A company's DevOps engineer manages an organization in AWS Organizations, which includes many accounts. The company needs to enable termination protection for all AWS CloudFormation stacks in production accounts. Non-production accounts do not require termination protection. The company has designated a central account for AWS Config aggregation and configured production accounts to support CloudFormation and AWS Config. The company has grouped production accounts into an organizational unit (OU). Which solution meets these requirements?

B. Create a CloudFormation template that deploys an AWS Config rule to detect stacks without termination protection enabled. Add a remediation action to enable termination protection. Use CloudFormation StackSets to deploy the template to the OU containing production accounts.

A. Create an AWS Config rule to detect stacks without termination protection enabled. Add a remediation action to enable termination protection. Deploy the rule across the organization using the PutOrganizationConfigRule API operation.

B. Create a CloudFormation template that deploys an AWS Config rule to detect stacks without termination protection enabled. Add a remediation action to enable termination protection. Use CloudFormation StackSets to deploy the template to the OU containing production accounts.

C. Create a service control policy (SCP) that denies the cloudformation:DeleteStack action. Use CloudFormation StackSets to apply the SCP to the OU containing production accounts.

D. Create a CloudFormation stack policy that denies Update:Delete actions. Use CloudFormation StackSets to apply the policy to the OU containing production accounts.

A DevOps engineer is using AWS CodeDeploy on a set of Amazon EC2 instances in an EC2 Auto Scaling group. The CodeDeploy deployment group associated with the EC2 Auto Scaling group is configured to use CodeDeployDefault.OneAtATime for in-place deployments. During an ongoing new deployment, the engineer observes that although the overall deployment succeeds, two-thirds of the instances deployed a previous application revision, while the remaining one-third have the latest application revision.

D. EC2 Auto Scaling launched two new instances during the new deployment before it completed, causing the previous application version to be deployed to the affected instances.

A. The two affected instances were unable to retrieve the new deployment.

B. A failed AfterInstall lifecycle event hook caused the CodeDeploy agent to roll back to the previous version on the affected instances.

C. The CodeDeploy agent is not installed on the two affected instances.

D. EC2 Auto Scaling launched two new instances during the new deployment before it completed, causing the previous application version to be deployed to the affected instances.

A company operates a file retrieval application that saves files to a database running on Amazon EC2 instances. Regulatory requirements mandate that the company delete files daily from specific EC2 instances. The company also retains database records for no more than 60 days. Database record deletion occurs after file deletion. The company has created a script to delete both files and database records. If the deletion script fails, the company must receive an email notification.

A. Use AWS Systems Manager State Manager to automatically invoke a Systems Manager Automation document at a scheduled time each day. Configure the Automation document to run the deletion script sequentially using Run Command. Create an Amazon EventBridge rule to send failure notifications to the company via Amazon Simple Notification Service (Amazon SNS).

B. Use AWS Systems Manager State Manager to automatically invoke a Systems Manager Automation document at a scheduled time each day. Configure the Automation document to run the deletion script sequentially using Run Command. Add a conditional statement in the Automation document as a final step to check for errors. Use Amazon Simple Email Service (Amazon SES) to send failure notifications as emails to the company.

C. Create an Amazon EventBridge rule that invokes an AWS Lambda function at a scheduled time. Add required invocation permissions to the Lambda function’s resource-based policy. Configure the Lambda function to run the deletion script sequentially. Configure the Lambda function to send failure notifications to the company via Amazon Simple Notification Service (Amazon SNS).

D. Create an Amazon EventBridge rule that invokes an AWS Lambda function at a scheduled time. Add required invocation permissions to the Lambda function’s resource-based policy. Configure the Lambda function to run the deletion script sequentially. Configure the Lambda function to use Amazon Simple Email Service (Amazon SES) to send failure notifications as emails to the company.

A development team is building a full-stack serverless web application consisting of a backend REST API and a frontend built using a single-page application (SPA) framework. The team wants to adopt a Git-based workflow for development and deployment. They created an AWS CodeCommit repository to store application code. They want to use multiple development branches to test new features and ensure that code changes on development branches are deployed to different development environments. Code changes to the main branch must be automatically promoted to production.

A. Create an application in the AWS Amplify console and connect the CodeCommit repository. Create feature branch deployments for each environment. Connect the Route 53 domain to the application and enable automatic subdomain creation.

B. Create an AWS CodePipeline pipeline using the CodeCommit repository as the source. Configure the pipeline to deploy to different environments based on the changed branch. Create an AWS Lambda function that creates a new subdomain based on the source branch name and invoke it in the deployment workflow.

C. Create an application in AWS Elastic Beanstalk using the CodeCommit repository as the source. Configure Elastic Beanstalk to create new application environments based on the changed branch. Connect the Route 53 domain to the application and enable automatic subdomain creation.

D. Create multiple AWS CodePipeline pipelines using the CodeCommit repository as the source. Configure each pipeline to deploy to a specific environment based on a configured branch. Configure AWS CodeDeploy steps in the pipelines to deploy application components and create Route 53 public hosted zones.

A global retail company headquartered in the United States plans to expand its business into Europe and Asia over the next six months. Its product catalog currently runs on Amazon EC2 instances behind an Application Load Balancer. These instances run in an Amazon EC2 Auto Scaling group spanning multiple Availability Zones. All data is stored in an Amazon Aurora database cluster.

C. Use Aurora with read-only replicas for the product catalog and additional local Aurora instances in each region for customer information and purchases.

A. Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for customer information and purchases.

B. Use Amazon DynamoDB global tables for the product catalog and regional DynamoDB tables for customer information and purchases.

C. Use Aurora with read-only replicas for the product catalog and additional local Aurora instances in each region for customer information and purchases.

D. Use Aurora for the product catalog and Amazon DynamoDB global tables for customer information and purchases.

A company wants to ensure their EC2 instances are secure. They want to be notified when new vulnerabilities are discovered on their instances and want to maintain audit trails of all login activity on the instances.

D. Configure Amazon Inspector to detect vulnerabilities on EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and log them via Amazon CloudWatch Logs.

A. Use AWS Systems Manager to detect vulnerabilities on EC2 instances. Install the Amazon Kinesis Agent to capture system logs and deliver them to Amazon S3.

B. Use AWS Systems Manager to detect vulnerabilities on EC2 instances. Install the Systems Manager Agent to capture system logs and view login activity in the CloudTrail console.

C. Configure Amazon CloudWatch to detect vulnerabilities on EC2 instances. Install the AWS Config agent to capture system logs and view them in the AWS Config console.

D. Configure Amazon Inspector to detect vulnerabilities on EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and log them via Amazon CloudWatch Logs.

A developer team manages the infrastructure for an application that uses long-running processes to consume items from an Amazon Simple Queue Service (SQS) queue. The application is deployed to an Auto Scaling group. The application recently encountered an issue where item processing duration increased significantly. The queue grew beyond its expected size, disrupting business processes. Application logs are sent to a third-party tool. The team currently subscribes to an Amazon Simple Notification Service (Amazon SNS) topic for alerts. They need to be notified when the queue exceeds its expected size.

B. Create a 1-hour period Amazon CloudWatch alarm that triggers when the sum of the metric value exceeds the expected threshold. Configure the alarm to notify the SNS topic.

A. Create a 1-hour period Amazon CloudWatch alarm that triggers when the average value exceeds the expected threshold. Configure the alarm to notify the SNS topic.

B. Create a 1-hour period Amazon CloudWatch alarm that triggers when the sum of the metric value exceeds the expected threshold. Configure the alarm to notify the SNS topic.

C. Create an AWS Lambda function that retrieves the ApproximateNumberOfMessagesVisible queue attribute and publishes it as a new CloudWatch custom metric. Create an Amazon EventBridge rule that runs the Lambda function every 5 minutes. Create a 1-hour CloudWatch metric alarm with a static threshold on the new custom metric’s sum.

D. Create an AWS Lambda function that checks the ApproximateNumberOfMessagesVisible queue attribute and compares it against an expected size defined in the function. Create an Amazon EventBridge rule that runs the Lambda function every 5 minutes. Send a notification to the SNS topic when the queue attribute exceeds the expected size.

A company runs an application on an Amazon EC2 instance. Application metadata is stored in Amazon S3 and must be retrieved when the instance restarts or recovers automatically.

B. Configure AWS OpsWorks with auto-healing enabled to stop and start the instance. Use OpsWorks lifecycle events to fetch metadata from Amazon S3 and update it on the instance.

A. Create an Amazon CloudWatch alarm for the StatusCheckFailed metric. Use recovery actions to stop and start the instance. When the instance is back online, use S3 event notifications to push metadata to the instance.

B. Configure AWS OpsWorks with auto-healing enabled to stop and start the instance. Use OpsWorks lifecycle events to fetch metadata from Amazon S3 and update it on the instance.

C. Use EC2 Auto Recovery to automatically stop and start the instance upon failure. When the instance is back online, use S3 event notifications to push metadata to the instance.

D. Use AWS CloudFormation to create an EC2 instance with a UserData property. Include a command in UserData to retrieve application metadata from Amazon S3.

A company recently migrated its application to AWS. The application is hosted on Amazon EC2 instances behind an Application Load Balancer, which is placed behind Amazon API Gateway. The company wants to ensure minimal disruption to users when deploying new versions of the application. It also wants to ensure rapid rollback capability in case of issues.

A. Introduce the change as a separate, parallel environment alongside the existing one. Configure Amazon API Gateway to use a canary release deployment to route a small percentage of user traffic to the new environment.

B. Introduce the change as a separate, parallel environment alongside the existing one. Update the application's DNS alias record to point to the new environment.

C. Introduce the change as a separate target group behind the existing Application Load Balancer. Configure Amazon API Gateway to gradually route user traffic to the new target group.

D. Introduce the change as a separate target group behind the existing Application Load Balancer. Configure Amazon API Gateway to route all traffic to the Application Load Balancer, and then have the Application Load Balancer route traffic to the new target group.

A company is migrating its software development team from an on-premises data center to a hybrid environment. The new environment will span four AWS Regions, enabling developers to use the geographically closest Region. All development teams use a shared set of Linux applications. On-premises data centers store these applications on a network-attached storage (NAS) device. Developers run VMs locally, and the shared volume is updated weekly.

C. Create multi-AZ Amazon FSx for NetApp ONTAP with volumes and instances for each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and FSx, consumable by on-demand instances.

A. Create an Amazon S3 File Gateway in the on-premises data center. Create S3 buckets in each Region. Set up a cron job to copy data from the on-premises storage device to the S3 File Gateway. Enable S3 Cross-Region Replication (CRR) from the gateway bucket to buckets in each Region.

B. Create an Amazon FSx File Gateway in one Region. Create file servers in Amazon FSx for Windows File Server for each Region. Set up a cron job to copy data from the on-premises storage device to the FSx File Gateway.

C. Create multi-AZ Amazon FSx for NetApp ONTAP with volumes and instances for each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and FSx, consumable by on-demand instances.

D. Create an Amazon Elastic File System (Amazon EFS) file system in each Region. Deploy an AWS DataSync agent in the on-premises data center. Schedule daily DataSync tasks to replicate data to Amazon EFS.

AWS DOP-C02 Chapter 1 Free Practice Test 2025 — DevOps Engineer Professional Exam Questions

AWS DOP-C02 Chapter 1 Practice Questions (100 Questions)

Practice questions for the AWS DOP-C02 (DevOps Engineer Professional) exam, Chapter 1.

