Question bank
AWS Certified DevOps Engineer – Professional
42 AWS Certified DevOps Engineer – Professional questions with the correct answer and a written explanation, organised across 6 exam domains.
- 42 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Configuration Management and Infrastructure as Code
8 questions in this domain
- Question 1Single Choice
What is the primary function of AWS Systems Manager State Manager?
- AEnforce desired configuration on managed instances on a scheduleCorrect answer
- BProvide a continuous audit trail of resource configurations
- CScan for security vulnerabilities in EC2 instances
- DAd-hoc command execution on EC2 instances
Why this is the answer
State Manager is a Systems Manager capability that enforces a desired state configuration on instances using associations. It runs on a schedule to proactively prevent drift. AWS Config provides continuous audit trail, not State Manager.
- Question 2Multiple Select
Which of the following are valid features of AWS Config? (Select TWO.)
- AContinuous evaluation of resource configurations against rulesCorrect answer
- BAutomatic remediation of non-compliant resources by default
- CRecording a configuration timeline for each supported resourceCorrect answer
- DProactive enforcement of desired state on EC2 instances
Why this is the answer
AWS Config performs continuous evaluation of resource configurations against rules and maintains a configuration timeline. It does not automatically remediate by default; remediation requires additional automation. Proactive enforcement is done by State Manager.
- Question 3Interactive
Review the following CloudFormation snippet. Which resource property is used to prevent accidental updates to the stack?
- ADisableRollback
- BStackPolicy
- CEnableTerminationProtectionCorrect answer
- DDeletionPolicy
Why this is the answer
EnableTerminationProtection is a stack-level attribute that prevents accidental stack deletion. DisableRollback only prevents rollback on failure. StackPolicy controls update permissions to resources, not deletion. DeletionPolicy defines what happens when a resource is deleted.
- Question 4Single Choice
What is the purpose of a conformance pack in AWS Config?
- ADeploy a collection of Config rules and remediation actions as a single entityCorrect answer
- BStore template definitions for EC2 Image Builder pipelines
- CManage state file locking for Terraform deployments
- DAutomatically rotate database credentials
Why this is the answer
A conformance pack is a collection of AWS Config rules and remediation actions that can be deployed as a single entity across accounts or OUs. It helps enforce compliance frameworks like CIS AWS Foundations Benchmark.
- Question 5Multiple Select
Which of the following are capabilities of AWS Systems Manager Patch Manager? (Select TWO.)
- AAutomating the process of patching managed nodesCorrect answer
- BProviding continuous compliance evaluation of running instances
- CUsing patch baselines to define approved and rejected patchesCorrect answer
- DEnforcing a desired state configuration on instances
Why this is the answer
Patch Manager automates patching using patch baselines. Continuous compliance evaluation is done by AWS Config, not Patch Manager. Enforcing desired state is the role of State Manager.
- Question 6Interactive
Examine the following Terraform configuration snippet. What is the purpose of the 'backend' block?
- ADefine the provider used to create resources
- BSpecify where Terraform stores its state dataCorrect answer
- CConfigure authentication with cloud providers
- DSet variable values for the infrastructure
Why this is the answer
The backend block configures where Terraform stores its state file, including optional state locking. In this example, it uses an S3 bucket with DynamoDB for locking.
- Question 7Single Choice
Which AWS service provides automatic rotation of RDS database passwords?
- AAWS Systems Manager Parameter Store
- BAWS Secrets ManagerCorrect answer
- CAWS Key Management Service (KMS)
- DAWS Certificate Manager (ACM)
Why this is the answer
AWS Secrets Manager provides built-in automatic rotation for supported services like RDS via Lambda functions. Parameter Store does not natively rotate secrets. KMS is for encryption keys, ACM for certificates.
- Question 8Multiple Select
Which of the following are true about AWS CloudFormation StackSets? (Select TWO.)
