I85PREP
⌘ K
AWS DevOps Engineer Professional study materials
AWS DevOps Engineer Professional study resources

AWS DevOps Engineer Professional practice questions

One question at a time. Build your AWS DevOps Engineer Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1SDLC Automation

A team wants CodePipeline to deploy an application to an Amazon ECS cluster running on EC2 instances. Which action provider is designed for this deployment target?

  1. AWS CodeDeploy with an ECS compute platform deployment group Correct answer.
  2. AWS Elastic Beanstalk action
  3. AWS CloudFormation with a change set
  4. AWS OpsWorks stack action

Explanation

CodeDeploy supports an ECS compute platform where a deployment group targets an ECS service and task set, allowing blue/green replacement of tasks. This is the native pipeline integration for ECS deployments.

Question 2SDLC Automation

Which CodeBuild buildspec section is used to declare the commands that run after the build and produce artifacts?

  1. env
  2. reports
  3. artifacts
  4. phases Correct answer.

Explanation

The phases section defines the ordered build lifecycle (install, pre_build, build, post_build) and the commands run in each. Artifact declaration is separate from command execution.

Question 3SDLC Automation

A pipeline must run only when a commit is pushed to the main branch of a CodeCommit repository. Which configuration achieves this?

  1. A CloudWatch Events rule that starts the pipeline on any repository state change
  2. An SNS topic subscribed to the repository that invokes the pipeline
  3. A CodeCommit repository trigger filtered to the main branch that starts the pipeline Correct answer.
  4. A scheduled pipeline execution every five minutes

Explanation

CodeCommit repository triggers can be filtered by branch and events and can directly start a pipeline execution. Filtering on the branch prevents executions for other branches.

Question 4SDLC Automation

In a CodeDeploy deployment group for EC2/on-premises instances, which configuration determines how traffic is shifted during a deployment?

  1. The target group health check settings
  2. The deployment configuration, such as AllAtOnce or a percentage-based option Correct answer.
  3. The revision's AppSpec hooks
  4. The IAM role attached to the deployment group

Explanation

Deployment configurations define the rate at which instances are updated, such as OneAtATime, HalfAtATime, or AllAtOnce. They control the deployment speed and availability impact.

Question 5SDLC Automation

Which artifact format does AWS CodePipeline require to store pipeline artifacts in an Amazon S3 bucket?

  1. A ZIP file containing the files Correct answer.
  2. An OCI image
  3. A tar archive with metadata
  4. A JSON manifest only

Explanation

CodePipeline stores artifacts as ZIP files in the configured artifact store bucket. Actions consume and produce these ZIP artifacts by default.

Question 6SDLC Automation

A CodeBuild project must pull a database password at build time without storing it in the buildspec. Which approach is appropriate?

  1. Pass the value as a plaintext environment variable in the project settings
  2. Hardcode the value in the buildspec file
  3. Commit an encrypted file to the repository
  4. Store the value in a parameter with type SecureString in Parameter Store and reference it in the env section Correct answer.

Explanation

The buildspec env section can reference Parameter Store parameters, including SecureString values, which CodeBuild resolves at runtime using its service role. This avoids embedding secrets in source control.

Question 7SDLC Automation

Which AWS service is the managed source control repository that integrates natively with CodePipeline as a source action?

  1. AWS CodeStar
  2. AWS CodeCommit Correct answer.
  3. Amazon S3
  4. AWS CodeArtifact

Explanation

CodeCommit is the managed Git-based source control service and provides a native source action for CodePipeline. S3 can be a source but is not a source control repository.

Question 8SDLC Automation

A CodeDeploy application targets Lambda functions. Which AppSpec resource is used to define the function version and the hooks to run during deployment?

  1. A files section listing destination paths
  2. A resources section with a lambda function and hooks Correct answer.
  3. An os section specifying linux
  4. A permissions section granting IAM roles

Explanation

For Lambda deployments, the AppSpec uses a resources section that names the Lambda function and specifies lifecycle hooks such as BeforeAllowTraffic and AfterAllowTraffic. The files and os sections apply to EC2/on-premises deployments.

Question 9SDLC Automation

A pipeline stage contains two actions in the same run order. How does CodePipeline execute them?

  1. In parallel Correct answer.
  2. Only the last action runs
  3. Sequentially, in the order they were added
  4. Only the first action runs

Explanation

Actions with the same run order in a stage execute in parallel. Sequential execution requires assigning different run order values.