Q1. A company's DevOps engineer manages an organization in AWS Organizations, which includes many accounts. The company needs to enable termination protection for all AWS CloudFormation stacks in production accounts. Non-production accounts do not require termination protection. The company has designated a central account for AWS Config aggregation and configured production accounts to support CloudFormation and AWS Config. The company has grouped production accounts into an organizational unit (OU). Which solution meets these requirements?
- A. Create an AWS Config rule to detect stacks without termination protection enabled. Add a remediation action to enable termination protection. Deploy the rule across the organization using the PutOrganizationConfigRule API operation.
- B. Create a CloudFormation template that deploys an AWS Config rule to detect stacks without termination protection enabled. Add a remediation action to enable termination protection. Use CloudFormation StackSets to deploy the template to the OU containing production accounts.
- C. Create a service control policy (SCP) that denies the cloudformation:DeleteStack action. Use CloudFormation StackSets to apply the SCP to the OU containing production accounts.
- D. Create a CloudFormation stack policy that denies Update:Delete actions. Use CloudFormation StackSets to apply the policy to the OU containing production accounts.
View question →
Q2. A DevOps engineer is using AWS CodeDeploy on a set of Amazon EC2 instances in an EC2 Auto Scaling group. The CodeDeploy deployment group associated with the EC2 Auto Scaling group is configured to use CodeDeployDefault.OneAtATime for in-place deployments. During an ongoing new deployment, the engineer observes that although the overall deployment succeeds, two-thirds of the instances deployed a previous application revision, while the remaining one-third have the latest application revision.
- A. The two affected instances were unable to retrieve the new deployment.
- B. A failed AfterInstall lifecycle event hook caused the CodeDeploy agent to roll back to the previous version on the affected instances.
- C. The CodeDeploy agent is not installed on the two affected instances.
- D. EC2 Auto Scaling launched two new instances during the new deployment before it completed, causing the previous application version to be deployed to the affected instances.
View question →
Q3. A company operates a file retrieval application that saves files to a database running on Amazon EC2 instances. Regulatory requirements mandate that the company delete files daily from specific EC2 instances. The company also retains database records for no more than 60 days. Database record deletion occurs after file deletion. The company has created a script to delete both files and database records. If the deletion script fails, the company must receive an email notification.
- A. Use AWS Systems Manager State Manager to automatically invoke a Systems Manager Automation document at a scheduled time each day. Configure the Automation document to run the deletion script sequentially using Run Command. Create an Amazon EventBridge rule to send failure notifications to the company via Amazon Simple Notification Service (Amazon SNS).
- B. Use AWS Systems Manager State Manager to automatically invoke a Systems Manager Automation document at a scheduled time each day. Configure the Automation document to run the deletion script sequentially using Run Command. Add a conditional statement in the Automation document as a final step to check for errors. Use Amazon Simple Email Service (Amazon SES) to send failure notifications as emails to the company.
- C. Create an Amazon EventBridge rule that invokes an AWS Lambda function at a scheduled time. Add required invocation permissions to the Lambda function’s resource-based policy. Configure the Lambda function to run the deletion script sequentially. Configure the Lambda function to send failure notifications to the company via Amazon Simple Notification Service (Amazon SNS).
- D. Create an Amazon EventBridge rule that invokes an AWS Lambda function at a scheduled time. Add required invocation permissions to the Lambda function’s resource-based policy. Configure the Lambda function to run the deletion script sequentially. Configure the Lambda function to use Amazon Simple Email Service (Amazon SES) to send failure notifications as emails to the company.
View question →
Q4. A development team is building a full-stack serverless web application consisting of a backend REST API and a frontend built using a single-page application (SPA) framework. The team wants to adopt a Git-based workflow for development and deployment. They created an AWS CodeCommit repository to store application code. They want to use multiple development branches to test new features and ensure that code changes on development branches are deployed to different development environments. Code changes to the main branch must be automatically promoted to production.
- A. Create an application in the AWS Amplify console and connect the CodeCommit repository. Create feature branch deployments for each environment. Connect the Route 53 domain to the application and enable automatic subdomain creation.
- B. Create an AWS CodePipeline pipeline using the CodeCommit repository as the source. Configure the pipeline to deploy to different environments based on the changed branch. Create an AWS Lambda function that creates a new subdomain based on the source branch name and invoke it in the deployment workflow.
- C. Create an application in AWS Elastic Beanstalk using the CodeCommit repository as the source. Configure Elastic Beanstalk to create new application environments based on the changed branch. Connect the Route 53 domain to the application and enable automatic subdomain creation.
- D. Create multiple AWS CodePipeline pipelines using the CodeCommit repository as the source. Configure each pipeline to deploy to a specific environment based on a configured branch. Configure AWS CodeDeploy steps in the pipelines to deploy application components and create Route 53 public hosted zones.
View question →
Q5. A global retail company headquartered in the United States plans to expand its business into Europe and Asia over the next six months. Its product catalog currently runs on Amazon EC2 instances behind an Application Load Balancer. These instances run in an Amazon EC2 Auto Scaling group spanning multiple Availability Zones. All data is stored in an Amazon Aurora database cluster.
- A. Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for customer information and purchases.
- B. Use Amazon DynamoDB global tables for the product catalog and regional DynamoDB tables for customer information and purchases.
- C. Use Aurora with read-only replicas for the product catalog and additional local Aurora instances in each region for customer information and purchases.
- D. Use Aurora for the product catalog and Amazon DynamoDB global tables for customer information and purchases.
View question →
Q6. A company wants to ensure their EC2 instances are secure. They want to be notified when new vulnerabilities are discovered on their instances and want to maintain audit trails of all login activity on the instances.
- A. Use AWS Systems Manager to detect vulnerabilities on EC2 instances. Install the Amazon Kinesis Agent to capture system logs and deliver them to Amazon S3.
- B. Use AWS Systems Manager to detect vulnerabilities on EC2 instances. Install the Systems Manager Agent to capture system logs and view login activity in the CloudTrail console.
- C. Configure Amazon CloudWatch to detect vulnerabilities on EC2 instances. Install the AWS Config agent to capture system logs and view them in the AWS Config console.
- D. Configure Amazon Inspector to detect vulnerabilities on EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and log them via Amazon CloudWatch Logs.
View question →
Q7. A developer team manages the infrastructure for an application that uses long-running processes to consume items from an Amazon Simple Queue Service (SQS) queue. The application is deployed to an Auto Scaling group. The application recently encountered an issue where item processing duration increased significantly. The queue grew beyond its expected size, disrupting business processes. Application logs are sent to a third-party tool. The team currently subscribes to an Amazon Simple Notification Service (Amazon SNS) topic for alerts. They need to be notified when the queue exceeds its expected size.
- A. Create a 1-hour period Amazon CloudWatch alarm that triggers when the average value exceeds the expected threshold. Configure the alarm to notify the SNS topic.
- B. Create a 1-hour period Amazon CloudWatch alarm that triggers when the sum of the metric value exceeds the expected threshold. Configure the alarm to notify the SNS topic.
- C. Create an AWS Lambda function that retrieves the ApproximateNumberOfMessagesVisible queue attribute and publishes it as a new CloudWatch custom metric. Create an Amazon EventBridge rule that runs the Lambda function every 5 minutes. Create a 1-hour CloudWatch metric alarm with a static threshold on the new custom metric’s sum.
- D. Create an AWS Lambda function that checks the ApproximateNumberOfMessagesVisible queue attribute and compares it against an expected size defined in the function. Create an Amazon EventBridge rule that runs the Lambda function every 5 minutes. Send a notification to the SNS topic when the queue attribute exceeds the expected size.
View question →
Q8. A company runs an application on an Amazon EC2 instance. Application metadata is stored in Amazon S3 and must be retrieved when the instance restarts or recovers automatically.
- A. Create an Amazon CloudWatch alarm for the StatusCheckFailed metric. Use recovery actions to stop and start the instance. When the instance is back online, use S3 event notifications to push metadata to the instance.
- B. Configure AWS OpsWorks with auto-healing enabled to stop and start the instance. Use OpsWorks lifecycle events to fetch metadata from Amazon S3 and update it on the instance.
- C. Use EC2 Auto Recovery to automatically stop and start the instance upon failure. When the instance is back online, use S3 event notifications to push metadata to the instance.
- D. Use AWS CloudFormation to create an EC2 instance with a UserData property. Include a command in UserData to retrieve application metadata from Amazon S3.
View question →
Q9. A company recently migrated its application to AWS. The application is hosted on Amazon EC2 instances behind an Application Load Balancer, which is placed behind Amazon API Gateway. The company wants to ensure minimal disruption to users when deploying new versions of the application. It also wants to ensure rapid rollback capability in case of issues.
- A. Introduce the change as a separate, parallel environment alongside the existing one. Configure Amazon API Gateway to use a canary release deployment to route a small percentage of user traffic to the new environment.
- B. Introduce the change as a separate, parallel environment alongside the existing one. Update the application's DNS alias record to point to the new environment.
- C. Introduce the change as a separate target group behind the existing Application Load Balancer. Configure Amazon API Gateway to gradually route user traffic to the new target group.
- D. Introduce the change as a separate target group behind the existing Application Load Balancer. Configure Amazon API Gateway to route all traffic to the Application Load Balancer, and then have the Application Load Balancer route traffic to the new target group.
View question →
Q10. A company is migrating its software development team from an on-premises data center to a hybrid environment. The new environment will span four AWS Regions, enabling developers to use the geographically closest Region. All development teams use a shared set of Linux applications. On-premises data centers store these applications on a network-attached storage (NAS) device. Developers run VMs locally, and the shared volume is updated weekly.
- A. Create an Amazon S3 File Gateway in the on-premises data center. Create S3 buckets in each Region. Set up a cron job to copy data from the on-premises storage device to the S3 File Gateway. Enable S3 Cross-Region Replication (CRR) from the gateway bucket to buckets in each Region.
- B. Create an Amazon FSx File Gateway in one Region. Create file servers in Amazon FSx for Windows File Server for each Region. Set up a cron job to copy data from the on-premises storage device to the FSx File Gateway.
- C. Create multi-AZ Amazon FSx for NetApp ONTAP with volumes and instances for each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and FSx, consumable by on-demand instances.
- D. Create an Amazon Elastic File System (Amazon EFS) file system in each Region. Deploy an AWS DataSync agent in the on-premises data center. Schedule daily DataSync tasks to replicate data to Amazon EFS.
View question →
Q11. A company operates hundreds of Amazon EC2 instances in a single AWS account and Region. The company frequently launches and terminates new EC2 instances. The account includes long-running EC2 instances that operate for more than one week.
- A. Configure an Amazon EventBridge rule matching the Amazon EC2 RunInstances API call. Configure the rule to invoke an AWS Lambda function that attaches the default instance profile to the EC2 instance.
- B. Configure AWS Config. Deploy the managed rule 'ec2-instance-profile-attached'. Configure an automatic remediation action invoking an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instance.
- C. Configure an Amazon EventBridge rule matching the Amazon EC2 Launch API call. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instance.
- D. Configure AWS Config. Deploy the managed rule 'iam-role-managed-policy-check'. Configure an automatic remediation action invoking an AWS Lambda function to attach the default instance profile to the EC2 instance.
View question →
Q12. A company’s application development team uses Linux-based Amazon EC2 instances as bastion hosts. SSH access to bastion hosts is restricted to specific IP addresses defined in associated security groups. The security team wants to be notified if security group rules are modified to allow SSH access from any IP address.
- A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule using the aws.cloudtrail source and event name AuthorizeSecurityGroupIngress. Define an Amazon Simple Notification Service (Amazon SNS) topic as the target.
- B. Enable Amazon GuardDuty and review security group findings in AWS Security Hub. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule with a custom pattern matching GuardDuty events with findingType NON_COMPLIANT. Define an Amazon SNS topic as the target.
- C. Create an AWS Config rule using the 'restricted-ssh' managed rule to check whether security groups permit unrestricted inbound SSH traffic. Configure automatic remediation to publish a message to an Amazon SNS topic.
- D. Enable Amazon Inspector. Include the Common Vulnerabilities and Exposures (CVE)-1.1 rule package to assess security groups associated with bastion hosts. Configure Amazon Inspector to publish messages to an Amazon SNS topic.
View question →
Q13. A DevOps engineer is building a CI/CD pipeline for a serverless application using AWS Lambda functions. The company wants to minimize customer impact from failed deployments and also monitor for issues.
- A. Define the serverless application using an AWS Serverless Application Model (AWS SAM) template. Deploy the Lambda function using AWS CodeDeploy with the Canary10Percent15Minutes deployment preference type. Use Amazon CloudWatch alarms to monitor function health.
- B. Use AWS CloudFormation to deploy stack updates and include Amazon CloudWatch alarms on all resources. Set up an AWS CodePipeline approval action for developers to validate and approve AWS CloudFormation change sets.
- C. Use AWS CloudFormation to publish new versions on every stack update and include Amazon CloudWatch alarms on all resources. Use the RoutingConfig property of the AWS::Lambda::Alias resource to update traffic routing during stack updates.
- D. Use AWS CodeBuild to add test event payloads for the Lambda function. Publish a new version of the function and include Amazon CloudWatch alarms. Update the production alias to point to the new version. Configure rollback to occur when alarms enter the ALARM state.
View question →
Q14. A company uses AWS Organizations to manage its AWS accounts. It has enabled AWS Config across all member accounts using AWS CloudFormation StackSets. The company has enabled trusted access for AWS Config in Organizations and designated a member account as the delegated administrator for AWS Config.
