Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 20

Question 190

An ECS service on Fargate uses rolling deployments. A new container starts but then fails the target-group health check repeatedly. The business wants a supported automated rollback rather than leaving the service stuck in a failed deployment. What should be configured?

Configure ECS tasks to restart forever without notifying deployment status or preserving the previous task set.
Enable the ECS deployment circuit breaker with rollback and validate health-check failure detection.
Set minimum healthy percent to zero and disable all target health checks to make every new task appear successful.
Enable ECS service auto scaling on CPU only and assume that scale-out rolls back a failed application deployment automatically.

Explanation

Correct Answer

The ECS deployment circuit breaker can mark a rollout failed and roll back to a previously completed deployment when configured to do so.

Incorrect Answers

Infinite restarts hide failure symptoms and do not guarantee an automatic safe return to the earlier service version.

Suppressing readiness evidence risks sending users to broken containers and cannot satisfy health-driven rollback.

Service auto scaling changes desired task count but does not automatically restore the previous deployment after new tasks fail health checks.

Question 191

A company publishes a high-value container image to ECR and then deploys it from multiple accounts. A developer accidentally reuses a release tag to point at different image contents, making rollbacks irreproducible. Which supply-chain control directly addresses this?

Enforce ECR tag immutability for release tags and deploy by versioned image digests in the task definitions.
Enable ECR enhanced scanning but continue deploying only the mutable release tag without locking its digest.
Use the ECR image scan results as the only identity of a release even if the underlying image tag can change.
Enable ECR lifecycle policies that expire old untagged images, while keeping release tags mutable.

Explanation

Correct Answer

Immutable tags and digest-pinned deployments prevent a previous release identifier from silently referring to different image bytes.

Incorrect Answers

CVE findings evaluate vulnerabilities, not release identity; a tag can still be redirected to different image bytes.

Security findings assess vulnerabilities but do not ensure stable image identification when tags are mutable.

Lifecycle retention affects image cleanup and does not prevent approved release tags from being repointed to untested layers.

Question 192

A distributed application changes a database column name while blue and green application versions can run concurrently during a rollout. The new code requires the column to be renamed immediately, while the old code still queries the existing name. What deployment design avoids an incompatible cutover?

Rename the database column first and assume the old application binary automatically discovers the new name.
Deploy the green application before provisioning the new field and rely on database errors as the acceptance test.
Coordinate an ALB blue/green traffic switch but immediately remove the old column before the blue application version drains.
Use a backward-compatible expand-and-contract schema migration, validating both app versions before removing the old column.

Explanation

Correct Answer

Expand-and-contract allows overlapping versions to read and write compatible representations and defers destructive schema removal until safe.

Incorrect Answers

The old version still issues queries for the former column, so immediate removal can break live requests during the overlap.

Releasing code that requires a missing schema property fails the compatibility prerequisite for a safe staged rollout.

Traffic scheduling cannot fix schema incompatibility while old readers still reference the dropped field; the expand/contract sequence must preserve both versions.

Question 193

A team already uses CodeDeploy for AWS Lambda releases and has proven a canary configuration. A new regulatory change now requires an evenly progressive rollout: ten additional percentage points of invocation traffic every ten minutes until 100 percent, with a rollback alarm monitored during each increment. A one-step canary jump followed by a final jump violates the rule. Which deployment configuration fits?

Use a canary configuration that sends ten percent once, waits ten minutes, and then immediately sends all remaining traffic.
Use CodeDeploy AllAtOnce because a single 100-percent shift still constitutes ten individual ten-percent increments.
Use a Lambda linear deployment such as CodeDeployDefault.LambdaLinear10PercentEvery10Minutes with supported alarm-based rollback.
Change only the function concurrency limit and assume it schedules weighted alias traffic shifts in ten-minute phases.

Explanation

Correct Answer

CodeDeploy linear deployment configurations shift additional portions at fixed intervals and can monitor deployment alarms for rollback.