Question 10SDLC Automation

A CodeBuild project must run a different set of commands when the build is triggered by a pull request versus a branch push. Which mechanism provides the relevant information to the build?

  1. The CODEBUILD_BUILD_ID variable
  2. The CODEBUILD_SOURCE_VERSION variable
  3. The CODEBUILD_WEBHOOK_EVENT variable Correct answer.
  4. The CODEBUILD_RESOLVED_SOURCE_VERSION variable

Explanation

CODEBUILD_WEBHOOK_EVENT indicates the event that triggered the build, such as PUSH or PULL_REQUEST_CREATED. The buildspec can branch on this variable to run different commands.

Question 11SDLC Automation

A team wants CodeDeploy to automatically roll back a deployment when a CloudWatch alarm fires during the deployment. Which configuration is required?

  1. Attach the alarm to the CodePipeline stage
  2. Add the alarm name to the AppSpec hooks
  3. Set the deployment configuration to OneAtATime
  4. Enable automatic rollback and associate the alarm with the deployment group Correct answer.

Explanation

Deployment groups can reference CloudWatch alarms; when an alarm fires during deployment and automatic rollback is enabled, CodeDeploy rolls back to the last known good revision.

Question 12SDLC Automation

A CodePipeline uses a cross-account deployment where the pipeline is in account A and the target resources are in account B. Which configuration enables the deploy action to assume the correct permissions?

  1. An IAM role in account B that trusts the pipeline role in account A, configured as the action role Correct answer.
  2. An S3 bucket policy allowing public read
  3. A resource-based policy on the artifact bucket only
  4. A shared KMS key in account A only

Explanation

Cross-account actions use an action role in the target account that trusts the pipeline's role in the source account. The pipeline assumes this role to perform the deployment.

Question 13SDLC Automation

A buildspec must fail the build when unit tests fail. Which buildspec behavior accomplishes this?

  1. A build-phase command that returns a non-zero exit code Correct answer.
  2. A post_build command that echoes a message
  3. An env variable setting DEBUG to true
  4. An artifacts section listing the test reports

Explanation

CodeBuild treats a non-zero exit code from a phase command as a failure and stops the build. Test commands naturally return non-zero on failure.

Question 14SDLC Automation

A pipeline must deploy only after a manual approval from a specific team. Which CodePipeline feature provides this?

  1. A manual approval action in a stage Correct answer.
  2. A Lambda invoke action
  3. A CloudFormation deploy action
  4. An SNS notification action

Explanation

The manual approval action pauses the pipeline until an IAM principal with permission approves or rejects it. SNS topics can notify approvers, but the approval action enforces the gate.

Question 15SDLC Automation

A CodeDeploy deployment to EC2 instances must run a script after the application is installed but before traffic is allowed. Which AppSpec hook should contain the script?

  1. ApplicationStart
  2. BeforeInstall
  3. AfterInstall Correct answer.
  4. ValidateService

Explanation

AfterInstall runs after files are copied to the instance and before the application start and traffic allowance steps. It is the appropriate place for post-install configuration.

Question 16SDLC Automation

A team wants to build a container image and push it to Amazon ECR as part of CodeBuild. Which buildspec configuration supports this?

  1. An artifacts section pointing to the Dockerfile
  2. An env variable named DOCKER_BUILD
  3. A pre_build command that runs docker login to ECR and a build command that runs docker build and docker push Correct answer.
  4. A post_build command that uploads the Dockerfile to S3

Explanation

CodeBuild can authenticate to ECR in a pre_build step and then build and push the image in the build step. The CodeBuild service role needs ECR permissions.

Question 17SDLC Automation

A pipeline source stage uses GitHub (via CodeStar Connections). What is required for CodePipeline to receive push events automatically?

  1. A connection in the pending state approved in the console, with the webhook created Correct answer.
  2. A scheduled pipeline execution
  3. A CloudWatch Events rule polling the repository
  4. An S3 bucket event notification

Explanation

A CodeStar connection must be authorized to become available, and CodePipeline creates a webhook so push events start the pipeline. Until the connection is authorized, events are not delivered.

Question 18SDLC Automation

A CodeDeploy blue/green deployment to EC2 must validate the new environment before shifting traffic. Which combination accomplishes this?