- A. Create a CloudFormation template containing AWS Config rules and remediation actions. Deploy the template using CloudFormation StackSets from the Organizations management account.
- B. Create an AWS Config conformance pack containing AWS Config rules and remediation actions. Deploy the conformance pack using CloudFormation StackSets from the Organizations management account.
- C. Create a CloudFormation template containing AWS Config rules and remediation actions. Deploy the template using AWS Config from the delegated administrator account.
- D. Create an AWS Config conformance pack containing AWS Config rules and remediation actions. Deploy the conformance pack using AWS Config from the delegated administrator account.
View question →
Q15. A company uses AWS CodeDeploy for application deployments. Its deployment group uses a tag group filter to identify EC2 instances for deployment. The current single tag group specifies instances with tags Environment=Production and Name=Application.
- A. Modify the current single tag group to include only the Environment=Production tag. Add another single tag group containing only the Name=Application tag.
- B. Modify the current single tag group to include Department=Marketing, Environment=Production, and Name=Application tags.
- C. Add another single tag group containing only the Department=Marketing tag. Retain Environment=Production and Name=Application tags in the current single tag group.
- D. Modify the current single tag group to include only the Environment=Production tag. Add another single tag group containing only the Department=Marketing tag.
View question →
Q16. A company developed an AWS Lambda function to process orders received via an HTTP API. It uses AWS CodeDeploy to deploy the Lambda function as the final stage of its CI/CD pipeline. A DevOps engineer observed intermittent failures in the order API during the first few seconds after deployment. Investigation revealed failures occurred because database schema migrations had not yet fully propagated before Lambda invocations began.
- A. Add a BeforeAllowTraffic hook to the AppSpec file to test for and wait until necessary database changes are complete before routing traffic to the new Lambda function version.
- B. Add an AfterAllowTraffic hook to the AppSpec file to force traffic to wait for pending database changes before allowing the new Lambda function version to respond.
- C. Add a BeforeInstall hook to the AppSpec file to test for and wait until necessary database changes are complete before deploying the new Lambda function version.
- D. Add a ValidateService hook to the AppSpec file to inspect incoming traffic and reject payloads if dependent services (e.g., database) are not ready.
View question →
Q17. A company uses AWS Organizations to centrally manage AWS accounts. The organization root has one child organizational unit (OU) named "Production." The "Production" OU has one child OU named "Engineering." Default service control policies (SCPs) are attached to the root, "Production," and "Engineering" OUs. The company has many AWS accounts in the "Engineering" OU. Each account has a management information system (MIS) and an IAM role with a policy granting permissions to access the MIS. Each account also has the default SCP attached. An engineer at Acme plans to replace the default SCP in the "Production" OU with a new SCP that contains only an Allow statement for Amazon EC2 API operations. After this change, what will happen to the permissions of the MIS IAM role in the Engineering accounts?
- A. All API operations on all resources are allowed.
- B. All API operations on EC2 resources are allowed. All other API operations are denied.
- C. All API operations on all resources are denied.
- D. All API operations on EC2 resources are denied. All other API operations are allowed.
View question →
Q18. A company runs an application on Amazon EC2 instances. A DevOps engineer needs to aggregate application logs into a centralized system for the application support team to search. Severe error messages appear periodically in the log files. When these errors occur, the DevOps engineer must notify the application support team via email.
- A. Configure the unified Amazon CloudWatch agent on the EC2 instances to publish application log files to a CloudWatch Logs log group. Configure metric filters on the CloudWatch Logs log group to detect severe errors and create custom metrics. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure a CloudWatch alarm to notify the SNS topic using the custom metric. Subscribe the application team's email address to the SNS topic.
- B. Install the Amazon Kinesis Agent on the EC2 instances. Configure the Kinesis Agent with the location of the log files. Stream logs to a Kinesis Data Firehose delivery stream targeting CloudWatch Metrics. Configure an AWS Lambda function to detect error messages and create custom metrics. Associate the Lambda function with the stream. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure a CloudWatch alarm to notify the SNS topic using the custom metric. Subscribe the application team's email address to the SNS topic.
- C. Install the AWS X-Ray daemon on the EC2 instances. Instrument the application using AWS Distro for OpenTelemetry (ADOT). Configure the ADOT collector with the custom log file location and the CloudWatch Logs log group name. Generate custom metrics based on error messages using CloudWatch Embedded Metric Format. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure a CloudWatch alarm to notify the SNS topic using the custom metric. Subscribe the application team's email address to the SNS topic.
- D. Configure the unified Amazon CloudWatch agent on the EC2 instances to publish application log files to a CloudWatch Logs log group. Create an Amazon OpenSearch Service domain. Subscribe the CloudWatch Logs log group to the OpenSearch Service domain. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure an OpenSearch Service alert monitor to notify the SNS topic. Subscribe the application team's email address to the SNS topic.
View question →
Q19. A company recently acquired another company. The acquiring company invited the acquired company to join its existing AWS Organization as a new organizational unit (OU). A DevOps engineer determined that the acquired company needs to launch only t3 instance types for its application workloads. The acquired company requires launching these instances only in the US West (Oregon) Region.
- A. Configure a statement to deny ec2:RunInstances on all EC2 instance resources when the ec2:InstanceType condition key does not equal t3*. Configure another statement to deny ec2:RunInstances on all EC2 instance resources when the aws:RequestedRegion condition key does not equal us-west-2.
- B. Configure a statement to allow ec2:RunInstances on all EC2 instance resources when the ec2:InstanceType condition key does not equal t3*. Configure another statement to allow ec2:RunInstances on all EC2 instance resources when the aws:RequestedRegion condition key does not equal us-west-2.
- C. Configure a statement to deny ec2:RunInstances on all EC2 instance resources when the ec2:InstanceType condition key equals t3*. Configure another statement to deny ec2:RunInstances on all EC2 instance resources when the aws:RequestedRegion condition key equals us-west-2.
- D. Configure a statement to allow ec2:RunInstances on all EC2 instance resources when the ec2:InstanceType condition key equals t3*. Configure another statement to allow ec2:RunInstances on all EC2 instance resources when the aws:RequestedRegion condition key equals us-west-2.
View question →
Q20. A company uses AWS Organizations to centrally manage AWS accounts. Its automation account hosts a CI/CD pipeline used to create and configure new AWS accounts. The company has an internal service team that provides services across accounts in the organization. The service team operates using a set of service accounts. When the CreateAccount API is called to create a new account, the service team wants to receive an AWS CloudTrail event in one of its service accounts.
- A. Create an Amazon EventBridge rule in the automation account that sends the account creation event to the default event bus in the service account. Update the default event bus in the service account to allow events from the automation account.
- B. Create a custom Amazon EventBridge event bus in the service account. Update the custom event bus to allow events from the automation account. Create an EventBridge rule in the service account that listens directly to CloudTrail events from the automation account.
- C. Create custom Amazon EventBridge event buses in both the automation account and the service account. Create EventBridge rules and resource policies connecting the custom event buses across accounts.
- D. Create a custom Amazon EventBridge event bus in the automation account. Create an EventBridge rule and resource policy that connects the custom event bus to the default event bus in the service account.
View question →
Q21. A company has an organization in AWS Organizations. A developer engineer maintains multiple AWS accounts belonging to different OUs within the organization. Resources—including IAM policies and Amazon S3 bucket policies—are deployed via AWS CloudFormation. All templates and code are stored in an AWS CodeCommit repository. Recently, some developers were unable to access S3 buckets in certain accounts in the organization. The following policy is attached to the S3 bucket: What should the developer engineer do to resolve this access issue?
- A. Modify the S3 bucket policy. Disable S3 Block Public Access settings on the bucket. In the S3 bucket policy, add the aws:SourceAccount condition key and include the AWS account IDs of all affected developers.
- B. Verify that no IAM permissions boundary denies developer access to the S3 bucket. Make necessary changes to IAM permissions boundaries. Use AWS Config Recorder in the affected individual developer accounts to restore any changes blocking access. Commit the fix to the CodeCommit repository and deploy via CloudFormation.
- C. Configure an SCP to prevent anyone from modifying IAM resources in developer OUs. In the S3 bucket policy, add the aws:SourceAccount condition key and include the AWS account IDs of all affected developers. Commit the fix to the CodeCommit repository and deploy via CloudFormation.
- D. Ensure SCPs do not block developer access to the S3 bucket. Ensure no IAM policy or permissions boundary denies developer access to IAM users or roles. Make necessary changes to SCPs and IAM permissions boundaries in the CodeCommit repository. Deploy the changes via CloudFormation.
View question →
Q22. A DevOps engineer is researching the most cost-effective way to implement an image processing cluster on AWS. The application cannot run in Docker containers and must run on Amazon EC2. The image processing workload checkpoints data to NFS and can tolerate interruptions. Configuring the cluster software on an EC2 Linux AMI takes 30 minutes.
- A. Use Amazon EFS for checkpoint data. Provision EC2 instances temporarily using an EC2 Auto Scaling group and the On-Demand pricing model.
- B. Use GlusterFS on EC2 instances for checkpoint data. Manually provision EC2 instances to run batch jobs and manually terminate them after job completion.
- C. Use Amazon EFS for checkpoint data. Launch EC2 Spot Instances using EC2 Fleet and use user data to configure the EC2 Linux instances at launch.
- D. Use Amazon EFS for checkpoint data. Launch EC2 Spot Instances using EC2 Fleet. Create a custom AMI with pre-installed cluster software and use the latest AMI when launching instances.
View question →
Q23. A company runs a web application across multiple Availability Zones. It uses an Application Load Balancer (ALB) for routing, Amazon Aurora for application data, and stores container images in Amazon Elastic Container Registry (Amazon ECR) in the same AWS account and Region. A developer engineer needs to establish a disaster recovery (DR) environment in another Region. The solution must meet an RTO of 8 hours and an RPO of 2 hours. The company requires more than 2 hours to build container images from source in the Dockerfiles.
- A. Copy the CloudFormation template and Dockerfiles to an Amazon S3 bucket in the DR Region. Use AWS Backup to configure automated Aurora cross-Region hourly snapshots. If a disaster occurs, build the latest container image and upload it to the ECR repository in the DR Region. Launch a new CloudFormation stack using the latest Aurora snapshot and the ECR image, then update the application DNS record to point to the new ALB.
- B. Copy the CloudFormation template to an Amazon S3 bucket in the DR Region. Configure Aurora automated backups with cross-Region replication. Configure ECR cross-Region replication. If a disaster occurs, launch a new CloudFormation stack in the DR Region using the latest Aurora snapshot and the locally replicated ECR image, then update the application DNS record to point to the new ALB.
- C. Copy the CloudFormation template to an Amazon S3 bucket in the DR Region. Use Amazon EventBridge Scheduler to invoke an AWS Lambda function hourly to take snapshots of the Aurora database and fetch the latest container image from the ECR repository. Copy the snapshots and image to the DR Region. If a disaster occurs, launch a new CloudFormation stack in the DR Region using the latest Aurora snapshot and the locally available ECR image.
- D. Copy the CloudFormation template to an Amazon S3 bucket in the DR Region. Deploy a second application CloudFormation stack in the DR Region. Reconfigure Aurora as a global database. When deploying new application versions, update both CloudFormation stacks. If a disaster occurs, update the application DNS record to point to the new ALB.
View question →
Q24. A DevOps team manages the company’s AWS accounts. The company wants to ensure automatic restoration of specific AWS resource configurations when changes occur.
- A. Use AWS Config rules to detect configuration changes. Configure a remediation action using an AWS Systems Manager Automation document to restore the configuration change.
- B. Use Amazon CloudWatch alarms to monitor resource metrics. When an alarm activates, use an Amazon Simple Notification Service (Amazon SNS) topic to notify administrators to manually restore the configuration change.
- C. Use AWS CloudFormation to create a stack that deploys the required configuration. Update the stack when configuration changes need to be restored.
- D. Use AWS Trusted Advisor to check for noncompliant configurations. Manually apply necessary changes based on Trusted Advisor recommendations.
View question →
Q25. A DevOps engineer wants to implement an automated response when AWS Trusted Advisor detects IAM access keys in public source code repositories. The automated response should delete exposed access keys and notify the security team.
- A. Create an AWS Lambda function to delete IAM access keys. Configure AWS CloudTrail logs to stream to Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter for the AWS_RISK_CREDENTIALS_EXPOSED event with two actions: first, invoke the Lambda function; second, send a notification to the security team using Amazon Simple Notification Service (Amazon SNS).
- B. Create an AWS Lambda function to delete IAM access keys. Create an AWS Config rule with two actions for status changes of 'aws.trustedadvisor' and 'Exposed Access Keys'. First, run the Lambda function; second, send a notification to the security team using Amazon Simple Notification Service (Amazon SNS).
- C. Create an AWS Lambda function to delete IAM access keys and use Amazon Simple Notification Service (Amazon SNS) to notify the security team. Create an AWS Personal Health Dashboard rule for the AWS_RISK_CREDENTIALS_EXPOSED event and configure the Personal Health Dashboard rule target as the Lambda function's ARN.
- D. Create an AWS Lambda function to delete IAM access keys. Create an Amazon EventBridge (Amazon CloudWatch Events) rule using the 'aws.trustedadvisor' event source and the 'Exposed Access Keys' status. Configure the EventBridge (CloudWatch Events) rule to invoke the Lambda function and publish to an Amazon SNS topic for notifying the security team.
View question →
Q26. A company publishes application logs to an Amazon CloudWatch Logs log group in the us-east-1 Region. The company needs to export these logs weekly from us-east-1 to the us-west-2 Region. Logs must be encrypted in both Regions.
- A. Create an Amazon S3 bucket in us-west-2. Configure server-side encryption using Amazon S3-managed keys (SSE-S3) for the S3 bucket. Create and schedule an AWS Lambda function to run weekly and export last week’s CloudWatch Logs to the us-west-2 S3 bucket.
