DOP-C02 Practice Question 25: Instance Refresh Checkpoints
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 3 · question 5 of 10
An Auto Scaling group of 40 instances behind an Application Load Balancer must be moved to a new Amazon Machine Image. The Auto Scaling group is created and managed by a provisioning tool other than AWS CloudFormation. The reliability team requires that the rollout pause after 20 percent and again after 50 percent of instances are new so they can review dashboards, that at least 90 percent of the group stays in service throughout, and that the whole rollout can be reversed to the previous image if a review fails. The team does not want to build custom orchestration.
What should the team do?
Show answer and explanation
Answer:
Instance refresh is the managed way to roll a new AMI or launch template through an Auto Scaling group, and checkpoints are the feature that turns it into a phased rollout: "you add checkpoints, which are points in time where the instance refresh pauses" so "you can perform verifications on your instances as you go." The checkpoint percentages are the minimum percentage of new instances that must exist before each pause, and Amazon EC2 Auto Scaling paces replacements to honor them while maintaining the minimum healthy percentage, 90 percent here. Auto Scaling also emits an event at each checkpoint (except the final one), so an EventBridge rule can notify the reviewers. The final checkpoint must be 100 so the refresh finishes rather than stopping part way. Because the refresh records a desired configuration, an undo is a rollback rather than a second hand-built rollout.
Option A is the custom orchestration the team ruled out: it doubles cost during the rollout, and nothing enforces the 90 percent floor or gives a supported rollback.
Option C does not apply. CodeDeploy blue/green with an Auto Scaling group deploys *application revisions* onto a copy of the group; it does not roll a new launch template or AMI into the existing group, and HalfAtATime shifts in halves rather than pausing at 20 and 50 percent.
Option D rebuilds instance refresh badly. A launching lifecycle hook holds each new instance in a wait state until someone completes the action, so a reviewer has to act 40 times instead of twice, and the team still has to write the code that decides which instances to terminate and when.
Reference: Add checkpoints to an instance refresh