Domain 3: Deployment, Provisioning, and Automation
Explore deployment, provisioning, and automation techniques essential for AWS CloudOps Engineers. Learn to manage golden AMIs with EC2 Image Builder, automate CloudFormation stack deployments, and utilize Systems Manager for configuration enforcement and patching. This lesson enhances your skills in building repeatable, secure workflows and orchestrating multi-account resources with minimal manual effort.
Question 29
A company maintains a fleet of Amazon EC2 instances across several application accounts. Each month, the operations team must produce hardened golden AMIs, apply the latest approved patches automatically, run validation tests before release, encrypt snapshots with AWS KMS, and distribute the final images to multiple accounts. The team wants the most repeatable and least manual workflow possible while preserving versioning and auditability.
Which solution best meets these requirements?
A. Use EC2 Image Builder with an image recipe, infrastructure configuration, distribution configuration, and test components. Integrate patching through Systems Manager and distribute the encrypted AMI to target accounts.
B. Launch a temporary EC2 instance each month, connect through SSH, install patches manually, create an AMI, and share it with other accounts.
C. Run a custom Bash pipeline on a build server that starts instances, applies patches, snapshots the volumes, and copies the artifacts to application accounts.
D. Use only AWS CloudFormation to deploy an instance, patch the operating system during stack creation, and treat the resulting instance as the reusable image source.
Question 30
A platform team builds container images used by Amazon ECS services. The team needs a managed AWS service that can build secure base images, scan components, version outputs, and push the final images to Amazon ECR on a scheduled cadence. The design must minimize custom scripting and reduce operational overhead.
Which components should the team include? Select any three options.
A. Create an EC2 Image Builder container pipeline with a container recipe that defines the base image, components, and output settings.
B. Configure Amazon EventBridge to invoke the image pipeline on a defined schedule.
C. Configure image distribution to push the resulting container image to Amazon ECR.
D. Require administrators to run docker build and docker push from their workstations every month.
E. Replace the pipeline with an AWS Lambda function that builds large Docker images directly during invocation.
F. Use only AWS CodeBuild with custom scripts because EC2 Image Builder cannot version container images.
Question 31
An operations engineer deploys an AWS CloudFormation stack that creates a VPC, several subnets, and route table associations. Stack creation fails, and the events show that one subnet CIDR block overlaps another. The route table associations never complete. The template syntax is valid, and the services involved are healthy.
What is the most likely root cause and best remediation?
A. The stack timeout is too short, so CloudFormation stops before ...