- B. Create an Amazon S3 bucket in us-west-2. Configure server-side encryption using AWS KMS keys (SSE-KMS) for the S3 bucket. Create and schedule an AWS Lambda function to run weekly and export last week’s CloudWatch Logs to the us-west-2 S3 bucket.
- C. Create an Amazon S3 bucket in us-east-1 and another in us-west-2. Configure server-side encryption using Amazon S3-managed keys (SSE-S3) and enable versioning on both S3 buckets. Create and schedule an AWS Lambda function to run weekly and export last week’s CloudWatch Logs to the us-east-1 S3 bucket. Configure replication rules on the us-east-1 S3 bucket to replicate logs to the us-west-2 S3 bucket.
- D. Create an Amazon S3 bucket in us-east-1 and another in us-west-2. Configure server-side encryption using AWS KMS keys (SSE-KMS) and enable versioning on both S3 buckets. Create and schedule an AWS Lambda function to run weekly and export last week’s CloudWatch Logs to the us-east-1 S3 bucket. Configure replication rules on the us-east-1 S3 bucket to replicate logs to the us-west-2 S3 bucket.
View question →
Q27. A company has a VPC consisting of one public subnet and one private subnet. An application runs on Amazon EC2 instances in the private subnet. An application load balancer resides in the public subnet and distributes traffic to the EC2 instances. The company has enabled Amazon GuardDuty for the account. The DevOps team maintains a daily-updated external IP range list stored in an Amazon S3 bucket. The DevOps engineer needs to configure GuardDuty to generate findings when application traffic originates from IP ranges in that external list.
- A. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to retrieve the latest external IP range list from the S3 bucket. For each IP range in the list, configure the Lambda function to create a GuardDuty finding filter on the publicIp filter attribute.
- B. Configure a threat list in GuardDuty with the source set to the external IP range list in the S3 bucket. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to refresh the GuardDuty threat list to match the external IP range list in the S3 bucket.
- C. Configure a trusted IP list in GuardDuty with the source set to the external IP range list in the S3 bucket. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to refresh the GuardDuty trusted IP list to match the external IP range list in the S3 bucket.
- D. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to retrieve the latest external IP range list from the S3 bucket. For each IP range in the list, configure the Lambda function to create a GuardDuty finding filter on the localIp filter attribute.
View question →
Q28. A company operating electronic medical records runs a fleet of Amazon EC2 instances using Amazon Linux operating systems. Due to patient privacy requirements, the company must ensure ongoing compliance for OS and application patching on the EC2 instances.
- A. Use AWS Systems Manager to create a new patch baseline that includes a custom repository. Use Run Command to execute the AWS-RunPatchBaseline document to validate and install patches.
- B. Use AWS Direct Connect to integrate the company’s repository and deploy patches using Amazon CloudWatch scheduled events, then create reports using CloudWatch dashboards.
- C. Use yum-config-manager to add a custom repository under /etc/yum.repos.d and run yum-config-manager --enable to activate the repository.
- D. Use AWS Systems Manager to create a new patch baseline that includes the company’s repository. Use Run Command to execute the AWS-AmazonLinuxDefaultPatchBaseline document to validate and install patches.
View question →
Q29. A company discovers its production and disaster recovery environments are deployed in the same AWS Region. All production applications run on Amazon EC2 instances managed by AWS CloudFormation. These applications use Amazon FSx for NetApp ONTAP file storage. EC2 instances host no application data locally. The DevOps team must migrate the non-production systems to a new Region. The DevOps team has updated CloudFormation templates to accept a Region parameter. Storage replication must meet a 10-minute Recovery Point Objective (RPO).
- A. Create an Amazon S3 bucket in each Region. Configure S3 Cross-Region Replication (CRR). Create a scheduled AWS Lambda function to copy new content from FSx to the production Region’s S3 bucket.
- B. Use AWS Backup to create a backup vault and a custom backup plan with 10-minute frequency. Specify the DR Region as the destination. Assign the production Region’s EC2 instances to the backup plan.
- C. Create an AWS Lambda function to create snapshots of instance store volumes attached to EC2 instances. Configure the Lambda function to copy snapshots to the DR Region and delete prior copies. Create an Amazon EventBridge scheduled rule to invoke the Lambda function every 10 minutes.
- D. Create an Amazon FSx for NetApp ONTAP file system and configure a 5-minute SnapMirror schedule to replicate data from the production Region to the DR Region.
View question →
Q30. A developer is building a blue/green deployment application on Amazon Elastic Container Service (Amazon ECS) using AWS CodeDeploy and AWS CloudFormation. During the deployment window, the application must remain highly available, and AWS CodeDeploy must shift 10% of traffic per minute to the new application version until all traffic is redirected.
- A. Add an AppSpec file with CodeDeploy default deployment settings.
- B. Add AWS::CodeDeploy::BlueGreenDeployment and ::CodeDeploy::LifecycleHook parameters with CodeDeploy defaults.
- C. Add an AppSpec file with a 5-minute deployment configuration and 10% traffic shift.
- D. Add AWS::CodeDeploy::BlueGreenDeployment and AWS::CodeDeploy::LifecycleHook parameters with a 10% per-minute traffic shift deployment configuration.
View question →
Q31. A company grants limited AWS permissions to employees. DevOps engineers assume administrator roles. For auditing purposes, the security team wants near real-time notifications when an administrator role is assumed.
- A. Configure AWS Config to deliver logs to an Amazon S3 bucket. Use Amazon Athena to query logs and send notifications to the security team when an administrator role is assumed.
- B. Configure Amazon GuardDuty to monitor when an administrator role is assumed and send notifications to the security team.
- C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule using an AWS Management Console sign-in event pattern that publishes to an Amazon SNS topic when an administrator role is assumed.
- D. Create an Amazon EventBridge (Amazon CloudWatch Events) rule triggered by AWS CloudTrail event patterns via an AWS API call, invoking an AWS Lambda function that publishes to an Amazon SNS topic when an administrator role is assumed.
View question →
Q32. A company runs applications in AWS accounts within an AWS Organizations organization. These applications use Amazon EC2 instances and Amazon S3. The company wants to detect potentially compromised EC2 instances, suspicious network activity, and anomalous API activity across all AWS accounts—including newly created ones—and send notifications to an Amazon SNS topic for investigation and remediation.
- A. In the organization’s management account, configure one AWS account as the Amazon GuardDuty administrator account. In the GuardDuty administrator account, add existing company AWS accounts as members. In the GuardDuty administrator account, create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern matching GuardDuty findings and forwarding matched events to the SNS topic.
- B. In the organization’s management account, configure Amazon GuardDuty to invite newly created AWS accounts and send invitations to existing AWS accounts. Create an AWS CloudFormation StackSet that accepts GuardDuty invitations and deploys an Amazon EventBridge (Amazon CloudWatch Events) rule. Configure the rule with an event pattern matching GuardDuty findings and forwarding matched events to the SNS topic. Deploy the StackSet to all AWS accounts in the organization.
- C. In the organization’s management account, create an AWS CloudTrail organization trail. Enable the organization trail in all AWS accounts. Create a Service Control Policy (SCP) enabling VPC Flow Logs in each account. Configure AWS Security Hub for the organization. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern matching Security Hub findings and forwarding matched events to the SNS topic.
- D. In the organization’s management account, configure an AWS account as the AWS CloudTrail administrator account. In the CloudTrail administrator account, create a CloudTrail organization trail and add existing AWS accounts to it. Create an SCP enabling VPC Flow Logs in each account. Configure AWS Security Hub for the organization. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern matching Security Hub findings and forwarding matched events to the SNS topic.
View question →
Q33. A company operates hundreds of Amazon EC2 instances in a single AWS Region within one AWS account. Each day, new EC2 instances are launched and terminated in the account. The account also includes existing EC2 instances that have been running for over a week. The company's security policy requires that all running EC2 instances use an EC2 instance profile. If an EC2 instance launches without an attached instance profile, it defaults to using an unassigned IAM role with no permissions. A DevOps engineer inspects the account and discovers EC2 instances running without an attached instance profile. During the review period, the DevOps engineer observes new EC2 instances launching without an instance profile. Which solution ensures that an instance profile is attached to all existing and future EC2 instances in the Region?
- A. Configure an Amazon EventBridge rule that responds to EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function to attach the default instance profile to the EC2 instance.
- B. Configure the ec2-instance-profile-attached AWS Config managed rule with a configuration change trigger type. Configure the automatic remediation action to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instance.
- C. Configure an Amazon EventBridge rule that responds to EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instance.
- D. Configure the iam-role-managed-policy-check AWS Config managed rule with a configuration change trigger type. Configure the automatic remediation action to invoke an AWS Lambda function to attach the default instance profile to the EC2 instance.
View question →
Q34. A company is divided into multiple teams. Each team has its own AWS account, and all accounts reside within a single organization in AWS Organizations. Each team must retain full administrative IAM permissions for its own AWS account. Each team must be allowed to access only approved AWS services. Access to AWS services must be granted through a formal request and approval process.
- A. Use AWS CloudFormation StackSets to deploy IAM policies in each account that deny access to restricted AWS services. In each account, configure AWS Config rules to ensure those policies are attached to IAM principals.
- B. Use AWS Control Tower to configure accounts into organizational units (OUs) within the organization. Configure AWS Control Tower to enable AWS IAM Identity Center (AWS SSO). Configure IAM Identity Center to provide administrative access, including deny policies for restricted AWS services on user roles.
- C. Place all accounts under a new top-level OU within the organization. Create a Service Control Policy (SCP) that denies access to restricted AWS services and attach it to the OU.
- D. Create an SCP that allows access only to approved AWS services. Attach the SCP to the organization’s root OU. Remove the FullAWSAccess SCP from the organization’s root OU.
View question →
Q35. A company has begun using AWS across multiple teams. Each team operates multiple accounts with unique security configurations. The company manages an organizational account aligned with industry security compliance frameworks. Each account maintains its own configuration and security controls. The development team wants to leverage preventive and detective controls to govern their accounts. As the company creates new accounts in the organization, the security team needs to ensure ongoing security for both current and future accounts.
- A. Use Organizations to create appropriate OUs and attach appropriate SCPs for each team. Place team accounts in appropriate OUs for security control. Create any new team accounts in the appropriate OUs.
- B. Create an AWS Control Tower landing zone. Configure OUs and appropriate controls in AWS Control Tower for existing teams. Configure trusted access for AWS Control Tower. Register existing accounts into appropriate OUs matching each team’s security policies. Use AWS Control Tower to provision any new accounts.
- C. Create AWS CloudFormation StackSets in the organization’s management account. Configure the StackSet to deploy AWS Config rules and remediation actions to every account in the organization. Update the StackSet upon new account creation to deploy to the new account.
- D. Deploy AWS Config to manage AWS Config rules across all AWS accounts in the organization. Deploy conformance packs that deliver AWS Config rules and remediation actions across the entire organization.
View question →
Q36. A company uses Amazon S3 buckets to store critical documents. The company discovers that some S3 buckets are unencrypted. Currently, IAM users in the company can create new S3 buckets without encryption. The company is implementing a new requirement mandating that all S3 buckets must be encrypted.
- A. Create an AWS Lambda function invoked periodically by an Amazon EventBridge scheduled rule. Program the Lambda function to scan all current S3 buckets for encryption status and set AES-256 as the default encryption for any bucket lacking encryption configuration.
- B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule. Configure the rule to use the AWS-enable-s3-bucket-encryption AWS Systems Manager Automation runbook as the remediation action. Manually run the re-evaluation process to ensure existing S3 buckets comply.
- C. Create an AWS Lambda function invoked by an Amazon EventBridge event rule. Define the rule with an event pattern matching new S3 bucket creation events. Write the Lambda function to parse the EventBridge event, inspect the S3 bucket configuration, and set AES-256 as the default encryption.
- D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key value is not AES-256. Create an IAM group for all company IAM users and attach the IAM policy to the group.
View question →
Q37. A company stores application source code based on a tiered architecture in AWS CodeCommit. The company deploys applications using AWS CodePipeline. The CodeCommit repository and CodePipeline are deployed in the same AWS account. The company’s security team requires scanning all code for vulnerabilities before deployment to production. If any vulnerabilities are found, deployment must halt.
- A. Create a new CodeBuild project. Configure the project to run a security scan using Amazon CodeGuru Security. Configure the CodeBuild project to fail if CodeGuru Security detects vulnerabilities. Create a new IAM role with sufficient permissions to run CodeGuru Security scans and assign it to the CodeBuild project. In the pipeline, add a new stage before the deploy stage. Select AWS CodeBuild as the action provider for the new stage. Use source artifacts from the CodeCommit repository and configure the action to use the CodeBuild project.
- B. Create a new CodeBuild project. Configure the project to use Amazon Inspector for security scanning. Configure the CodeBuild project to fail if Amazon Inspector detects vulnerabilities. Create a new IAM role with sufficient permissions to run Amazon Inspector scans and assign it to the CodeBuild project. In the pipeline, add a new stage before the deploy stage. Select AWS CodeBuild as the action provider for the new stage. Use source artifacts from the CodeCommit repository and configure the action to use the CodeBuild project.
- C. Update the IAM role attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the pipeline, add a new stage before the deploy stage. Select Amazon DevOps Guru as the action provider for the new stage. Use source artifacts from the CodeCommit repository.
- D. Update the IAM role attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the pipeline, add a new stage before the deploy stage. Select Amazon CodeGuru Security as the action provider for the new stage. Use source artifacts from the CodeCommit repository.
View question →
Q38. A company hosts a web application on Amazon EC2 instances backed by Amazon EBS storage. The company wants to recover quickly with minimal data loss when network connectivity or power failures occur on the EC2 instances.