Incorrect Answers

The canary’s one initial shift and final jump are not ten evenly spaced ten-percent traffic increments.

AllAtOnce switches all invocation traffic at one time and fails the explicitly required incremental risk exposure.

Lambda concurrency bounds running executions and does not implement staged alias routing by prescribed weights and time intervals.

Question 194

A developer submits a new CDK infrastructure application to the pipeline. Compliance policy requires review of the exact AWS CloudFormation resources and IAM privilege changes before deployment rather than approval based only on application source code. What should the workflow generate and inspect?

Enable deployment without synthesis and rely on CloudTrail to reconstruct every intended change after the fact.
Ignore generated IAM policies because all policies created by CDK have fixed least-privilege semantics.
Synthesize the CDK app into CloudFormation templates and review proposed resource and IAM changes via a controlled change preview.
Review only a source-code pull request diff and skip the synthesized CloudFormation template and IAM changes.

Explanation

Correct Answer

CDK source expresses infrastructure abstractions; synthesized templates and a change preview reveal the concrete resources and privileges that will be deployed.

Incorrect Answers

Postdeployment audit cannot replace the requested preventive view of resources and privilege modifications.

Generated IAM permissions depend on application constructs and still require review for excess authorization.

CDK source differences do not by themselves disclose the exact generated CloudFormation resources or effective IAM modifications to be deployed.

Question 195

A blue/green deployment to an EC2 Auto Scaling service must preserve a warm previous fleet for one hour after cutover because operators may need immediate rollback. Which release procedure best meets this requirement?

Use CodeDeploy blue/green with immediate original-instance termination after the successful traffic switch, rather than preserving the specified hold period.
Keep the blue environment available for the defined hold period and switch the load balancer only after validating the new green targets.
Terminate all blue instances as soon as the green launch begins, before health checks complete.
Perform an ECS rolling update on the same EC2 Auto Scaling group and designate the previous application version as a warm blue fleet.

Explanation

Correct Answer

Retaining a healthy old fleet preserves a rollback destination while target validation limits exposure to a defective new release.

Incorrect Answers

Immediate termination eliminates the warm blue fleet needed for the one-hour rapid rollback requirement.

Early teardown removes the requested immediately available rollback capacity and can amplify an unsuccessful release.

An in-place rolling update does not preserve a separate original fleet for rapid rollback after a traffic switch.

Question 196

A company must deploy a CloudFormation baseline stack into newly created AWS accounts automatically when they join a designated OU. The team wants existing enrolled accounts updated as policies change. Which managed deployment feature fits this dynamic targeting?

Copy a template to S3 and rely on every new AWS account to execute it without a deployment orchestration service.
Use one self-managed StackSet deployment without automatic OU targeting, relying on manually installing the execution role for every new account.
Use organization-integrated CloudFormation StackSets with automatic deployment enabled for the target OUs.
Use only AWS Config organization rules to report new-account drift rather than applying the CloudFormation baseline stack.

Explanation

Correct Answer

Service-managed StackSets can deploy to accounts in targeted OUs and react to supported account addition and removal events.

Incorrect Answers

Template availability alone cannot trigger authorized stack deployments in accounts that appear later.

A manual self-managed workflow lacks the requested automatic organization-account enrollment with service-managed roles.

Detective Config evaluations do not deploy the required baseline resources to new OU members.

Question 197

A deployment pipeline pushes an artifact encrypted under a customer-managed KMS key in a central tooling account. Its deployment role in a separate production account can read the S3 object but receives AccessDenied while decrypting it. Which configuration needs review?

Give the production role more s3:ListBucket permissions but leave the KMS key policy excluding that principal.
Disable server-side encryption for every artifact because a cross-account role can never use a customer-managed KMS key.
Allow s3:GetObject on the source artifact bucket and add the KMS key ARN to the pipeline description without key-policy changes.
Grant the production deployment principal approved cryptographic use of the tooling KMS key through aligned key policy and IAM permissions.

Explanation

Correct Answer

S3 object retrieval and KMS decryption are separate authorization checks; both must permit the cross-account deployment principal.

