Luyện thi AWS DevOps Engineer Professional

CodePipeline models release pipelines with source, build, test, and deploy stages. CodeCommit is source control, S3 is storage, and CloudTrail records API calls.

CodeBuild compiles and tests code in managed build environments. CodeDeploy deploys applications, Systems Manager manages instances, and CloudWatch monitors.

CodeDeploy automates application deployments to EC2, Lambda, and on-premises systems. CodePipeline orchestrates stages, CodeCommit stores code, and Config tracks configuration.

Blue/green keeps an old environment active while a new one is validated, then shifts traffic. Rolling replaces instances gradually; deleting first is risky; building is not deployment.

Canary releases serve a small slice of traffic to the new version before full rollout. Sending all traffic or disabling checks is not a canary.

Approval actions pause pipelines until a user approves or rejects the change. Build commands, alarms, and bucket policies are different.

CodePipeline supports cross-region actions so artifacts can be deployed in other Regions. VPCs, versioning, and CloudTrail do not provide cross-region pipeline actions.

CodeCommit is a managed Git repository service. CodeBuild builds code, ECR stores container images, and WAF filters web traffic.

buildspec.yml defines install, pre-build, build, and post-build phases in CodeBuild. Route tables, IAM policies, and dashboards are unrelated.

CodePipeline orchestrates release stages, CodeBuild builds and tests, CodeDeploy deploys, and CodeCommit hosts Git repositories.

CloudFormation provisions AWS resources from templates. CodeDeploy deploys apps, CodeCommit stores code, and CloudWatch monitors.

Change sets let you review how a stack update will change resources before applying it. Backups, scripts, and roles are different.

Drift detection identifies resources whose live configuration no longer matches the template. It does not delete or roll back resources.

The AWS Cloud Development Kit defines infrastructure in TypeScript, Python, Java, and other languages. CodeDeploy deploys apps, SNS sends messages, and Shield protects against DDoS.

Terraform manages infrastructure across cloud providers with declarative configuration. It is not AWS-only, a database, or a CDN.

StackSets deploy stacks to multiple accounts and Regions from one template. Backups, builds, and DNS records are different.

CloudFormation assumes the execution role when creating, updating, or deleting stack resources. Lambda runtimes, security groups, and launch templates are not roles.

Template parameters let users supply values such as instance types or environment names at stack creation. Embedding, S3, and VPCs are not parameter mechanisms.

Secrets Manager stores and rotates secrets such as database credentials. CodeCommit, CloudWatch, and WAF do not manage secrets.

CloudFormation provisions templates, change sets preview updates, drift detection finds mismatches, and StackSets deploy across accounts.

Systems Manager manages instance configuration, patching, and state. CodePipeline orchestrates releases, Route 53 is DNS, and ECS runs containers.

OpsWorks manages servers with Chef and Puppet. ECR stores images, WAF filters traffic, and Route 53 resolves DNS.

State Manager associations define configuration states that Systems Manager applies and monitors. Routes, snapshots, and load balancers are different.

Run Command executes commands on managed instances in parallel. Templates, build stages, and DNS records are different.

Patch Manager automates patching across managed instances. Building images, routing traffic, and storing backups are separate functions.

Config records configuration changes and evaluates rules. Pipelines, repositories, and CDNs are different services.

SSM documents define actions for Run Command, State Manager, and Automation. Buckets, dashboards, and peering are not documents.

Automation executes runbooks for common maintenance and remediation tasks. Building, DNS, and image storage are other services.

Secrets should live in Parameter Store or Secrets Manager with least-privilege access. Committing, publishing, or disabling encryption is unsafe.

Systems Manager manages instances, Config tracks configuration, OpsWorks manages with Chef/Puppet, and Patch Manager automates patching.

Logs Insights lets you query log groups with a purpose-built query language. CodeBuild builds, Route 53 resolves DNS, and Direct Connect is networking.

X-Ray traces requests across services to find bottlenecks and errors. Log archives, firewalls, and load balancers are different.

Composite alarms aggregate multiple alarms to reduce noise. Single-metric alarms, DNS checks, and backups are different.

Synthetics runs configurable canaries that verify endpoints and flows. Repositories, databases, and CDNs are not canary services.

CloudWatch collects and stores metrics from AWS resources and applications. CodeCommit stores code, S3 stores objects, and WAF filters traffic.

Container Insights collects metrics and logs from ECS and EKS. ECR stores images, CodeBuild builds, and Route 53 manages DNS.

Log subscriptions stream matching log events to Lambda, Kinesis, or OpenSearch in real time. They are not backups, DNS records, or routes.

ADOT provides instrumented OpenTelemetry components that send traces and metrics to AWS services. It is not a database, runtime, or firewall.

Contributor Insights analyzes log data to find top contributors such as IP addresses or error types. IAM, security groups, and storage classes are different.

Logs Insights queries logs, X-Ray traces requests, Synthetics runs canaries, and Container Insights monitors containers.

Least privilege limits permissions to what is required. Admin-for-all, disabled IAM, and shared accounts are security risks.

GuardDuty analyzes VPC, DNS, and CloudTrail data to detect threats. CodeBuild builds, Route 53 resolves DNS, and WAF filters web traffic.

ECR image scanning finds vulnerabilities in container images. Pipelines, S3, and Direct Connect do not scan images.

Security Hub centralizes findings from GuardDuty, Inspector, Config, and partner tools. Repositories, databases, and load balancers are different.

Inspector assesses workloads for software vulnerabilities and network exposure. Build tools, CDNs, and DNS services are different.

SCPs restrict what member accounts can do even if their IAM policies allow more. S3 policies, routes, and dashboards are not SCPs.

Secrets Manager stores secrets and can rotate them automatically. CodeCommit, S3, and WAF are not secret managers.

KMS creates and controls encryption keys used across AWS services. Builds, DNS, and WAF are unrelated.

Permission boundaries cap the permissions granted to IAM principals. VPCs, alarms, and load balancer rules are different.

GuardDuty detects threats, Inspector assesses vulnerabilities, Security Hub aggregates findings, and KMS manages encryption keys.

Auto Scaling groups maintain and adjust EC2 capacity. DNS records, databases, and images are different.

Multi-AZ deployment with load balancing tolerates AZ failures. A single instance, disabled checks, and one volume reduce availability.

Multi-AZ provides a synchronous standby for automatic failover. Read replicas scale reads, snapshots back up, and caches speed reads.

On-demand mode adjusts capacity instantly based on traffic. Provisioned capacity is fixed, and DynamoDB is not relational or a backup.

Multi-Region DR replicates workloads and data so traffic can fail over. Instance types, versioning alone, and no backups are insufficient.

Route 53 health checks combined with failover routing shift traffic from unhealthy endpoints. CloudWatch monitors, CloudTrail records, and Config tracks configuration.

Event-driven systems react to events with services such as Lambda, SNS, and SQS. Monoliths, no scaling, and database-only designs are different.

Reserved concurrency caps function executions and protects other functions. Connections, routes, and scripts are different.

Queues and topics let services exchange messages without tight coupling. Synchronous calls, in-memory state, and no retries reduce resilience.

Auto Scaling adjusts instances, Multi-AZ provides database failover, Route 53 handles DNS failover, and SQS decouples services.