- A. Add the instance to an EC2 Auto Scaling group and set minimum, maximum, and desired capacity to 1.
- B. Add the instance to an EC2 Auto Scaling group using lifecycle hooks to detach the EBS volume when the EC2 instance shuts down or terminates.
- C. Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric and select the EC2 Recover instance action.
- D. Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric and select the EC2 Reboot instance action.
View question →
Q39. A company wants to use AWS CloudFormation for infrastructure deployments. The company has strict tagging and resource requirements and wants to restrict deployments to a single Region. Developers will need to deploy multiple versions of the same application. Which solution ensures resources are deployed according to company policy?
- A. Create an AWS Trusted Advisor check to identify and remediate unauthorized CloudFormation StackSets.
- B. Create a CloudFormation drift detection operation to identify and remediate unauthorized CloudFormation StackSets.
- C. Create CloudFormation StackSets using approved CloudFormation templates.
- D. Create AWS Service Catalog products using approved CloudFormation templates.
View question →
Q40. A company has configured an Amazon S3 event source for an AWS Lambda function. The company needs the Lambda function to run whenever a new object is created or an existing object is modified in a specific S3 bucket. The Lambda function will use the S3 bucket name and object key from the event to retrieve the new or modified S3 object content. The Lambda function will parse the content and save the parsed output to Amazon DynamoDB. The Lambda function’s execution role has permissions to retrieve objects from the S3 bucket and write to DynamoDB. During testing, a developer finds that the Lambda function does not execute when objects are added to or modified in the S3 bucket.
- A. Create an S3 bucket policy granting the S3 bucket permission to invoke the Lambda function.
- B. Create a resource-based policy granting Amazon S3 permission to invoke the Lambda function for the S3 bucket.
- C. Configure an Amazon Simple Queue Service (Amazon SQS) queue as the Lambda function’s dead-letter queue. Update the Lambda function to process messages from the SQS queue and S3 event notifications.
- D. Configure an Amazon Simple Queue Service (Amazon SQS) queue as the destination for S3 event notifications. Update the Lambda function’s execution role to grant permissions to read from the SQS queue. Update the Lambda function to process messages from the SQS queue.
View question →
Q41. A company needs to scan code changes for security issues before deployment and prevent deployment of noncompliant code. The company uses an AWS CodePipeline pipeline that triggers on code changes, which occur multiple times per day. The company's security team supports a third-party scanning application and provides command-line integration steps for the scan. The code scanning step requires credentials. Which solution meets these requirements in the most secure manner?
- A. Create a new AWS CodeBuild project. Configure the username and password in environment variables. Run the command-line integration steps using the username and password. Update the CodePipeline pipeline to include a new scan stage. In the new scan stage, include a test action that uses the newly created CodeBuild project.
- B. Create a new AWS CodeBuild project. Store the username and password as secrets in AWS Secrets Manager. Read the secrets from Secrets Manager. Run the command-line integration steps using the username and password. Update the CodePipeline pipeline to include a new scan stage. In the new scan stage, include a test action that uses the newly created CodeBuild project.
- C. Create a new AWS CodeBuild project. Store the username and password as strings in AWS Systems Manager Parameter Store. Read the strings from Parameter Store. Run the command-line integration steps using the username and password. Update the CodePipeline pipeline to include a new scan stage. In the new scan stage, include a test action that uses the newly created CodeBuild project.
- D. Upload an encrypted JSON file containing the username and password to an Amazon S3 bucket with a specific policy that allows only administrators to read the file. Create a new AWS CodeBuild project. Use the username and password from the file in Amazon S3 to run the command-line integration steps. Update the CodePipeline pipeline to include a new scan stage. In the new scan stage, include a test action that uses the newly created CodeBuild project.
View question →
Q42. A company runs an application on Amazon EC2 instances within an Auto Scaling group. When the application starts, it must process data from an Amazon S3 bucket before it can begin handling requests. The volume of data stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before it can serve requests. The company wants to reduce the time required for new EC2 instances to be ready to serve requests.
- A. Configure a warm pool for the Auto Scaling group, where warm EC2 instances are in the stopped state. Configure an Auto Scaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when it is ready to serve requests.
- B. Increase the maximum number of instances in the Auto Scaling group. Configure an Auto Scaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when it is ready to serve requests.
- C. Configure a warm pool for the Auto Scaling group, where warm EC2 instances are in the running state. Configure an Auto Scaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when it is ready to serve requests.
- D. Increase the maximum number of instances in the Auto Scaling group. Configure an Auto Scaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook and place the new instance in standby state when the application is ready to serve requests.
View question →
Q43. A media company has multiple Amazon EC2 instances in its AWS account. The company uses Slack and a shared email inbox for team communication and critical updates. A DevOps engineer needs to send notifications about scheduled AWS EC2 maintenance events to a Slack channel and the shared email inbox. The solution must include the instance name and owner tags.
- A. Integrate AWS Trusted Advisor with AWS Config. Configure a custom AWS Config rule to invoke an AWS Lambda function that publishes notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the Slack channel endpoint and shared email inbox to the topic.
- B. Use Amazon EventBridge to monitor AWS Health events. Configure maintenance events to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe an AWS Lambda function to the SNS topic to send notifications to the Slack channel and shared email inbox.
- C. Create an AWS Lambda function to send EC2 maintenance notifications to the Slack channel and shared email inbox. Use Amazon CloudWatch metrics to monitor EC2 health events. Configure a CloudWatch alarm to invoke the Lambda function upon receiving a maintenance notification.
- D. Configure AWS Support integration with AWS CloudTrail. Create a CloudTrail lookup event to invoke an AWS Lambda function to deliver EC2 maintenance notifications to Amazon Simple Notification Service (Amazon SNS). Configure Amazon SNS to target the Slack channel and shared email inbox.
View question →
Q44. A company’s DevOps team uses Node Package Manager (NPM) open-source libraries to build applications. The DevOps team runs application builds in an AWS CodeBuild project. The company downloads NPM libraries from the public NPM registry. The company wants to host NPM libraries in a private NPM repository. The company also needs to validate new library versions before the DevOps team uses them.
- A. Create an AWS CodeArtifact repository with an upstream repository named npmjs.org. Configure the application build process to use the CodeArtifact repository as the default NPM source. Create an AWS CodePipeline pipeline to perform required checks on package versions in the CodeArtifact repository. If checks fail, set the package status to unlisted.
- B. Enable Amazon S3 caching in the CodeBuild project configuration. Add a step in the buildspec.yaml file to perform required checks on package versions in the cache.
- C. Create an AWS CodeCommit repository for each library. Clone the required NPM libraries into the appropriate CodeCommit repositories. Modify the CodeBuild appspec.yaml configuration file to use the private CodeCommit repositories. Add a step to perform required checks on package versions.
- D. Create an AWS CodeCommit repository for each library. Clone the required NPM libraries into the appropriate CodeCommit repositories. Modify the CodeBuild buildspec.yaml configuration file so that NPM uses the private CodeCommit repositories. Add an AWS CodePipeline pipeline to check each new package version committed to the repositories. Configure the pipeline to revert to the most recent commit if checks fail.
View question →
Q45. A company uses AWS Organizations to manage accounts across its business units. Its development team has built an AWS Lambda function that calls the Organizations API to create new AWS accounts. The Lambda function currently runs in the organization’s management account. The DevOps team needs to move the Lambda function from the management account to a dedicated member account. The DevOps team wants to ensure that the Lambda function can create new AWS accounts in the organization only after it is deployed to the new account.
- A. In the management account, create a new IAM role with permissions required to create new accounts in Organizations. Allow the Lambda execution role in the new AWS account to assume this role. Update the Lambda function code to assume the role when creating new AWS accounts. Update the Lambda execution role to ensure it has permissions to assume the new role.
- B. In the management account, configure delegated administration for Organizations. Create a new service control policy (SCP) granting the new AWS account permission to create new AWS accounts in Organizations. Ensure the Lambda execution role has organizations:CreateAccount permission.
- C. In the management account, create a new IAM role with permissions required to create new accounts in Organizations. Configure the trust policy to allow the Lambda service principal to assume the role. Update the Lambda function code to assume the role when creating new AWS accounts. Update the Lambda execution role to ensure it has permissions to assume the new role.
- D. In the management account, enable AWS Control Tower. Enable Control Tower’s delegated administration. Create a resource policy allowing the new AWS account to create new AWS accounts in Control Tower. Update the Lambda function code in the new AWS account to use the Control Tower API. Ensure the Lambda execution role has controltower:CreateAccount permission.
View question →
Q46. A company wants to use AWS CloudFormation for infrastructure deployments. The company has strict tagging and resource requirements and wants to restrict deployments to a single Region. Developers will need to deploy multiple versions of the same application.
- A. Create an AWS Trusted Advisor check to identify and remediate unauthorized CloudFormation stack sets.
- B. Create a CloudFormation drift detection operation to identify and remediate unauthorized CloudFormation stack sets.
- C. Use an approved CloudFormation template to create a CloudFormation stack set.
- D. Use an approved CloudFormation template to create an AWS Service Catalog product.
View question →
Q47. A company uses AWS Systems Manager to manage Amazon Linux EC2 instances with the SSM Agent installed. All EC2 instances are configured to use Instance Metadata Service Version 2 (IMDSv2) and run in the same AWS account and Region. The company’s policy requires developers to use only Amazon Linux. The company wants to ensure that new EC2 instances are automatically managed by Systems Manager immediately after creation.
- A. Create an IAM role with a trust policy allowing Systems Manager to assume the role. Attach the latest AmazonSSMManagedInstanceCore managed policy to the role. Configure the SSM service setting 'Default EC2 instance management role' to use this role.
- B. Ensure AWS Config is enabled. Create an AWS Config rule to verify whether the SSM Agent is installed on EC2 instances. Configure the rule to run on EC2 configuration changes. Configure automatic remediation to run the AWS-InstallSSMAgent document to install the SSM Agent.
- C. Configure Systems Manager Patch Manager. Create a patch baseline to automatically install the SSM Agent on all new EC2 instances. Create a patch group for all EC2 instances. Attach the patch baseline to the patch group. Create a maintenance window and maintenance window task to install the SSM Agent daily.
- D. Create an EC2 instance role with a trust policy allowing Amazon EC2 to assume the role. Attach the AmazonSSMManagedInstanceCore managed policy to the role. Ensure AWS Config is enabled. Use the managed AWS Config rule 'EC2InstanceManagedBySSM' to verify whether the role is attached to EC2 instances. Configure the rule to run on EC2 configuration changes. Configure automatic remediation to run the AWS-ConfigureAWSPackageManager SSM document to attach the role to EC2 instances.
View question →
Q48. A company has many applications. Different teams develop applications using various languages and frameworks. These applications run locally and on different servers, using different operating systems. Each team has its own release protocols and processes. The company wants to reduce the complexity of releasing and maintaining these applications. The company is migrating its technology stack—including these applications—to AWS. The company wants centralized source code control, consistent automated delivery pipelines, and minimal underlying infrastructure maintenance tasks.
- A. Create one AWS CodeCommit repository for all applications. Place each application’s code in separate branches. Merge branches and use AWS CodeBuild to build applications. Use AWS CodeDeploy to deploy applications to a centralized application server.
- B. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build one application at a time. Use AWS CodeDeploy to deploy applications to a centralized application server.
- C. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build one application at a time and create an AMI for each server. Use AWS CloudFormation StackSets with these AMIs to automatically provision and deprovision Amazon EC2 fleets.
- D. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build a Docker image for each application and push it to Amazon Elastic Container Registry (Amazon ECR). Use AWS CodeDeploy to deploy applications to Amazon Elastic Container Service (Amazon ECS) running on AWS Fargate–managed infrastructure.
View question →
Q49. A company hosts a multi-tenant application on Amazon EC2 instances behind an Application Load Balancer. These instances run Windows Server and are part of an Auto Scaling group. The application uses license files stored on the instances, which can be updated on the instances without disrupting customers. When a new customer purchases access to the application, the licensing team adds the new license key to a file in an Amazon S3 bucket. After updating the license file, the operations team manually updates the EC2 instances. A DevOps engineer needs to automate the EC2 instance file update process. The automation must minimize the time required for EC2 instances to obtain the updated license file and must notify the operations team of success or failure of the update process. The DevOps engineer creates a resource group in AWS Resource Groups. The resource group uses tags to automatically include the application’s EC2 instances. What should the DevOps engineer do next to meet these requirements in the most cost-effective and efficient way?
- A. Create an S3 event notification to invoke an AWS Lambda function when the license file is updated in the S3 bucket. Configure the Lambda function to invoke AWS Systems Manager Run Command to run the AWS-RunRemoteScript document to download the updated license file. Specify that the command runs on the application’s resource group with 50% concurrency. Configure Amazon Simple Email Service (Amazon SES) notifications for SUCCESS and FAILED events to email the operations team.
- B. Create an S3 event notification to invoke an AWS Lambda function when the license file is updated in the S3 bucket. Configure the Lambda function to invoke AWS Systems Manager Run Command to run the AWS-RunPowerShellScript document to download the updated license file. Specify that the command runs on the application’s resource group with 50% concurrency. Configure an Amazon Simple Notification Service (Amazon SNS) topic to send SUCCESS and FAILED event notifications. Subscribe the operations team members’ email addresses to the SNS topic.
