AWS DVA-C02: Deployment Practice Questions

The .ebextensions directory allows developers to include configuration files (with a .config extension, in YAML or JSON) inside the application source bundle. These files can install packages (using the packages key), create files (using the files key), run commands, and modify the environment without building a custom platform. — The Procfile is used to specify how to start application processes (similar to a web server command); it is not used for system-level package installation or file creation. — Uploading a shell script directly to S3 is not a recognized Elastic Beanstalk customization mechanism; Elastic Beanstalk would not automatically execute it. — Using a separate CloudFormation stack for OS-level configuration adds unnecessary complexity and tight coupling; .ebextensions handles this natively within the deployment bundle.

ECR lifecycle policies allow you to define rules that automatically expire images based on age (sinceImagePushed), count (imageCountMoreThan), and tag status (tagged, untagged, or a tag prefix pattern). You can create one rule for untagged images older than 30 days and another to keep only the 10 most recent 'release-*' tagged images. — ECR image scanning identifies OS and software vulnerabilities in images; it does not delete or expire images based on age or count. — ECR does not expose its underlying storage as a user-accessible S3 bucket; S3 lifecycle policies cannot be applied to ECR images directly. — An EventBridge-triggered Lambda could accomplish this but requires custom code, ongoing maintenance, and permissions management that ECR lifecycle policies handle natively without additional infrastructure.

The env/parameter-store section in buildspec.yml is specifically designed to retrieve values from AWS Systems Manager Parameter Store at build time. CodeBuild fetches and injects the value as an environment variable without it ever being stored in the source code. — The env/variables section stores plaintext values, which defeats the purpose of securing the secret. — The env/secrets-manager section is for AWS Secrets Manager, not SSM Parameter Store; using the SSM parameter ARN here would fail or retrieve the wrong resource. — Manually calling the SSM API in the install phase would work technically but is error-prone, harder to maintain, and does not leverage CodeBuild's native secret injection support.

buildspec.yml is the build specification file that CodeBuild looks for at the root of the source repository by default. It defines phases (install, pre_build, build, post_build), environment variables, and artifact output paths. — appspec.yml is used by CodeDeploy to manage deployment lifecycle hooks, not CodeBuild. — template.yaml is used by AWS SAM or CloudFormation to define infrastructure, not build commands. — Dockerfile defines container image build steps for Docker, not a CodeBuild build specification.

A Lambda alias supports weighted routing between two function versions, which is the mechanism CodeDeploy uses to shift traffic. CodeDeploy updates the alias weights automatically during deployment. The CodeDeployDefault.LambdaLinear10PercentEvery10Minutes configuration shifts traffic linearly, adding 10% every 10 minutes until all traffic is on the new version — matching the described requirement exactly. Together, these two form the correct answer. — Updating $LATEST directly does not create a separate version for traffic splitting; traffic shifting requires distinct published versions. — The Canary configuration shifts a fixed initial percentage and then shifts the remainder all at once (e.g., 10% then 90%), not incrementally every 10 minutes — this matches a canary deployment, not the linear one described. — A CloudWatch alarm attached to the deployment group is important for automatic rollback, but the question asks for the combination that achieves the gradual traffic shift; the alarm alone does not implement the shifting. — Lambda concurrency reservations throttle the total invocations of a version but do not implement percentage-based traffic routing.