aws devops interview questions Intermediate Practice Exam: Medium Difficulty 2025

A DevOps team is implementing a CI/CD pipeline for a microservices application deployed on Amazon ECS. The team needs to ensure that new container images are automatically scanned for vulnerabilities before deployment, and deployments should be blocked if critical vulnerabilities are found. Which combination of services should be implemented to meet these requirements?

A company uses AWS CloudFormation to manage infrastructure across multiple AWS accounts. The DevOps team needs to ensure that all CloudFormation stacks comply with organizational policies, such as requiring encryption for all S3 buckets and specific tagging standards. What is the most efficient approach to enforce these policies?

An application running on Amazon EC2 instances behind an Application Load Balancer experiences intermittent connection timeouts during deployment. The DevOps team uses AWS CodeDeploy with a Blue/Green deployment strategy. Health checks pass, but some users report errors during the cutover. What is the MOST likely cause and solution?

A DevOps engineer needs to centralize logs from multiple AWS accounts and services, including VPC Flow Logs, CloudTrail, and application logs from ECS containers. The solution must enable cross-account queries and retain logs for 7 years for compliance. Which architecture provides the most cost-effective and operationally efficient solution?

An application deployed using AWS CodePipeline and CodeDeploy to an Auto Scaling group occasionally fails during deployment with the error 'The deployment failed because no instances were found'. The Auto Scaling group has a minimum of 2 instances and uses target tracking scaling. What is the MOST likely cause and appropriate solution?

A company's CloudWatch alarm for high CPU usage on EC2 instances triggers frequently during normal business hours, creating alert fatigue. Investigation shows CPU spikes are expected during batch processing jobs that run every hour and complete within 5 minutes. How should the DevOps engineer optimize the alarming strategy?

A DevOps team manages a multi-tier application using AWS Systems Manager Parameter Store for configuration. The application spans development, staging, and production environments. The team needs to implement a strategy that allows environment-specific configurations while maintaining a single deployment pipeline. Which approach follows AWS best practices?

A company detects unauthorized API calls in their AWS CloudTrail logs. The DevOps team needs to implement an automated response system that disables compromised IAM access keys within minutes of detection and notifies the security team. Which solution provides the fastest automated response?

A company uses AWS CodePipeline with CodeBuild to build Docker images and deploy to EKS. The build process requires accessing secrets stored in AWS Secrets Manager. The DevOps team needs to ensure secrets are securely accessed during builds without embedding credentials in the buildspec file or Docker images. What is the recommended approach?

A DevOps team is implementing infrastructure as code using AWS CloudFormation for a complex application with databases, compute resources, and networking components. The team wants to enable developers to quickly spin up complete application stacks while ensuring consistent security configurations. Which CloudFormation feature should they leverage?