- C. Create an Amazon EventBridge scheduled rule that runs hourly to invoke an AWS Lambda function. Configure the Lambda function to invoke AWS Systems Manager Run Command to run the AWS-RunPowerShellScript document to download the updated license file. Specify that the command runs on the application’s resource group with 50% concurrency. Configure an Amazon Simple Notification Service (Amazon SNS) topic to send SUCCESS and FAILED event notifications. Subscribe the operations team members’ email addresses to the SNS topic.
- D. Create an Amazon EventBridge scheduled rule that runs hourly to invoke an AWS Lambda function. Configure the Lambda function to invoke AWS Systems Manager Run Command to run the AWS-RunRemoteScript document to download the updated license file. Specify that the command runs on the application’s resource group with 50% concurrency. Configure Amazon Simple Email Service (Amazon SES) notifications for SUCCESS and FAILED events to email the operations team.
View question →
Q50. A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet compliance requirements. The security team wants to receive notifications when any key has not been rotated after 90 days.
- A. Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when a key exceeds 90 days.
- B. Configure an Amazon EventBridge event to invoke an AWS Lambda function that calls the AWS Trusted Advisor API and publishes to an Amazon Simple Notification Service (Amazon SNS) topic.
- C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when a key exceeds 90 days without rotation.
- D. Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when a key exceeds 90 days.
View question →
Q51. A company deploys an application in a production VPC within a single AWS account. The application is highly popular and experiences high usage. The security team wants to add additional security, such as AWS WAF, but the product manager is concerned about cost and does not want to approve additional spending unless the security team can demonstrate the necessity of extra protection. The security team notes that some application requests may originate from IP addresses on a deny list. The security team provides the DevOps engineer with this deny list. If any IP address from the deny list accesses the application, the security team wants near-real-time automated notifications so they can document that the application requires enhanced security. The DevOps engineer enables VPC Flow Logs for the production VPC.
- A. Create a log group in Amazon CloudWatch Logs. Configure VPC Flow Logs to capture accepted traffic and send data to the log group. Create Amazon CloudWatch metric filters for IP addresses in the deny list. Use the metric filters as input to create CloudWatch alarms. Set the period to 5 minutes and the number of data points to alarm to 1. Use an Amazon Simple Notification Service (Amazon SNS) topic to send alarm notifications to the security team.
- B. Create an Amazon S3 bucket for log files. Configure VPC Flow Logs to capture all traffic and send data to the S3 bucket. Configure Amazon Athena to query all log files in the S3 bucket for IP addresses in the deny list. Configure Amazon QuickSight to consume Athena results and publish a dashboard accessible to the security team. Create an alert threshold of 1 for successful access. Configure the alert to auto-notify the security team as frequently as possible upon threshold breach.
- C. Create an Amazon S3 bucket for log files. Configure VPC Flow Logs to capture accepted traffic and send data to the S3 bucket. Configure an Amazon OpenSearch Service cluster and domain for the log files. Create an AWS Lambda function to retrieve logs from the S3 bucket, format them, and load them into the OpenSearch cluster. Schedule the Lambda function to run every 5 minutes. Configure alerts and conditions in OpenSearch Service to send notifications to the security team via an Amazon Simple Notification Service (Amazon SNS) topic when access from a deny-listed IP is detected.
- D. Create a log group in Amazon CloudWatch Logs. Create an Amazon S3 bucket to store query results. Configure VPC Flow Logs to capture all traffic and send data to the log group. Deploy the Amazon Athena CloudWatch Logs connector in AWS Lambda. Connect the connector to the log group. Configure Athena to periodically query for all accepted traffic originating from deny-listed IP addresses and store results in the S3 bucket. Configure S3 event notifications to automatically notify the security team via an Amazon Simple Notification Service (Amazon SNS) topic when new objects are added to the S3 bucket.
View question →
Q52. A DevOps engineer manages a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). These instances run in an EC2 Auto Scaling group spanning multiple Availability Zones. The engineer needs to implement the following deployment strategy: 1. Launch a second fleet of instances with identical capacity to the original fleet. 2. Keep the original fleet running while deploying to the second fleet. 3. Shift traffic to the second fleet once it is fully deployed. 4. Automatically terminate the original fleet one hour after the traffic shift.
- A. Use an AWS CloudFormation template and set the ALB’s retention policy to one hour. Update the Amazon Route 53 record to reflect the new ALB.
- B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new environment. Create an application version lifecycle policy to terminate the original environment within one hour.
- C. Use AWS CodeDeploy with a deployment group configured for blue/green deployment. Select the option to terminate the original instances in the deployment group, with a wait time of one hour.
- D. Use AWS Elastic Beanstalk with immutable deployment enabled. Create an .ebextensions configuration file containing a Resources key that sets the ALB deletion policy to one hour, and deploy the application.
View question →
Q53. A company has enabled AWS Organizations for its organization and has 10 AWS accounts. The company has enabled AWS CloudTrail in the organization’s management account. The company expects the number of AWS accounts in the organization to grow to 500 within a year and plans to use multiple OUs. The company has already enabled AWS Config in each existing AWS account. A DevOps engineer needs to implement a solution that automatically enables AWS Config for any new AWS accounts created in the organization.
- A. In the organization’s management account, create an Amazon EventBridge rule to respond to CreateAccount API calls. Configure the rule to invoke an AWS Lambda function that enables AWS Config with trusted access.
- B. In the organization’s management account, create an AWS CloudFormation StackSet to enable AWS Config. Configure the StackSet to automatically deploy when accounts are created through the organization.
- C. In the organization’s management account, create a Service Control Policy (SCP) that allows the appropriate AWS Config API calls to enable AWS Config. Apply the SCP to the root-level OU.
- D. In the organization’s management account, create an Amazon EventBridge rule to respond to CreateAccount API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to enable AWS Config for the account.
View question →
Q54. A company’s application development team uses Linux-based Amazon EC2 instances as bastion hosts. SSH access to the bastion hosts is restricted to specific IP addresses, as defined in associated security groups. If the security group rules are modified to allow SSH access from any IP address, the company’s security team wants to be notified.
- A. Create an Amazon EventBridge rule using the aws.cloudtrail source and event name AuthorizeSecurityGroupIngress. Define an Amazon Simple Notification Service (Amazon SNS) topic as the target.
- B. Enable Amazon GuardDuty and review security group findings in AWS Security Hub. Configure an Amazon EventBridge rule with a custom pattern matching GuardDuty events with output NON_COMPLIANT.
- C. Create an AWS Config rule using the restricted-ssh managed rule to check whether security groups allow unrestricted inbound SSH traffic. Configure automatic remediation to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.
- D. Enable Amazon Inspector. Include the Common Vulnerabilities and Exposures-1.1 rule package to assess the security group associated with the bastion host. Configure Amazon Inspector to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.
View question →
Q55. A company’s application runs on Amazon EC2 instances. The application writes log files recording user login sessions, dates, durations, and source IP addresses. Logs are published to a log group in Amazon CloudWatch Logs. The company is conducting root cause analysis for an incident that occurred the previous day. The company needs to know how many times a specific user logged in over the past seven days.
- A. Create a CloudWatch Logs metric filter on the log group. Use a filter pattern matching the username. Publish a CloudWatch metric summarizing login counts over the past seven days.
- B. Create a CloudWatch Logs subscription on the log group. Use a filter pattern matching the username. Publish a CloudWatch metric summarizing login counts over the past seven days.
- C. Create a CloudWatch Logs Insights query that uses an aggregation function to count login occurrences for the username over the past seven days. Run the query against the log group.
- D. Create a CloudWatch dashboard. Add a numeric widget with a filter pattern that computes the login count for the username directly from the log group over the past seven days.
View question →
Q56. A healthcare insurance services company is concerned about rising software licensing costs for an application that monitors patient health. The company wants to create an audit process to ensure the application runs only on Amazon EC2 Dedicated Hosts. A DevOps engineer needs to create a workflow to audit the application and ensure compliance. What steps should the engineer take to meet this requirement with minimal administrative overhead?
- A. Use AWS Systems Manager Compliance. Use calls to the put-compliance-items API to scan and build a database of noncompliant EC2 instances based on host placement. Store these instance IDs in an Amazon DynamoDB table for quick access. Generate reports using the list-compliance-summaries API operation via Systems Manager.
- B. Use custom Java code running on EC2 instances. Scale EC2 Auto Scaling based on the number of instances to check. Send a list of noncompliant EC2 instance IDs to an Amazon SQS queue. Set up another worker instance to process instance IDs from the SQS queue and write them to Amazon DynamoDB. Use an AWS Lambda function to terminate noncompliant instances retrieved from the queue and send notifications to an Amazon SNS email topic.
- C. Use AWS Config. Enable configuration recording for all Amazon EC2 resources in the region to identify all EC2 instances to audit. Create a custom AWS Config rule using the 'config-rule-change-triggered' blueprint to invoke an AWS Lambda function. Modify the Lambda evaluateCompliance() function to verify host placement and return NON_COMPLIANT if the instance is not running on an EC2 Dedicated Host. Use AWS Config reports to identify and resolve noncompliant instances.
- D. Use AWS CloudTrail. Analyze all calls to the EC2 RunCommand API to identify all EC2 instances to audit. Invoke an AWS Lambda function to analyze instance host placement. Store noncompliant EC2 instance IDs in an Amazon RDS MySQL database instance. Generate reports by querying the RDS instance and export results as CSV.
View question →
Q57. A developer administrator is configuring a repository to store the company's container images. The administrator needs to configure a lifecycle rule that automatically deletes container images with a specific tag that are older than 15 days. Which solution most effectively meets these requirements?
- A. Create a repository in Amazon Elastic Container Registry (Amazon ECR). Add a lifecycle policy to the repository to expire images with matching tags after 15 days.
- B. Create a repository in AWS CodeArtifact. Add a repository policy to the CodeArtifact repository to terminate outdated assets with matching tags after 15 days.
- C. Create a bucket in Amazon S3. Add a bucket lifecycle policy to expire older objects with matching tags after 15 days.
- D. Create an EC2 Image Builder container recipe. Add build components to expire containers with matching tags after 15 days.
View question →
Q58. A developer is creating a proof of concept for a new software service (SaaS) application. The application resides in a shared development AWS account, which is part of an organization in AWS Organizations. The developer needs to create IAM roles related to AWS services under consideration for the proof of concept. The solution must grant only the ability to create and configure service-related roles. Which solution meets these requirements?
- A. Create an IAM user for the developer in the organization’s management account. Configure a cross-account role for the developer in the development account. Scope the cross-account role to common tasks.
- B. Add the developer to an IAM group. Attach the PowerUserAccess managed policy to the IAM group. Enforce multi-factor authentication (MFA) on the user account.
- C. Add a Service Control Policy (SCP) in the organization’s development account. Configure the SCP with a deny rule for iam:* to restrict the developer’s access.
- D. Create an IAM role with necessary IAM permissions allowing the developer to create policies and roles. Attach a permissions boundary to the role. Grant the developer permission to assume this role.
View question →
Q59. A company uses AWS Organizations to manage multiple accounts. Its information security policy requires unencrypted Amazon EBS volumes to be marked non-compliant. A DevOps engineer must automatically deploy a solution and ensure this compliance check remains continuously enforced. Which solution achieves this?
- A. Create an AWS CloudFormation template defining an AWS Inspector rule to check whether EBS encryption is enabled. Store the template in an Amazon S3 bucket shared across all company accounts. Update the account-creation script to reference the CloudFormation template in Amazon S3.
- B. Create an AWS Config organization rule to check whether EBS encryption is enabled and deploy it using the AWS CLI. Create and apply an SCP to prevent stopping or deleting AWS Config across the entire organization.
- C. Create an SCP in the organization. Use condition expressions to deny launching Amazon EC2 instances when EBS volumes are unencrypted. Apply the SCP to all AWS accounts. Use Amazon Athena to analyze AWS CloudTrail output to identify denied Ec2:RunInstances events.
- D. Deploy an IAM role to all accounts from a single trusted account. Use AWS CodePipeline to build a pipeline with an AWS Lambda stage assuming the IAM role to list all EBS volumes in each account. Publish reports to Amazon S3.
View question →
Q60. A DevOps engineer frequently uses AWS CodeBuild to build software packages from source code. CodeBuild projects build Docker images, which developers reuse across multiple builds. The DevOps engineer wants to improve build performance and optimize cost. Which solution meets these requirements?
- A. Store Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Enable local Docker layer caching for CodeBuild.
- B. Cache Docker images in an Amazon S3 bucket accessible across multiple build hosts. Use S3 lifecycle policies to invalidate the cache.
- C. Store Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Modify the CodeBuild project runtime configuration to always use the latest image version.
- D. Create a custom AMI containing cached Docker images. In the CodeBuild build, launch an Amazon EC2 instance from the custom AMI.
View question →
Q61. A company runs applications in AWS accounts within an organization in AWS Organizations. These applications use Amazon EC2 instances and Amazon S3. The company wants to detect potentially compromised EC2 instances, suspicious network activity, and anomalous API activity across both AWS accounts managed by the company and any AWS accounts created outside the company’s governance. When the company detects such an event, it wants to use the corresponding Amazon Simple Notification Service (Amazon SNS) topic to notify its security operations team for investigation and remediation. According to AWS best practices, which solution meets these requirements?
