DevOps Engineer - Professional Practice Questions

The AWS-RunPatchBaseline document in Systems Manager has built-in support for pre- and post-patching hooks. By specifying a script for the post-reboot hook, the team can automate the verification of the application's health immediately after the instance reboots from patching. If this verification script fails (returns a non-zero exit code), the overall patching task for that instance will fail, making it easy to identify problematic instances in the execution history. This is the most integrated and direct way to add verification to the existing Patch Manager workflow.

Kinesis Data Firehose has a built-in feature for data transformation that integrates directly with AWS Lambda. You can enable this feature and provide a Lambda function that Firehose will invoke for each batch of records. The Lambda function receives the records, performs the necessary transformation (like converting to JSON and adding metadata), and returns the transformed records to Firehose. Firehose then delivers the processed data to the destination. This is a fully managed, serverless, and scalable solution for real-time data processing within the stream. Record format conversion is limited to converting between JSON and Parquet/ORC and cannot perform custom enrichment.

Using an Auto Scaling group with min/max/desired capacity of 1 across multiple AZs is the standard and most effective pattern for ensuring the resilience of a single-instance application. If the instance fails its health check (either EC2 status checks or ELB health checks if one is used), the Auto Scaling group will automatically terminate it and launch a new replacement instance in one of the configured AZs. If an entire AZ fails, the Auto Scaling group will launch the replacement in a healthy AZ. This provides both instance-level and AZ-level automated recovery. The EC2 recover action only works for underlying hardware failures and does not protect against AZ failure. A warm standby is more expensive. A Lambda function adds unnecessary complexity for a standard use case.

The correct and recommended pattern is to configure the internal CodeArtifact repository with an upstream connection to the public repository (e.g., pypi-store). When CodeBuild (or a developer) requests a package, it queries only the internal CodeArtifact repository. If the package is not found locally, CodeArtifact will fetch it from the upstream public repository and cache it. Subsequent requests for the same package will be served from the CodeArtifact cache, ensuring availability even if the public repository is down and providing a centralized audit trail. Configuring two index URLs in pip can lead to unpredictable behavior and doesn't provide the caching and control benefits.

This is false. AWS CloudFormation StackSets have two permission models: service-managed and self-service. Service-managed permissions integrate with AWS Organizations and are the easier way to manage deployments within an organization. However, self-service permissions allow you to deploy StackSets to accounts outside of your organization by creating the necessary IAM roles in the administrator and target accounts manually. Therefore, belonging to the same organization is not a strict requirement.

AWS X-Ray captures detailed information in subsegments for calls to AWS services. For a DynamoDB call, the subsegment will contain the exact API operation used (like GetItem, Query, or Scan), the table name, and crucial performance data like ConsumedCapacity. High ConsumedCapacity or an inefficient operation like Scan would be a clear indicator of the performance issue's root cause, allowing a developer to optimize the query or provision more capacity. The status code would likely be 200 (OK) even for a slow query. Annotations are for custom filtering and don't explain latency. The Lambda cold start time is a separate issue.

The AfterAllowTestTraffic hook is specifically designed for running tests in a blue/green deployment after the test listener is active but before production traffic is shifted. Triggering a Lambda function from this hook allows for external test suites to be run. If the Lambda function exits with an error (non-zero exit code), CodeDeploy will automatically initiate a rollback, preventing the faulty green environment from serving production traffic. BeforeInstall is too early in the lifecycle. AfterInstall happens before the task set is stable and ready for testing. BeforeAllowTraffic is for tasks just before the test listener traffic is allowed, which is also too early for end-to-end tests.

AWS Config conformance packs are designed for this exact purpose. They allow you to package a collection of AWS Config rules and remediation actions that can be easily deployed as a single entity across an entire organization from the management account. This is more scalable and maintainable than managing individual StackSets for EventBridge rules and Lambda functions. Service-managed SCPs can prevent certain actions but cannot remediate existing resources. A single Lambda function in the management account would require complex cross-account permissions to remediate resources in member accounts.

In AWS Step Functions, the Retry block allows for fine-grained control over error handling. To achieve an increasing delay that is less aggressive than the default exponential backoff (which has a BackoffRate of 2.0), you must specify a BackoffRate between 1.0 and 2.0. A value of 1.5 will cause the interval to increase by 50% after each attempt, which is less aggressive than the default doubling. A BackoffRate of 2.0 is the default exponential backoff. Not specifying a BackoffRate also defaults to 2.0. ErrorEquals: ["States.TaskFailed"] is appropriate for catching failures within the Lambda function execution.