- AThey can deploy stacks across multiple AWS accounts and RegionsCorrect answer
- BThey support both self-managed and service-managed permission modelsCorrect answer
- CThey automatically remediate configuration drift without user intervention
- DThey are used exclusively for Amazon ECS cluster management
Why this is the answer
StackSets are used to deploy stacks across multiple accounts and Regions, and they support two permission models: self-managed and service-managed. They do not automatically remediate drift; drift detection is a separate feature. StackSets are not exclusive to ECS.
High Availability, Fault Tolerance, and Disaster Recovery
5 questions in this domain
- Question 9Single Choice
What is the primary purpose of a multi-AZ architecture in AWS?
- AFailure of a single data center within a regionCorrect answer
- BFailure of an entire AWS region
- CFailure of an individual EC2 instance
- DFailure of a single load balancer
Why this is the answer
Multi-AZ protects against the failure of a single Availability Zone, not a full region.
- Question 10Multiple Select
Which two of the following are Route 53 routing policies that can be used for high availability?
- AFailover routingCorrect answer
- BSimple routing
- CWeighted routingCorrect answer
- DLatency-based routing
Why this is the answer
Failover and Weighted routing policies support health checks to exclude unhealthy endpoints.
- Question 11Interactive
Based on the CloudFormation snippet below, what is the consequence of setting the FailureThreshold to 3?
- A3 consecutive failuresCorrect answer
- B10 consecutive failures
- CThe number of failures required is not specified
- DThe health check will never be marked unhealthy
Why this is the answer
The FailureThreshold parameter defines the number of consecutive failures before marking unhealthy.
- Question 12Single Choice
What distinguishes a Warm Standby DR strategy from a Pilot Light strategy?
- AWarm Standby has a full copy of data but no running compute resources
- BWarm Standby runs a scaled-down but fully functional environment in the DR regionCorrect answer
- CWarm Standby requires a multi-active configuration
- DWarm Standby uses only backup and restore
Why this is the answer
Warm Standby has a minimal running environment, while Pilot Light has only data replicated.
- Question 13Multiple Select
Which two of the following AWS services provide asynchronous cross-region replication?
- AAmazon S3 Cross-Region ReplicationCorrect answer
- BAmazon RDS Multi-AZ
- CDynamoDB Global TablesCorrect answer
- DAmazon RDS Read Replicas
Why this is the answer
S3 CRR and DynamoDB Global Tables replicate asynchronously across regions; RDS Multi-AZ is synchronous and within region.
Incident and Event Response
7 questions in this domain
- Question 14Single Choice
Which AWS service acts as the central event bus for handling operational events and routing them to Lambda functions?
- AAmazon EventBridgeCorrect answer
- BAmazon SNS
- CAmazon CloudWatch
- DAWS Config
Why this is the answer
Amazon EventBridge is the central event bus that ingests events from AWS services and routes them to targets like Lambda functions.
- Question 15Multiple Select
Which features of Amazon EventBridge are critical for incident response automation? (Select two.)
- ABuilt-in retry policy and dead-letter queueCorrect answer
- BSupports complex JSON event pattern matchingCorrect answer
- CProvides manual approval workflows
- DAutomatically deduplicates all events
Why this is the answer
EventBridge offers built-in retry/DLQ and advanced JSON pattern matching, essential for robust incident automation.
- Question 16Interactive
Review the EventBridge rule pattern below. Choose the option that correctly matches an EC2 instance stop event.
- ASource: aws.ec2, DetailType: EC2 Instance State-change Notification, Detail: state = stoppedCorrect answer
- BSource: aws.ec2, DetailType: EC2 Instance State-change Notification, Detail: state = running
- CSource: aws.ec2, DetailType: EC2 Instance Stop, Detail: state = stopped
- DSource: aws.ec2, DetailType: AWS API Call via CloudTrail, Detail: eventName = StopInstances
Why this is the answer
The correct pattern targets the EC2 instance state-change detail-type with state equal to stopped.
- Question 17Single Choice
What is the main function of an Auto Scaling lifecycle hook?
- ARun custom actions before instance transitionsCorrect answer
- BTerminate unhealthy instances immediately
- CDefine scaling policies based on metrics
- DMonitor CPU utilization of instances
Why this is the answer
Lifecycle hooks pause instance launch or termination to run custom actions like software installation or deregistration.
- Question 18Multiple Select
Which two AWS services can be combined to create self-healing mechanisms?
- AAWS Config Auto-RemediationCorrect answer
- BAWS Systems Manager AutomationCorrect answer
- CAmazon Route 53
- DAWS Shield
Why this is the answer
AWS Config Auto-Remediation and Systems Manager Automation are core services for implementing automated self-healing.
- Question 19Interactive
Look at the Systems Manager Automation document snippet. Choose the option that completes the missing step to restart the service.
- Aaction: 'aws:runShellScript' and input: 'systemctl restart myapp'Correct answer
- Baction: 'aws:executeAwsApi' and input: 'ec2 restart-instances'
- Caction: 'aws:invokeLambdaFunction' and input: 'RestartFunction'
- Daction: 'aws:runPowerShellScript' and input: 'Restart-Service myapp'
Why this is the answer
The correct action for restarting a service on a Linux instance is 'aws:runShellScript' with the appropriate shell command.
- Question 20Single Choice
Which disaster recovery strategy involves running a minimal copy of production in another Region and scaling up on failover?
- APilot LightCorrect answer
- BBackup and Restore
- CWarm Standby
- DMulti-Site Active-Active
Why this is the answer
Pilot Light keeps core services (like database) replicated and infrastructure defined but not fully provisioned until needed.
Monitoring and Logging
7 questions in this domain
- Question 21Single Choice
What is the primary purpose of a CloudWatch Logs subscription filter?
- ATransform log data before storage
- BFilter logs for retention policy enforcement
- CRoute log events in real-time to destinations like Kinesis or LambdaCorrect answer
- DEncrypt log data at rest
Why this is the answer
Subscription filters are used to stream log data from CloudWatch Logs to other AWS services in near real-time, enabling centralized processing and analysis.
- Question 22Multiple Select
Which of the following are valid destinations for a CloudWatch Logs subscription filter? (Select two.)
- AAmazon S3
- BAWS LambdaCorrect answer
- CAmazon DynamoDB
- DAmazon Kinesis Data StreamsCorrect answer
Why this is the answer
CloudWatch Logs subscription filters can deliver logs to Lambda, Kinesis Data Streams, Kinesis Data Firehose, and Amazon OpenSearch Service. S3 and DynamoDB are not direct destinations.
- Question 23Interactive
Examine the provided ECS task definition snippet. Which component is being deployed as a sidecar container to forward trace data to AWS X-Ray?
- AX-Ray DaemonCorrect answer
- BX-Ray SDK
- CX-Ray Sampling Rule
- DX-Ray API
Why this is the answer
The X-Ray Daemon must run as a sidecar on ECS (or on EC2) to receive segment data from the application and send it to the X-Ray service.
- Question 24Single Choice
What is the default buffer size for Amazon Kinesis Data Firehose before delivering data to its destination?
- A1 MB or 10 seconds
- B5 MB or 60 secondsCorrect answer
- C128 MB or 900 seconds
- D256 MB or 300 seconds
Why this is the answer
The default buffering hint for Kinesis Data Firehose is 5 MB or 60 seconds. The larger limits (128 MB or 900 seconds) are configurable maximums.
- Question 25Multiple Select
Which of the following are true about AWS X-Ray annotations? (Select two.)
- AAnnotations are key-value pairs that are indexed for search.Correct answer
- BAnnotations are non-indexed and can be arbitrary JSON.
- CAnnotations can be used to filter traces in the X-Ray console.Correct answer
- DAnnotations are automatically added by AWS services without code changes.
Why this is the answer
Annotations are indexed and searchable, allowing you to filter traces. Metadata is non-indexed. Annotations require explicit code instrumentation.
- Question 26Interactive
Using the provided CloudFormation alarm snippet, what will be the initial state of the alarm if no data points have been received yet?
- AALARM
- BOK
- CINSUFFICIENT_DATACorrect answer
- DMISSING
Why this is the answer
When TreatMissingData is set to 'missing', missing data points are not considered breaching. With no data at all, the alarm remains in INSUFFICIENT_DATA.
- Question 27Single Choice
Which AWS service provides a managed ELK stack (Elasticsearch, Logstash, Kibana) for log analysis?
- AAmazon CloudWatch Logs
- BAmazon OpenSearch ServiceCorrect answer
- CAmazon Kinesis Data Analytics
- DAmazon Athena
Why this is the answer
Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) is a managed service that provides the ELK stack with Elasticsearch, Logstash, and Kibana.
Policies and Standards Automation
5 questions in this domain
- Question 28Single Choice
What is the primary purpose of AWS Config managed rules?
- AReplace IAM policies
- BEvaluate resource configurations for complianceCorrect answer
- CAutomatically create AWS resources
- DMonitor network traffic patterns
Why this is the answer
Managed rules are pre-built templates that continuously evaluate AWS resources against compliance standards like CIS or HIPAA.
- Question 29Multiple Select
Which two AWS services can automatically remediate non-compliant IAM resources?
- AAWS Systems Manager AutomationCorrect answer
- BAWS LambdaCorrect answer
- CAmazon Simple Notification Service
- DAWS CloudTrail
Why this is the answer
SSM Automation documents and custom Lambda functions are common patterns to automatically remediate non-compliant resources.
- Question 30Interactive
Which condition key in an IAM policy enforces a required tag at resource creation?
- Aaws:RequestTagCorrect answer
- Baws:ResourceTag
- Caws:TagKeys
- Dec2:TagSpecification
Why this is the answer
The aws:RequestTag condition key checks for tags in the API request to enforce tagging at creation.
- Question 31Single Choice
What is the effect of a Service Control Policy with an explicit Deny on an action?
- AAction is allowed if IAM policy allows
- BAction is denied regardless of IAM permissionsCorrect answer
- CAction is allowed only for the root user
- DAction is denied but resource-based policies can override
Why this is the answer
An explicit Deny in an SCP always overrides any Allow in IAM policies, making the action unavailable.
- Question 32Multiple Select
Which two metrics are key for disaster recovery validation?
- ARecovery Point Objective (RPO)Correct answer
- BRecovery Time Objective (RTO)Correct answer
- CMean Time Between Failures (MTBF)
- DService Level Agreement (SLA)
Why this is the answer
RPO defines acceptable data loss, and RTO defines acceptable downtime during recovery.
SDLC Automation
10 questions in this domain
- Question 33Single Choice
Which AWS service is primarily used for automated deployment of application code to EC2 instances?
- AAWS CodeBuild
- BAWS CodeDeployCorrect answer
- CAWS CodePipeline
- DAWS CodeCommit
Why this is the answer
AWS CodeDeploy is the managed service that automates code deployments to EC2, Lambda, and ECS. CodeBuild handles building and testing, CodePipeline orchestrates the pipeline, and CodeCommit is a source control service.
- Question 34Multiple Select
Which of the following are valid artifact repository services on AWS? (Choose two.)
- AAmazon S3Correct answer
- BAmazon DynamoDB
- CAWS CodeArtifactCorrect answer
- DAmazon RDS
Why this is the answer
S3 is widely used for storing generic build artifacts, and CodeArtifact is a managed service for package dependencies. DynamoDB and RDS are databases, not artifact stores.
- Question 35Interactive
Examine the following CloudFormation template snippet. Which intrinsic function should replace the placeholder to retrieve the VPC ID from another stack?
- AFn::GetAtt
- BFn::ImportValueCorrect answer
- CRef
- DFn::Select
Why this is the answer
Fn::ImportValue is used to import values exported from other stacks using the Export field. Fn::GetAtt gets attributes of resources in the same stack, Ref returns the physical ID, and Fn::Select selects from a list.
- Question 36Single Choice
What does the 'CodeGuru Reviewer' service primarily analyze?
- ARuntime performance
- BStatic code quality and security vulnerabilitiesCorrect answer
- CInfrastructure configuration
- DNetwork traffic patterns
Why this is the answer
CodeGuru Reviewer is a static analysis tool that identifies code defects, security vulnerabilities, and best practice violations. CodeGuru Profiler handles runtime performance.
- Question 37Multiple Select
Which of the following are valid trigger mechanisms for AWS CodePipeline? (Choose two.)
- AAmazon CloudWatch Events (EventBridge)Correct answer
- BAWS Lambda function invocation
- CGitHub webhooks via CodeStar ConnectionsCorrect answer
- DAmazon SQS queue messages
Why this is the answer
CodePipeline can be triggered by CloudWatch Events (e.g., CodeCommit state changes) and by webhooks from GitHub, Bitbucket, or GitLab via CodeStar Connections. Lambda is a possible action within a pipeline, not a trigger. SQS is not a native trigger for CodePipeline.
- Question 38Interactive
Review the following CodeDeploy lifecycle hook configuration. Which hook is missing to run a validation script after traffic is shifted to the new environment?
- ABeforeInstall
- BAfterInstall
- CAfterAllowTrafficCorrect answer
- DBeforeAllowTraffic
Why this is the answer
AfterAllowTraffic runs after the new environment receives traffic. BeforeInstall runs before installation, AfterInstall after installation, and BeforeAllowTraffic before shifting traffic.
- Question 39Single Choice
Which AWS service is used to manage package dependencies (such as npm, Maven, PyPI) within a CI/CD pipeline?
- AAmazon S3
- BAWS CodeArtifactCorrect answer
- CAmazon ECR
- DAWS Systems Manager
Why this is the answer
AWS CodeArtifact is a fully managed artifact repository service that works with popular package managers (npm, Maven, PyPI, NuGet, etc.). S3 is for generic binary artifacts, ECR for container images, and Systems Manager for operational data.
- Question 40Multiple Select
Which of the following are valid deployment strategies supported by AWS CodeDeploy? (Choose two.)
- ABlue/GreenCorrect answer
- BCanary
- CIn-PlaceCorrect answer
- DAll-at-once
Why this is the answer
CodeDeploy supports In-Place (rolling) and Blue/Green deployments. Canary and All-at-once are deployment strategies for ECS or Lambda, not directly for EC2/on-premises with CodeDeploy.
- Question 41Interactive
Examine this CodePipeline JSON definition. Which attribute must be added to the source stage to prevent polling when using EventBridge triggers?
- APollForSourceChanges: falseCorrect answer
- BRunOrder: 1
- CBranch: main
- DOutputArtifacts: []
Why this is the answer
Setting PollForSourceChanges to false disables the default polling mechanism when a CloudWatch Events rule is configured to trigger the pipeline. Without this, the pipeline may run twice per commit.
- Question 42Single Choice
What does a 'change set' in AWS CloudFormation allow you to do before executing a stack update?
- AIt automatically rolls back the stack on failure.
- BIt previews the changes that will be made to resources.Correct answer
- CIt deletes the stack immediately.
- DIt runs a full integration test on the template.
Why this is the answer
A change set shows the proposed changes (additions, modifications, deletions) to resources without actually applying them. This allows manual review and approval before an update. Rollback is a separate feature.
Frequently asked questions
Everything about the AWS Certified DevOps Engineer – Professional question bank and how to use it.