AWS DevOps DevOps CI/CD Pipeline Design & Implementation 2 — Questions and Answers
Question 1: A team wants to run integration tests in AWS CodePipeline only after unit tests pass, and in parallel with security scans. Which pipeline configuration achieves this?
- Use sequential stages where unit tests, integration tests, and security scans each run one after another
- Use a single stage with multiple action groups: unit tests in group 1, integration tests and security scans in group 2 (Correct answer)
- Use Lambda functions to trigger each test type independently outside of CodePipeline
- Configure separate pipelines for each test type and use SNS to coordinate them
Correct answer: Use a single stage with multiple action groups: unit tests in group 1, integration tests and security scans in group 2
CodePipeline action groups within a stage run sequentially by group number, but actions within the same group run in parallel, enabling this dependency pattern.
Question 2: Which AWS CodeBuild feature allows you to cache dependencies between builds to reduce build time?
- Build artifacts stored in S3 with versioning enabled
- CodeBuild cache configured with S3 or local cache for dependency directories (Correct answer)
- ElastiCache cluster mounted as a network drive during builds
- EFS file system shared across all CodeBuild projects
Correct answer: CodeBuild cache configured with S3 or local cache for dependency directories
CodeBuild supports S3 caching and local caching (within the same build host) for directories like node_modules or .m2 to speed up subsequent builds.
Question 3: A company needs to deploy a Lambda function with zero downtime and the ability to instantly roll back if errors spike. Which deployment configuration should they use?
- Lambda versioning with manual alias switching after testing
- CodeDeploy with a Canary10Percent5Minutes deployment configuration (Correct answer)
- S3 blue/green deployment with CloudFront cache invalidation
- Elastic Beanstalk rolling update with health checks
Correct answer: CodeDeploy with a Canary10Percent5Minutes deployment configuration
CodeDeploy Canary deployments shift a small percentage of traffic first, monitor CloudWatch alarms, and automatically roll back if the alarm triggers within the specified window.
Question 4: In AWS CodePipeline, what is the purpose of a manual approval action?
- It pauses the pipeline and sends a notification, requiring a human to explicitly approve or reject before the pipeline continues (Correct answer)
- It automatically approves deployments that pass all automated tests
- It creates a pull request in CodeCommit for peer review
- It triggers a Lambda function that validates deployment readiness
Correct answer: It pauses the pipeline and sends a notification, requiring a human to explicitly approve or reject before the pipeline continues
Manual approval actions halt pipeline execution and notify approvers via SNS; the pipeline resumes only when someone approves or rejects within the configured timeout.
Question 5: A developer committed a broken build to the main branch. The CI system should prevent merges that break the build. Which approach enforces this on AWS CodeCommit?
- Enable branch protection rules that require all pull requests to pass a CodeBuild project before merging (Correct answer)
- Use S3 event notifications to trigger a build on every commit
- Configure CodePipeline to send an email when the build fails
- Use IAM policies to restrict direct pushes to the main branch
Correct answer: Enable branch protection rules that require all pull requests to pass a CodeBuild project before merging
CodeCommit branch protection rules can require pull request approvals and associate a CodeBuild status check that must pass before a merge is allowed.
Question 6: Which artifact store does AWS CodePipeline use by default to pass artifacts between stages?
- Amazon EFS shared file system mounted on pipeline workers
- Amazon S3 bucket created in the same region as the pipeline (Correct answer)
- Amazon DynamoDB table with artifact metadata
- Amazon ECR repository for container-based artifacts
Correct answer: Amazon S3 bucket created in the same region as the pipeline
CodePipeline uses an S3 bucket as the default artifact store; output artifacts from one stage are uploaded to S3 and downloaded by the next stage.
Question 7: A team uses AWS CDK to define their infrastructure and wants pipeline changes (including the pipeline itself) to be deployed automatically when CDK code changes. Which CDK Pipelines feature enables this?
- CdkPipeline.addApplicationStage() with manual approval between environments
- Self-mutation, where the pipeline updates itself before deploying application stages (Correct answer)
- AWS CloudFormation StackSets that distribute changes across regions automatically
- CodeDeploy blue/green deployments triggered by CDK synth output
Correct answer: Self-mutation, where the pipeline updates itself before deploying application stages
CDK Pipelines supports self-mutation: the pipeline first runs cdk synth and updates its own CloudFormation stack, then proceeds to deploy application stages with the latest changes.
AWS DevOps DevOps CI/CD Pipeline Design & Implementation 2
A team wants to run integration tests in AWS CodePipeline only after unit tests pass, and in parallel with security scans.
Which pipeline configuration achieves this?