  1. A Lambda hook that terminates instances
  2. A single target group with health checks disabled
  3. An in-place deployment with AllAtOnce configuration
  4. A replacement environment with a ValidateService hook and a load balancer with two target groups Correct answer.

Explanation

Blue/green deployments provision a replacement environment and use lifecycle hooks such as ValidateService to verify health before traffic is shifted. Two target groups allow the load balancer to switch traffic between environments.

Question 19SDLC Automation

A CodePipeline must pass output from a build stage to a deploy stage. Which mechanism carries the artifact between stages?

  1. Environment variables in the pipeline definition
  2. The pipeline artifact store, with the output artifact named in the build action and used as input in the deploy action Correct answer.
  3. A shared EFS file system mounted in both stages
  4. An SNS message containing the files

Explanation

Actions declare output artifacts that CodePipeline stores in the artifact store; later actions reference those artifacts as input artifacts. This is the standard data flow between stages.

Question 20SDLC Automation

A team wants to enforce that only approved container images from ECR are deployed to ECS. Which approach best supports this in the pipeline?

  1. Add an image scanning and approval step before the deploy action Correct answer.
  2. Disable image scanning in ECR
  3. Allow developers to push images directly to the cluster
  4. Use a single mutable image tag such as latest

Explanation

Adding a validation step that checks image scan results or approval status before deployment enforces the policy. Disabling scanning or using mutable tags undermines traceability.

Question 21SDLC Automation

A CodeBuild project needs to cache dependencies between builds to reduce duration. Which configuration achieves this?

  1. Store dependencies in the artifact output
  2. Increase the compute type of the build environment
  3. Set cache type to S3 and specify the cache paths in the buildspec Correct answer.
  4. Add a post_build command that deletes dependencies

Explanation

CodeBuild supports S3 or local caching; the buildspec cache section lists the paths to cache, and the project references the cache bucket. This reuses dependencies across builds.

Question 22SDLC Automation

A pipeline must deploy to multiple Regions sequentially, stopping if any Region fails. Which design satisfies this?

  1. One deploy action with a list of Regions
  2. A single stage with parallel actions for each Region
  3. Separate stages in sequence, one per Region, each with a deploy action Correct answer.
  4. A Lambda function that deploys to all Regions concurrently

Explanation

Separate sequential stages ensure each Region deploys only after the previous one succeeds; a failure halts the pipeline. Parallel actions would proceed independently and could mask failures.

Question 23SDLC Automation

A CodeDeploy deployment to EC2 fails during the AllowTraffic lifecycle event. Which action best diagnoses the root cause?

  1. Change the deployment configuration to AllAtOnce
  2. Review the deployment lifecycle event logs and the instance's CodeDeploy agent log Correct answer.
  3. Delete and recreate the deployment group
  4. Reboot all instances in the deployment group

Explanation

CodeDeploy records lifecycle event status and the agent log on the instance contains detailed script output. Reviewing these identifies the failing command or permission issue.

Question 24SDLC Automation

A team wants CodePipeline to run a custom validation that calls an internal API and blocks the pipeline on failure. Which action type is appropriate?

  1. A CloudFormation deploy action
  2. A manual approval action
  3. A Lambda invoke action that returns a failure Correct answer.
  4. An SNS publish action

Explanation

A Lambda invoke action runs custom code and can fail the action, which stops the pipeline. This supports arbitrary validation logic.

Question 25SDLC Automation

A developer wants a CodeCommit repository to trigger a CodePipeline build immediately whenever code is pushed to the main branch. Which configuration provides the lowest-latency automatic trigger?

  1. Configure an Amazon CloudWatch Events (EventBridge) rule for the repository state change as the pipeline trigger Correct answer.
  2. Rely on CodePipeline's default polling of the source branch at a fixed interval
  3. Schedule the pipeline to poll the repository every minute using a cron expression
  4. Enable a repository notification rule that publishes to an Amazon SNS topic subscribed by the pipeline

Explanation

CodePipeline integrates with EventBridge (CloudWatch Events) so that repository state changes start the pipeline near-instantly. Event-driven triggering is the recommended low-latency pattern; polling introduces delay and is not the default mechanism for push-triggered pipelines.

Question 26SDLC Automation

A team maintains infrastructure as code in an AWS CloudFormation template stored in an S3 bucket. They want CodePipeline to create or update the stack as a deployment action. Which action provider should the deploy stage use?

  1. AWS CodeBuild
  2. AWS CloudFormation Correct answer.
  3. AWS Elastic Beanstalk
  4. AWS CodeDeploy

Explanation

CodePipeline has a native CloudFormation deploy action provider that creates or updates stacks from a template artifact. CodeDeploy, Elastic Beanstalk, and CodeBuild serve different deployment or build purposes and do not manage CloudFormation stacks.

Question 27SDLC Automation

An engineer is writing a buildspec.yml and needs a command to run only during the post-build phase after the build artifacts have been prepared. Which buildspec section should contain that command?

  1. post_build Correct answer.
  2. pre_build
  3. build
  4. install

Explanation

The buildspec phases run in order: install, pre_build, build, and post_build. Commands that must run after the build phase belong in post_build, which executes last in the sequence.

Question 28SDLC Automation

A CodeDeploy deployment to an Auto Scaling group must use a new set of instances rather than updating instances in place. Which deployment configuration type should be selected?

  1. Rolling with additional batch
  2. Blue/green Correct answer.
  3. In-place with a rolling update
  4. All-at-once in-place

Explanation

Blue/green deployment provisions a new environment (a replacement Auto Scaling group) and shifts traffic to it, leaving the original instances untouched. In-place variants update the existing instances rather than replacing them.

Question 29SDLC Automation

A pipeline needs to store pipeline artifacts in an encrypted S3 bucket. Which service key is used by default to encrypt artifacts when no customer managed key is specified?

  1. The AWS managed key for CodePipeline artifacts
  2. The default Amazon EBS encryption key
  3. A customer managed key created per pipeline
  4. An AWS managed key for Amazon S3 (aws/s3) Correct answer.

Explanation

When no customer managed KMS key is configured, S3 server-side encryption with the AWS managed key aws/s3 protects the artifact bucket. Customers can optionally supply their own KMS key for tighter control.

Question 30SDLC Automation

A CodeBuild project must be granted permission to read from an S3 bucket during a build. Which mechanism provides those AWS API permissions to the build environment?

  1. An SSH key stored in the buildspec
  2. Environment variables containing IAM user credentials
  3. A service role attached to the CodeBuild project Correct answer.
  4. A personal access token in the source repository

Explanation

CodeBuild assumes a service role whose IAM policy grants the AWS API permissions the build needs. The build environment inherits these temporary credentials automatically.

Question 31SDLC Automation

A release manager wants to run an automated security scan as a CodePipeline stage between build and deploy, using a tool that is not natively integrated. Which approach integrates the custom tool while keeping the pipeline blocked on failure?

  1. Configure the tool as a deploy provider
  2. Add the tool as a source action in the pipeline
  3. Attach the tool as a manual approval action
  4. Run the tool in a CodeBuild action whose non-zero exit status fails the action Correct answer.

Explanation

A CodeBuild action can wrap any custom tool; a non-zero exit code fails the action, which fails the stage and blocks downstream stages. This is the standard pattern for custom validation in a pipeline.

Question 32SDLC Automation

A team wants CodeDeploy to stop a deployment and roll back when the error rate reported by a CloudWatch alarm exceeds a threshold during a blue/green deployment. Which configuration supports this?

  1. Set the deployment configuration to AllAtOnce
  2. Attach the alarm to the target Auto Scaling group's scaling policy
  3. Reference the alarm in the deployment group's alarm configuration and enable rollback on alarm Correct answer.
  4. Add the alarm as a CodePipeline manual approval

Explanation

CodeDeploy deployment groups can monitor CloudWatch alarms and, when an alarm fires, trigger a rollback if automatic rollback is enabled. The alarm must be associated with the deployment group.

Question 33SDLC Automation

A buildspec has a command that should only run when building the main branch. Which capability lets the buildspec branch its logic on the branch being built?

  1. Create a separate CodeBuild project per branch without conditionals
  2. Use the CODEBUILD_WEBHOOK_HEAD_REF environment variable in a conditional Correct answer.
  3. Use the CODEBUILD_BUILD_ID variable to infer the branch
  4. Hardcode the branch name in the buildspec

Explanation

CodeBuild exposes webhook environment variables such as CODEBUILD_WEBHOOK_HEAD_REF that identify the source branch, allowing conditional logic within a single buildspec. This avoids duplicating projects.

Question 34SDLC Automation

A CodeDeploy deployment to Lambda shifts traffic to the new version over a period. Which AppSpec field controls how traffic is shifted between versions?

  1. The deploymentStyle field
  2. The traffic-routing configuration Correct answer.
  3. The hooks section
  4. The resources section

Explanation

For Lambda deployments the AppSpec specifies a traffic-routing configuration that defines the shifting type (such as linear or canary) and the associated parameters. This governs how traffic moves to the new version.

Question 35SDLC Automation

A pipeline in account A must deploy to resources in account B. The pipeline artifact bucket resides in account A. Which configuration enables the deploy action in account B to read the artifact?

  1. Copy the artifact to a public S3 bucket
  2. Use the account A root credentials in the buildspec
  3. Grant the account B role access to the artifact bucket and KMS key used by the pipeline Correct answer.
  4. Store the artifact in an account B bucket without cross-account permissions

Explanation

Cross-account deployments require the target account's role to have permission to read the artifact bucket and decrypt with the KMS key in the source account. The bucket policy and key policy must explicitly allow the cross-account principal.

Question 36SDLC Automation

A team wants a CodePipeline stage to wait for a human to confirm a production release before the deploy stage proceeds. Which action type accomplishes this?

  1. A CloudFormation deploy action
  2. An S3 deploy action
  3. A Lambda invoke action
  4. A manual approval action Correct answer.

Explanation

A manual approval action pauses the pipeline until an authorized user approves or rejects it. This is the native way to require human sign-off before a stage proceeds.

Question 37SDLC Automation

A CodeBuild project should fail the build if a linting command returns a non-zero exit code. What is the default behavior of CodeBuild for a failing command in the build phase?

  1. It retries the command three times
  2. It continues to the next command and reports success
  3. It marks the phase as failed and stops the build Correct answer.
  4. It skips the remaining phases but reports success

Explanation

By default, a command returning a non-zero exit status fails the current phase and the build, unless the command is configured to ignore failures. This ensures quality gates block the pipeline.

Question 38SDLC Automation

A team wants to run unit tests in parallel across multiple containers to reduce build time. Which CodeBuild feature supports running multiple builds concurrently?

  1. A single build with a longer timeout
  2. Sequential buildspec phases
  3. A larger compute type
  4. Batch builds with a build graph Correct answer.

Explanation

CodeBuild batch builds with a build graph can run multiple builds in parallel or in dependency order. This reduces total time when work can be split across concurrent builds.

Question 39SDLC Automation

A pipeline must deploy to three Regions in sequence, and a failure in any Region should stop further deployments. How should the pipeline be structured?

  1. Use a single deploy action targeting all Regions at once
  2. Use manual approval actions between Regions
  3. Use sequential deploy actions with run order in a single stage Correct answer.
  4. Use parallel deploy actions in one run order

Explanation

Assigning increasing run orders to deploy actions in a stage makes them execute sequentially, and a failure halts subsequent actions. This provides ordered regional rollout with fail-fast behavior.

Question 40SDLC Automation

A CodeDeploy deployment to EC2 fails during the AllowTraffic lifecycle event. Which step best identifies why the instance did not receive traffic?

  1. Inspect the CodeDeploy agent log on the instance for the lifecycle script output Correct answer.
  2. Examine the CloudFormation stack events for the VPC
  3. Check the CodeBuild buildspec for syntax errors
  4. Review the pipeline's source action configuration

Explanation

Lifecycle event scripts run on the instance via the CodeDeploy agent, and its log captures the script output and errors. Reviewing that log is the direct way to diagnose an AllowTraffic failure.

Question 41SDLC Automation

A team wants to enforce that only container images built and scanned by their pipeline are deployed to ECS. Which combination best enforces this policy?

  1. Push images to ECR with immutable tags and reference digests in the task definition Correct answer.
  2. Allow any image tag in the task definition and rely on developer review
  3. Use mutable latest tags and rebuild on each deploy
  4. Store images in a public registry and pull by tag

Explanation

Immutable tags and digest references ensure the exact scanned image is deployed and cannot be overwritten. This provides verifiable provenance and prevents tag mutation from swapping in unapproved images.

Question 42SDLC Automation

A CodeBuild project must cache Maven dependencies between builds to reduce duration. Which configuration achieves this?

  1. Use a larger compute type
  2. Increase the build timeout
  3. Store dependencies in environment variables
  4. Configure a cache in the CodeBuild project and reference it in the buildspec cache section Correct answer.