Incorrect Answers

Listing objects cannot authorize kms:Decrypt on an encrypted artifact, so the decryption error remains.

Cross-account KMS use is supported when policy and identity permissions are configured, so removing encryption is unnecessary.

Documenting key metadata does not grant the cross-account cryptographic actions required for decrypting SSE-KMS artifacts.

Question 198

An operations group uses automated canary releases and identifies a failure after the first traffic shift. Leadership asks how to ensure rollback is based on customer-facing error rate rather than a manually observed dashboard. What should the release pipeline include?

Configure only manual CodePipeline approval after the first traffic shift without registering the customer-error-rate CloudWatch alarm.
Associate suitable CloudWatch alarms with the deployment orchestrator so threshold breaches automatically stop and roll back supported releases.
Publish only dashboard screenshots in a chat channel and require someone to spot all errors before a bad release propagates.
Configure an ALB request-count metric alarm unrelated to customer error status and assume it catches bad release failures.

Explanation

Correct Answer

A monitored alarm tied to a supported rollback action converts application health evidence into an actionable deployment safety gate.

Incorrect Answers

Human approvals do not provide the requested automatic alarm-triggered rollback on observed error rate.

Manual dashboard observation lacks the requested deterministic alarm-triggered rollback control.

High request count can represent healthy traffic; rollback needs an alarm measuring the actual error conditions of the canary.

Question 199

An application uses CloudFormation for RDS and networking. A change set indicates replacement of a critical security group, but the operations team also wants to prevent unauthorized modifications to protected resources during subsequent stack updates. Which CloudFormation control should be added?

Remove change-set review and allow every stack update because protected resources cannot change under CloudFormation.
Enable termination protection alone and assume it denies updates to individual resources.
Name the protected resources with a PreventUpdate prefix but omit stack-policy update restrictions.
Apply a stack policy that denies updates to designated protected resources except through a deliberate, reviewed override.

Explanation

Correct Answer

CloudFormation stack policies constrain update actions on specified logical resources, reducing accidental stack-update blast radius.

Incorrect Answers

Change sets can include destructive replacements, and unconditional execution does not protect critical resources.

Termination protection controls stack deletion, not arbitrary updates to resources inside a stack.

Resource names are not a CloudFormation authorization control; only the evaluated stack policy can block attempted updates of protected logical resources.

Question 200

A company’s production CloudFormation stack must never be deleted by an accidental console click, but its authorized application resources must still be updatable through change sets. Which stack-level protection fits?

Apply a stack policy that denies updates to every logical resource and assume that policy blocks DeleteStack operations.
Enable CloudFormation termination protection for the production stack and maintain controlled update permissions.
Configure a stack policy that denies every resource update and assume it alone prevents DeleteStack.
Give the application operator only read access to the CloudFormation stack while relying on that access model to block accidental DeleteStack by other authorized administrators.

Explanation

Correct Answer

Termination protection blocks ordinary DeleteStack attempts while preserving separately authorized update workflows.

Incorrect Answers

Stack policies limit resource updates; preventing entire stack deletion requires termination protection.

Stack policies protect selected update actions but are not the dedicated stack deletion control.

Reducing one operator’s permissions can help, but it is not the stack-level termination protection requested against accidental authorized deletion.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 190

Explanation

Correct Answer

Incorrect Answers

Question 191

Explanation

Correct Answer

Incorrect Answers

Question 192

Explanation

Correct Answer

Incorrect Answers

Question 193

Explanation

Correct Answer

Incorrect Answers

Question 194

Explanation

Correct Answer

Incorrect Answers

Question 195

Explanation

Correct Answer

Incorrect Answers

Question 196

Explanation

Correct Answer

Incorrect Answers

Question 197

Explanation

Correct Answer

Incorrect Answers

Question 198

Explanation

Correct Answer

Incorrect Answers

Question 199

Explanation

Correct Answer

Incorrect Answers

Question 200

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests