts to a central monitoring account view

Question 11

A platform team is asked to reduce scale-out latency on an EC2 Auto Scaling group whose instances take minutes to boot because of large on-disk state. The platform team is reading the EC2 Auto Scaling warm pools documentation. Which capability does that documentation describe?

Accepted Answer

A warm pool gives you the ability to decrease latency for your applications that have exceptionally long boot times, and a warm pool is a pool of pre-initialized EC2 instances that sits alongside an Auto Scaling group so that whenever your application needs to scale out, the Auto Scaling group can draw on the warm pool to meet its new desired capacity.

Answer

Warm pools are required for every Auto Scaling group regardless of boot-time characteristics. Warm pools are an opt-in feature aimed at exceptionally long boot times, not a default.

Answer

Warm pools store running EC2 instances exclusively and do not support stopped or hibernated instances. Warm pools support multiple states including stopped, running, and hibernated instances per AWS documentation.

Answer

Warm pools eliminate the need for any baseline capacity in the Auto Scaling group itself, so the ASG always sits at zero desired capacity. Warm pools augment the ASG; they do not replace baseline ASG capacity planning. This contradicts the cited AWS documentation page, which describes the documented behavior in the opposite terms and explicitly anchors the supported workflow on the documented primitive instead of on the alternative implied by this distractor.

Question 12

A SRE is being asked how to validate a refactor of an event consumer by replaying historical production events to it, and is reading the EventBridge archive documentation. Which capability does that documentation describe?

Accepted Answer

In EventBridge you can create an archive of events so that you can easily replay or resend them to the event bus that originally received them at a later time, and you might want to replay events to recover from errors or to validate new functionality in your application.

Answer

EventBridge archives can only be read for offline analysis and cannot be replayed back to an event bus. The docs explicitly describe replay/resend back to the originating event bus.

Answer

EventBridge archives store metadata only and discard the original event payload. EventBridge archives store the events themselves so they can be replayed.

Answer

Replay requires events to be exported to S3 and re-injected by a customer-authored Lambda. EventBridge provides native archive and replay; a custom S3/Lambda round-trip is not required. This contradicts the cited AWS documentation page, which describes the documented behavior in the opposite terms and explicitly anchors the supported workflow on the documented primitive instead of on the alternative implied by this distractor.

Question 13

A developer is asked whether some tags in an ECR repository can be marked immutable while others remain mutable, so that `latest` can move while semver tags are pinned. The developer is reading the ECR image tag mutability documentation. What does that documentation say about scope?

Accepted Answer

Tag immutability affects all tags. You cannot make some tags immutable while others aren't.

Answer

Tag immutability is configured per-tag through a repository policy condition. The docs say tag immutability affects all tags in the repository, so per-tag selective immutability is not supported.

Answer

Tag immutability is configurable per IAM principal, so different roles see different mutability rules for the same tag. Tag immutability is a repository-wide configuration, not an IAM-principal-scoped attribute.

Answer

Tag immutability is enforced only on Linux container images, with Windows images always remaining mutable. The docs do not split tag immutability by OS — it is a repository-wide property regardless of image platform.

Question 14

A team is evaluating Systems Manager Parameter Store and needs parameter policies, larger value sizes, and higher per-account limits than the default tier offers. Which parameter tier should they choose?

Accepted Answer

The advanced-parameter tier, which supports higher limits, larger values, and policies

Answer

The standard-parameter tier, which is the default used for low-scale configuration data

Answer

A Secrets Manager secret, which rotates credentials on a managed schedule for the team

Answer

A CloudFormation dynamic reference, which reads an external value at stack-operation time

Question 15

A SRE is asked what actually gets created in each target AWS account when an IAM Identity Center permission set is assigned to a group across many accounts. The SRE is reading the permission sets documentation. What does that documentation describe?

Accepted Answer

IAM Identity Center assigns access to a user or group in one or more AWS accounts with permission sets, and when you assign a permission set, IAM Identity Center creates corresponding IAM Identity Center-controlled IAM roles in each account.

Answer

IAM Identity Center creates only one shared IAM role across all target accounts. IAM Identity Center creates per-account IAM-Identity-Center-controlled IAM roles when a permission set is assigned, not one shared role.

Answer

IAM Identity Center stores permission sets as static IAM users in each account. Permission sets back IAM-Identity-Center-controlled IAM roles, not IAM users.

Answer

IAM Identity Center provisions a Lambda function in each account to evaluate policies at sign-in. Permission set evaluation is performed by IAM via federated role assumption, not by a customer-visible Lambda.

AWS Certified DevOps Engineer - Professional

Sample questions

Sources

Similar exams