Explanation

CodeBuild supports caching (for example, in S3 or locally) configured on the project and referenced in the buildspec cache section. Restoring cached dependencies avoids re-downloading them on each build.

Question 43SDLC Automation

A pipeline must pass an output artifact from a build stage to a later deploy stage. Which statement describes how the artifact is made available to the deploy action?

  1. The deploy action declares the build action's output as its input artifact Correct answer.
  2. The deploy action downloads the artifact from the build container's local disk
  3. The deploy action reads the source repository directly
  4. The deploy action re-runs the build commands to regenerate the artifact

Explanation

CodePipeline stores action outputs in the artifact bucket and makes them available to downstream actions that declare them as input artifacts. The deploy action references the build action's output by name.

Question 44SDLC Automation

A team wants to use a CodePipeline stage to invoke a custom Lambda function that validates configuration and fails the stage on error. Which action type should be used?

  1. A manual approval action
  2. An S3 deploy action
  3. A CodeDeploy action
  4. A Lambda invoke action Correct answer.

Explanation

A Lambda invoke action calls a function with a job payload, and the function reports success or failure back to CodePipeline. This allows custom validation logic to gate the stage.

Question 45Configuration Management and Infrastructure as Code

A CloudFormation template must be able to create the same stack in three AWS Regions with different AMI IDs per Region. Which template feature maps a Region to its correct value at deploy time?

  1. Mappings with Fn::FindInMap Correct answer.
  2. Conditions with Fn::Equals
  3. Outputs with Fn::ImportValue
  4. Parameters with AllowedValues

Explanation

Mappings are static key-value lookups in a template, and Fn::FindInMap retrieves a value keyed by Region (for example AWS::Region) so the same template resolves a different AMI per Region. The lookup is evaluated during stack operations without user input.

Question 46Configuration Management and Infrastructure as Code

A team wants a single CloudFormation template to conditionally create a production-only WAF resource while keeping the template valid in all environments. Which approach implements this?

  1. Place the resource in a nested stack that is always deployed
  2. Define a Condition on the resource and set the condition using a parameter Correct answer.
  3. Add an AWS::NoValue value to the resource's Tags
  4. Use Fn::If inside the Outputs section only

Explanation

A Condition defined in the Conditions section can be attached to a resource, and CloudFormation skips creating that resource when the condition evaluates false. The condition typically derives from a parameter such as environment.

Question 47Configuration Management and Infrastructure as Code

Which CloudFormation feature lets you detect that a stack's actual resources have drifted from the template's expected configuration?

  1. Change sets
  2. Drift detection Correct answer.
  3. Stack policies
  4. Rollback triggers

Explanation

Drift detection compares the current configuration of stack resources with the configuration defined in the template and reports resources that differ. It is run on demand or scheduled and reports status per resource.

Question 48Configuration Management and Infrastructure as Code

In AWS CodePipeline, which artifact store configuration is required for a pipeline that deploys across multiple Regions?

  1. A CodeCommit repository per Region
  2. A single S3 bucket in the pipeline's home Region only
  3. An ECR repository per Region
  4. An S3 bucket in each Region where actions run Correct answer.

Explanation

Cross-Region pipelines require an artifact bucket in every Region where the pipeline runs actions, because each Region's actions read artifacts from a bucket in that Region. The pipeline's artifact store configuration must include those buckets.

Question 49Configuration Management and Infrastructure as Code

Which AWS service provides managed, versioned configuration data and feature flags that applications can retrieve at runtime with automatic validation?

  1. AWS AppConfig Correct answer.
  2. AWS Secrets Manager
  3. Amazon S3
  4. AWS Systems Manager Parameter Store

Explanation

AWS AppConfig is designed for application configuration and feature flags with validators, deployment strategies, and gradual rollout. It supports safe deployment of configuration changes independent of code deployments.

Question 50Configuration Management and Infrastructure as Code

A build must fail if a CloudFormation template contains syntax errors before any stack is created. Which step in a CodeBuild buildspec accomplishes this?

  1. Run aws cloudformation wait stack-create-complete in the build phase
  2. Run aws cloudformation describe-stacks in the install phase
  3. Run aws cloudformation deploy in the post_build phase
  4. Run aws cloudformation validate-template in the build phase Correct answer.

Explanation

validate-template checks the template's syntax and structure without creating resources, and a non-zero exit fails the build phase. Placing it in the build phase stops the pipeline before deployment.