Deployment, Provisioning, and Automation
Free AWS Certified SysOps Administrator - Associate practice — 6 questions on Deployment, Provisioning, and Automation, with explanations. No sign-up. Full 12-question mixed test →
Your organization uses AWS Organizations with 60 member accounts across multiple OUs, and new accounts are provisioned weekly via account vending. You need a security baseline CloudFormation stack (CloudTrail, GuardDuty, Config rules) automatically deployed to every account in the 'Workloads' OU, including accounts created in the future, without manually assuming roles into each account. Which StackSets configuration meets this requirement?
Service-managed permissions let StackSets use AWS Organizations trust to deploy without manual IAM role setup in target accounts. Enabling automatic deployment ensures the stack is automatically deployed to any new account that joins the targeted OU, with no manual intervention.
A CloudFormation stack includes a custom resource of type Custom::ConfigValidator backed by a Lambda function that performs a one-time validation during stack creation. After the stack is created, an engineer runs 'aws cloudformation detect-stack-drift' on the stack. What drift status will CloudFormation report for the custom resource?
Drift detection does not support all resource types. Custom resources (Custom::* / AWS::CloudFormation::CustomResource) are among the types CloudFormation cannot evaluate for drift, so they are always reported as NOT_CHECKED regardless of their actual state.
A SysOps administrator must update a production CloudFormation stack where the change will cause an AWS::RDS::DBInstance to be replaced due to a modified engine version property, resulting in data loss if not handled carefully. Before applying the update, the administrator needs to know exactly which resources will be replaced versus modified in place. Which approach should be used?
Change sets show a preview of exactly how CloudFormation will modify resources (Add, Modify, Remove) and explicitly flag whether a Modify action requires replacement, allowing the administrator to catch destructive changes like DB instance replacement before applying the update.
A company requires that critical security patches only be installed on production EC2 instances 7 days after release (to allow time for internal review), and that patching only occurs during a defined Sunday 2-4 AM maintenance window. Which configuration satisfies both requirements?
Patch Manager patch baselines support an auto-approval delay per severity/classification rule, ensuring patches aren't approved until N days after release. Pairing this baseline with a Maintenance Window task running AWS-RunPatchBaseline on a cron schedule ensures patching happens only within the defined window.
A team needs to build custom hardened Linux AMIs on a recurring schedule, automatically run vulnerability scans and application-level tests against each new AMI build, and distribute the validated AMI to three other AWS Regions — all with minimal custom scripting to maintain. Which service should be used to build this pipeline?
EC2 Image Builder is purpose-built for this exact use case: it defines build recipes, supports test components (including security/vulnerability testing via built-in or custom test steps), and includes a distribution configuration to automatically copy and share the validated AMI to multiple Regions on a schedule — all natively, with minimal custom scripting.
An Elastic Beanstalk environment runs a fixed fleet of 4 instances behind an Application Load Balancer serving production traffic. The application must remain at full capacity throughout every deployment (no reduction in available instances), the team has a strict budget that prohibits temporarily doubling the fleet size, and any bad deployment should be caught on a small subset of instances before it reaches the rest of the fleet. Which Elastic Beanstalk deployment policy should be configured?
Rolling with additional batch launches one extra batch of instances with the new version first, so total capacity never drops below the original fleet size, then performs the rolling update in batches across the rest of the fleet — catching issues in the first small batch before all instances are updated, without doubling the entire fleet's cost.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
undefined $34.99 with code 89CE4ED79F19FA855B6D — valid through Sep 23.
Get my $34.99 deal →