- A. In the organization’s management account, configure one AWS account as the Amazon GuardDuty administrator account. In the GuardDuty administrator account, add the company’s existing AWS accounts as members to GuardDuty. In the GuardDuty administrator account, create an Amazon EventBridge rule using an event pattern to match GuardDuty findings and forward matching events to the SNS topic.
- B. In the organization’s management account, configure Amazon GuardDuty to invite newly created AWS accounts and send invitations to existing AWS accounts. Create an AWS CloudFormation StackSet that accepts GuardDuty invitations and creates Amazon EventBridge rules. Configure the rule using an event pattern to match GuardDuty findings and forward matching events to the SNS topic. Configure the StackSet to deploy to all AWS accounts in the organization.
- C. In the organization’s management account, create an AWS CloudTrail organization trail. Activate the organization trail in all AWS accounts in the organization. Create an SCP to enable VPC Flow Logs in every account in the organization. Enable AWS Security Hub for the organization. Create an Amazon EventBridge rule using an event pattern to match Security Hub findings and forward matching events to the SNS topic.
- D. In the organization’s management account, configure one AWS account as the AWS CloudTrail administrator account. In the CloudTrail administrator account, create a CloudTrail organization trail. Add the company’s existing AWS accounts to the organization trail. Create an SCP to enable VPC Flow Logs in every account in the organization. Enable AWS Security Hub for the organization. Create an Amazon EventBridge rule using an event pattern to match Security Hub findings and forward matching events to the SNS topic.
View question →
Q62. A development team wants to use AWS CloudFormation stacks to deploy an application. However, the developer IAM role lacks permissions required for resources specified in the AWS CloudFormation template. A DevOps engineer must implement a solution that allows developers to deploy stacks while adhering to the principle of least privilege. Which solution meets these requirements?
- A. Create an IAM policy allowing developers to provision the required resources. Attach the policy to the developer IAM role.
- B. Create an IAM policy allowing full access to AWS CloudFormation. Attach the policy to the developer IAM role.
- C. Create an AWS CloudFormation service role with required permissions. Grant the developer IAM role cloudformation:* action. Use the new service role during stack deployment.
- D. Create an AWS CloudFormation service role with required permissions. Grant the developer IAM role iam:PassRole permission. Use the new service role during stack deployment.
View question →
Q63. A company uses AWS Control Tower to manage its multi-account AWS environment. The company previously used the standard AWS Management Console to create AWS accounts via AWS Control Tower. The company now wants to implement an automated solution using AWS Control Tower Account Factory to create new AWS accounts. A DevOps engineer is testing a new method where employees upload a CSV file to an Amazon S3 bucket. The CSV file contains information required to create a new AWS account. When a new file is created in the S3 bucket, an AWS Lambda function processes the Amazon S3 event notification. The Lambda function uses the AWS Service Catalog API to create the AWS account. The DevOps engineer needs to implement a solution to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic upon successful completion of the account creation process. How should the DevOps engineer automate the SNS notification?
- A. Configure AWS Control Tower to publish to the SNS topic when its automatic drift detection feature identifies that a new account has been added to the service.
- B. Configure the AWS Control Tower Account Factory product in AWS Service Catalog to publish to the SNS topic when a new account product is provisioned.
- C. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that responds to AWS Service Catalog ProvisionProduct events and publishes to the SNS topic.
- D. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that responds to AWS Control Tower CreateManagedAccount events and publishes to the SNS topic.
View question →
Q64. A multinational company uses AWS Control Tower to manage multiple AWS accounts. It hosts internal applications and public-facing applications. Each application team has its own AWS account for application hosting. These accounts are consolidated into an organization in AWS Organizations. One AWS Control Tower member account serves as a centralized DevOps account, hosting CI/CD pipelines that application teams use to deploy applications to their respective target AWS accounts. Deployment IAM roles reside in the centralized DevOps account. An application team is attempting to deploy its application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster in its application AWS account. A deployment IAM role exists in the application AWS account. The deployment is performed via an AWS CodeBuild project configured in the centralized DevOps account. The CodeBuild project uses CodeBuild’s IAM service role. Deployment fails with an 'access denied' error when CodeBuild attempts to connect to the cross-account EKS cluster. Which solution resolves this error?
- A. Configure the application account’s deployment IAM role to establish a trust relationship with the centralized DevOps account. Configure the trust relationship to allow sts:AssumeRole. Configure the application account’s deployment IAM role with required permissions for the EKS cluster. Configure the EKS cluster’s aws-auth ConfigMap to map the role to appropriate Kubernetes system permissions.
- B. Configure the centralized DevOps account’s deployment IAM role to establish a trust relationship with the application account. Configure the trust relationship to allow sts:AssumeRole. Configure the centralized DevOps account’s deployment IAM role with required permissions for CodeBuild.
- C. Configure the centralized DevOps account’s deployment IAM role to establish a trust relationship with the application account. Configure the trust relationship to allow sts:AssumeRoleWithSAML. Configure the centralized DevOps account’s deployment IAM role with required permissions for CodeBuild.
- D. Configure the application account’s deployment IAM role to establish a trust relationship with the AWS Control Tower management account. Configure the trust relationship to allow sts:AssumeRole. Configure the application account’s deployment IAM role with required permissions for the EKS cluster. Configure the EKS cluster’s aws-auth ConfigMap to map the role to appropriate Kubernetes system permissions.
View question →
Q65. A DevOps engineer is creating a CI/CD pipeline for an Amazon ECS service. The ECS containers run behind an Application Load Balancer and serve as the web tier of a three-tier application. The success criterion for deployment is ensuring that the web tier can communicate with the application’s database and middleware tiers after deployment. How can this be achieved automatically?
- A. Create a health check endpoint in the web application that tests connectivity to the data and middleware tiers. Use this endpoint as the load balancer’s health check URL.
- B. Create an approval step for the quality assurance team to verify connectivity. Reject changes in the pipeline if issues occur connecting to dependent tiers.
- C. Use Amazon RDS active connection count and Amazon CloudWatch ELB metrics to trigger alerts when open connection counts change significantly.
- D. Use Amazon Route 53 health checks to detect issues with the web service and roll back the CI/CD pipeline upon errors.
View question →
Q66. A company has an application composed of four independent AWS Lambda functions. A DevOps engineer built a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild to sequentially build, test, package, and deploy each Lambda function. The pipeline uses Amazon EventBridge rules to trigger immediately after application source code changes. After using the pipeline for several weeks, the DevOps engineer notices it takes too long to complete. What should the DevOps engineer implement to best improve pipeline speed?
- A. Modify the CodeBuild projects in the pipeline to use a compute type with higher available network throughput.
- B. Create a custom CodeBuild execution environment with symmetric multiprocessing configuration to run builds in parallel.
- C. Modify the CodePipeline configuration to run operations for each Lambda function in parallel by specifying the same run order.
- D. Modify each CodeBuild project to run within a VPC and use dedicated instances to increase throughput.
View question →
Q67. A DevOps engineer is troubleshooting deployment of a new application running on Amazon EC2 instances behind an Application Load Balancer. The instances run in an EC2 Auto Scaling group spanning multiple Availability Zones. Instances register with the load balancer before becoming fully ready, causing increased customer error rates. Current health check configuration grants a 60-second grace period and marks an instance healthy after a single 200 response from /index.php — a page that may intermittently respond during deployment. The development team wants instances to become available as quickly as possible. Which strategy resolves this issue?
- A. Increase the instance grace period from 60 seconds to 180 seconds and increase the consecutive health check requirement from 2 to 3.
- B. Increase the instance grace period from 60 seconds to 120 seconds and change the expected HTTP response code from 200 to 204.
- C. Modify the deployment script to create a /health-check.php file at the start of deployment, then update the health check path to point to that file.
- D. Modify the deployment script to create a /health-check.php file only after all deployment tasks complete, then update the health check path to point to that file.
View question →
Q68. A highly regulated company has implemented a policy prohibiting DevOps engineers from logging into Amazon EC2 instances except during emergencies. If login does occur, the security team must be notified within 15 minutes. Which solution meets these requirements?
- A. Install the Amazon Inspector agent on each EC2 instance. Subscribe to Amazon CloudWatch Events notifications. Trigger an AWS Lambda function to inspect messages for user login events and send notifications via Amazon SNS to the security team.
- B. Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up CloudWatch metric filters to search for user login events. If detected, send notifications via Amazon SNS to the security team.
- C. Configure AWS CloudTrail with Amazon CloudWatch Logs. Subscribe CloudWatch Logs to Amazon Kinesis. Attach an AWS Lambda function to Kinesis to parse logs and identify login events, then notify the security team via Amazon SNS.
- D. Deploy a script on each Amazon EC2 instance to push logs to Amazon S3. Configure S3 event notifications to trigger an AWS Lambda function that invokes Amazon Athena to query logs for login events and sends results via Amazon SNS to the security team.
View question →
Q69. Within an AWS Organization, a company operates multiple accounts. The SecOps team requires Amazon SNS notifications whenever any account disables the Block Public Access setting on an Amazon S3 bucket. A DevOps engineer must implement this change without impacting any AWS account operations. The implementation must prevent individual member accounts from disabling the notification mechanism.
- A. Designate an account as the delegated Amazon GuardDuty administrator. Enable GuardDuty across all organization accounts. In the administrator account, create an SNS topic, subscribe the SecOps team’s email address, and create an Amazon EventBridge rule targeting GuardDuty findings with the SNS topic.
- B. Create an AWS CloudFormation template that defines an SNS topic and subscribes the SecOps team’s email. Include an Amazon EventBridge rule matching the CloudTrail event s3:PutBucketPublicAccessBlock, with the SNS topic as target. Deploy the stack across all accounts using CloudFormation StackSets.
- C. Enable AWS Config across the organization. In the delegated administrator account, create an SNS topic and subscribe the SecOps team’s email. Deploy a conformance pack using the AWS Config managed rule s3-bucket-level-public-access-prohibited and use AWS Systems Manager Documents to publish noncompliance events to the SNS topic.
- D. Enable Amazon Inspector across the organization. In the Amazon Inspector delegated administrator account, create an SNS topic and subscribe the SecOps team’s email. Create an Amazon EventBridge rule matching public exposure events for S3 buckets and publish notifications to the SNS topic.
View question →
Q70. A company selected AWS to host a new application and requires a multi-account strategy. A DevOps engineer created a new AWS account and organization in AWS Organizations, built an OU structure, and set up a Landing Zone using AWS Control Tower. The engineer now needs to implement a solution that automatically deploys resources for new accounts provisioned via AWS Control Tower Account Factory. When a new account is created, the solution must apply OU- or account-specific AWS CloudFormation templates and Service Control Policies (SCPs) to deploy attached resources. All OUs are registered in AWS Control Tower.
- A. Integrate AWS Service Catalog with AWS Control Tower. Create portfolios and products in AWS Service Catalog and grant fine-grained permissions for provisioning. Deploy SCPs using AWS CLI and JSON documents.
- B. Deploy CloudFormation StackSets with required templates. Enable automatic deployment and deploy stack instances to target accounts. Deploy SCPs via CloudFormation StackSets in the organization’s management account.
- C. Create an Amazon EventBridge rule to detect CreateManagedAccount events. Configure AWS Service Catalog to deploy resources to new accounts. Deploy SCPs using AWS CLI and JSON documents.
- D. Deploy Customizations for AWS Control Tower (CfCT). Use an AWS CodeCommit repository as the source. In the repository, define a custom package containing CloudFormation templates and SCP JSON documents.
View question →
Q71. A company runs an application on Amazon EC2 instances and uses AWS CodePipeline to deploy it across multiple AWS Regions. The pipeline configures one stage per Region, each containing an AWS CloudFormation action for auto-scaling group creation. After deploying to a Region, the company requires confirmation that the application is healthy before proceeding to the next Region. Amazon Route 53 records are configured per Region, and the DevOps engineer created Route 53 health checks based on Amazon CloudWatch alarms for each Region’s deployed application.
- A. Create an AWS Step Functions workflow to check the status of CloudWatch alarms. Configure the workflow to fail if the alarm is in ALARM state. Add a new stage between each Region’s deployment stage in the pipeline and include an action invoking the Step Functions workflow.
- B. Configure an AWS CodeDeploy application to deploy a CloudFormation template with automatic rollback. Configure CloudWatch alarms as CodeDeploy instance health checks. Remove CloudFormation actions from the pipeline and add CodeDeploy actions per Region.
- C. Create a new pipeline stage for each Region where the application is deployed. Configure a CloudWatch alarm action in the new stage to check alarm status and exit with error if the alarm is in ALARM state.
- D. Configure the CloudWatch agent on EC2 instances to report application status to Route 53 health checks. Create a new pipeline stage per Region. Configure a CloudWatch alarm action to exit with error if the alarm is in ALARM state.
View question →
Q72. A company’s developers rely on system administrators from a third-party IT services firm to perform maintenance tasks. The company operates several Amazon EC2 instances requiring restart after AWS Health notifications during scheduled maintenance windows. The DevOps engineer must implement an automated remediation solution using Amazon EventBridge to respond to planned maintenance notifications.
- A. Configure AWS Health as the event source. Specify event types indicating planned instance termination and retirement. Target an AWS Systems Manager Automation runbook to restart the EC2 instances.
- B. Configure Amazon Systems Manager as the event source. Specify event types indicating maintenance windows. Target an AWS Systems Manager Automation runbook to restart the EC2 instances.
- C. Configure AWS Health as the event source. Specify event types indicating planned instance termination and retirement. Target a newly created AWS Lambda function that registers an SSM Maintenance Window task to restart the EC2 instances.
- D. Configure Amazon EC2 as the event source. Specify event types representing instance state notifications. Target a newly created AWS Lambda function that registers an SSM Maintenance Window task to restart the EC2 instances.
View question →
Q73. A video-sharing company stores videos in Amazon S3. The company observes a sudden increase in video access requests but does not know which videos are most popular. The company needs to determine the general access patterns of video files, including the number of unique users accessing a specific file on a given date and the total number of requests for that file. How can the company meet these requirements with minimal effort?
- A. Enable S3 server access logging. Import the access logs into an Amazon Aurora database. Use Aurora SQL queries to analyze access patterns.
- B. Enable S3 server access logging. Use Amazon Athena to create an external table over the log files stored in S3. Use Athena SQL queries to analyze access patterns.
- C. Invoke an AWS Lambda function for each S3 object access event. Configure the Lambda function to write file access information—such as user, S3 bucket, and object key—to an Amazon Aurora database. Use Aurora SQL queries to analyze access patterns.
- D. Log an Amazon CloudWatch Logs entry for each S3 object access event. Configure CloudWatch Logs streams to send file access information (e.g., user, S3 bucket, and object key) to an Amazon Kinesis Data Analytics for SQL application. Perform sliding-window analysis.
View question →
Q74. A company wants to ensure its EC2 instances are secure. It wants to detect new vulnerabilities on the instances and receive notifications, and it also wants to audit login activities on the instances.
- A. Use AWS Systems Manager to detect vulnerabilities on EC2 instances. Install the Amazon Kinesis Agent to capture system logs and deliver them to Amazon S3.
- B. Use AWS Systems Manager to detect vulnerabilities on EC2 instances. Install the Systems Manager Agent to capture system logs and view login activity in the CloudTrail console.
- C. Configure Amazon CloudWatch to detect vulnerabilities on EC2 instances. Install the AWS Config agent to capture system logs and view them in the AWS Config console.
- D. Configure Amazon Inspector to detect vulnerabilities on EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and publish them via Amazon CloudWatch Logs.
View question →
Q75. A security review finds that an AWS CodeBuild project is downloading database population scripts from an Amazon S3 bucket using unauthenticated requests. The security team prohibits unauthenticated requests to the S3 bucket used by this project.
- A. Add the bucket name to the AllowedBuckets section in the CodeBuild project settings. Update the build specification to use the AWS CLI to download the database population script.
- B. Modify the S3 bucket configuration to enable HTTPS basic authentication and specify a token. Update the build specification to use cURL to pass the token and download the database population script.
- C. Use a bucket policy to remove unauthenticated access to the S3 bucket. Modify the CodeBuild project’s service role to include Amazon S3 permissions. Use the AWS CLI to download the database population script.
- D. Use a bucket policy to remove unauthenticated access to the S3 bucket. Use the AWS CLI with IAM access keys and secret access keys to download the database population script.
View question →
Q76. A developer maintains a fleet of 50 Amazon EC2 Linux servers. These servers are part of an Amazon EC2 Auto Scaling group and are load-balanced using Elastic Load Balancing. Occasionally, some application servers are terminated after failing ELB HTTP health checks. The developer wants to perform root cause analysis but cannot access application logs before the servers terminate.
- A. Use an Auto Scaling lifecycle hook to place the instance in Pending:Wait state. Create an Amazon CloudWatch alarm for EC2 Instance Terminate Successful and trigger an AWS Lambda function to invoke SSM Run Command to collect logs, push them to Amazon S3, and then complete the lifecycle action.
- B. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an AWS Config rule for EC2 instance termination lifecycle events and trigger a Step Functions workflow that runs a script to collect logs, push them to Amazon S3, and then complete the lifecycle action.
- C. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an Amazon CloudWatch Logs subscription filter for EC2 Instance Terminate Successful and trigger the CloudWatch agent to run a script to collect logs, push them to Amazon S3, and then complete the lifecycle action.
- D. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an Amazon EventBridge rule for EC2 instance termination lifecycle events and trigger an AWS Lambda function to invoke SSM Run Command to collect logs, push them to Amazon S3, and then complete the lifecycle action.
View question →
Q77. A company uses an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with one DB instance. The application uses the cluster endpoint to perform read and write operations on the database. The company plans to apply updates to the cluster during an upcoming maintenance window. During the maintenance window, cluster availability must be maintained, with minimal disruption.
- A. Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the application to use the Aurora reader endpoint for read operations.
- B. Add a reader instance to the Aurora cluster. Create a custom cluster endpoint. Update the application to use the custom cluster endpoint for both read and write operations.
- C. Enable the Multi-AZ option on the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the application to use the Aurora reader endpoint for read operations.
- D. Enable the Multi-AZ option on the Aurora cluster. Create a custom cluster endpoint. Update the application to use the custom cluster endpoint for both read and write operations.
View question →
Q78. A company runs a synchronous application that processes records. All components run on Amazon EC2 instances within an Auto Scaling group. Each record undergoes a multi-step, sequential processing flow based on its type. Each step completes within five minutes or less. A current limitation is that if any step fails, the entire record is reprocessed from the beginning. The company wants to update the architecture so only failed steps are retried.
- A. Create a web application to write records to Amazon S3. Use S3 event notifications to publish to an Amazon Simple Notification Service (Amazon SNS) topic. Use EC2 instances polling SNS to begin processing. Save intermediate results to Amazon S3 to pass to the next step.
- B. Implement processing steps using application logic. Refactor the application code to run in containers. Use AWS Fargate to manage container instances. Configure containers to call themselves to pass state from one step to the next.
- C. Create a web application to send records to an Amazon Kinesis data stream. Use Kinesis Data Streams and AWS Lambda functions to separate processing.
- D. Create a web application to send records to AWS Step Functions. Decompose processing into Step Functions tasks and AWS Lambda functions.
View question →
Q79. A company uses AWS CodeBuild to deploy container-based applications. The security team requires vulnerability scanning of containers before deployment to protected endpoints. All sensitive information must be securely stored.
- A. Encrypt secrets using AWS KMS. Store the encrypted secrets as environment variables in the buildspec.yml file under variable mappings. Reference the environment variables to initiate the scan.
- B. Import secrets into AWS CloudHSM keys. Reference the CloudHSM key as an environment variable under variable mappings in the buildspec.yml file. Reference the environment variable to initiate the scan.
- C. Store secrets as SecureString parameters in AWS Systems Manager Parameter Store. Add the Parameter Store key as an environment variable under parameter store mappings in the buildspec.yml file. Reference the environment variable to initiate the scan.
- D. Encrypt secrets using the AWS Encryption SDK and embed them as variables under secrets mappings in the buildspec.yml file. Attach a policy to the CodeBuild project to grant access to the required decryption key.
View question →
Q80. A company uses containers for its applications. It discovers that some container images lack required security configurations. A DevOps engineer must implement a solution to create a standardized base image. The solution must publish the base image weekly to the US West (Oregon), US East (N. Virginia), and EU (Frankfurt) Regions.
- A. Create an EC2 Image Builder pipeline using container recipes to build the image. Configure the pipeline to distribute the image to an Amazon Elastic Container Registry (Amazon ECR) repository in us-west-2. Configure ECR replication from us-west-2 to us-east-2, then from us-east-2 to eu-central-1. Schedule the pipeline to run weekly.
- B. Create an AWS CodePipeline pipeline using an AWS CodeBuild project to build the image. Use AWS CodeDeploy to publish the image to an Amazon ECR repository in us-west-2. Configure ECR replication from us-west-2 to us-east-2, then from us-east-2 to eu-central-1. Schedule the pipeline to run weekly.
- C. Create an EC2 Image Builder pipeline using container recipes to build the image. Configure the pipeline to distribute the image to Amazon ECR repositories in all three Regions. Schedule the pipeline to run weekly.
- D. Create an AWS CodePipeline pipeline using an AWS CodeBuild project to build the image. Use AWS CodeDeploy to publish the image to Amazon ECR repositories in all three Regions. Schedule the pipeline to run weekly.
View question →
Q81. A company sends AWS Network Firewall logs to an Amazon S3 bucket. Later, the company uses Amazon Athena to analyze these logs. Before delivering these logs to the target S3 bucket, the company needs to transform the logs and add additional data. Which solution meets these requirements?
- A. Create an AWS Lambda function to transform the data and write a new object to the existing S3 bucket. Configure an S3 trigger on the existing S3 bucket. Specify all object creation events as the event type. Allow recursive invocation.
- B. Enable Amazon EventBridge notifications on the existing S3 bucket. Create a custom event bus. Create an EventBridge rule associated with the custom event bus. Configure the rule to respond to all object creation events for the existing S3 bucket and invoke an AWS Step Functions workflow. Configure a Step Functions task to transform the data and write it to a new S3 bucket.
- C. Create an Amazon EventBridge rule associated with the default event bus. Configure the rule to respond to all object creation events for the existing S3 bucket. Define a new S3 bucket as the rule target. Create an EventBridge input transformation to customize the event before delivering it to the rule target.
- D. Create an Amazon Kinesis Data Firehose delivery stream configured with an AWS Lambda transformer. Specify the existing S3 bucket as the destination. Change the Network Firewall log destination from Amazon S3 to Kinesis Data Firehose.
View question →
Q82. A company uses AWS CloudFormation to deploy its application environment. A recent update to the CloudFormation stack failed during deployment. A DevOps engineer discovered that some resources in the stack had been manually modified. A DevOps engineer needs a solution to detect manual modifications to resources and alert the DevOps manager. Which solution meets these requirements with minimal operational overhead?
- A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps manager’s email address to the SNS topic. Create an AWS Config managed rule with identifier CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK. Create an Amazon EventBridge rule that invokes on NON_COMPLIANT resource state. Set the SNS topic as the rule target.
- B. Tag all CloudFormation resources with a specific tag. Use the AWS Config Rules Development Kit library (RDKlib) to create a custom AWS Config rule that checks for changes to all tagged resources. Configure the custom rule to mark any change to tagged resources as NON_COMPLIANT when CloudFormation did not perform the change. Create an Amazon EventBridge rule that invokes on NON_COMPLIANT resource state. Create an AWS Lambda function to send an email to the DevOps manager. Set the Lambda function as the rule target.
- C. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps manager’s email address to the SNS topic. Create an AWS Config managed rule with identifier CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK. Create an Amazon EventBridge rule that invokes on COMPLIANT resource state. Set the SNS topic as the rule target.
- D. Create an AWS Config managed rule with identifier CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK. Create an Amazon EventBridge rule that invokes on NON_COMPLIANT resource state. Create an AWS Lambda function to send an email to the DevOps manager. Set the Lambda function as the rule target.
View question →
Q83. A company hosts a static website from an Amazon S3 bucket. Users access the website at example.com. The company uses Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the static website with a dynamic web application running on a set of Amazon EC2 instances behind an Application Load Balancer (ALB). On launch day, the company creates an additional Route 53 weighted DNS record pointing to the ALB, with weight 255 and TTL 1 second. After 24 hours, a DevOps engineer notices that when users navigate to example.com, the static website still appears. How should the DevOps engineer ensure the company serves only dynamic content for example.com?
- A. Delete all objects—including previous versions—from the S3 bucket containing the static website content.
- B. Update the weighted DNS record pointing to the S3 bucket. Apply weight 0. Specify domain reset option to propagate the change immediately.
- C. Configure website redirect requests on the S3 bucket to redirect to the ALB’s hostname.
- D. Delete the weighted DNS record pointing to the S3 bucket from the example.com hosted zone. Wait for DNS propagation to complete.
View question →
Q84. A company has a local application written in Go. A DevOps engineer wants to migrate the application to AWS. The company’s development team wants to enable blue/green deployments and perform A/B testing.
- A. Deploy the application on Amazon EC2 instances and create an AMI from the instance. Use the AMI to create an Auto Scaling launch configuration used in an Auto Scaling group. Use Elastic Load Balancing to distribute traffic. When changes are made to the application, create a new AMI, triggering EC2 instance refresh.
- B. Deploy the application using Amazon Lightsail. Store the application in compressed format in an Amazon S3 bucket. Deploy new versions of the application to Lightsail using this compressed version. Use Lightsail deployment options to manage deployments.
- C. Use AWS CodeArtifact to store the application code. Use AWS CodeDeploy to deploy the application to a fleet of Amazon EC2 instances. Use Elastic Load Balancing to distribute traffic across EC2 instances. When changes are made to the application, upload the new version to CodeArtifact and create a new CodeDeploy deployment.
- D. Use AWS Elastic Beanstalk to host the application. Store the compressed version of the application in Amazon S3. Deploy new versions of the application using that location. Use Elastic Beanstalk to manage deployment options.
View question →
Q85. A company uses an Application Load Balancer (ALB) as part of its application architecture. The company owns the ALB in an AWS account that belongs to an organization within AWS Organizations. The company has configured AWS Config in all AWS accounts within the organization. The company needs to apply an AWS WAF Web ACL with a set of common rules to the ALB—including any ALBs created in the future—and allow administrators of each AWS account to define their own AWS WAF rules that supplement the common rules provided by the company’s security team. Which solution meets these requirements?
- A. Configure AWS Firewall Manager for the organization. In the Firewall Manager administrator account, create an AWS WAF policy. Enable auto-remediation and define the Web ACL. Configure the policy scope to apply to all ALBs in the organization.
- B. Use AWS Resource Access Manager (AWS RAM) from the organization’s management account to enable resource sharing across the organization. Create a Web ACL. Configure Web ACL resource sharing for the organization. Associate the shared Web ACL with all ALBs in the organization.
- C. Set up the ALB_WAF_ENABLED AWS Config managed rule with auto-remediation enabled. Configure the rule to create a Web ACL and attach it to all ALBs in the AWS account. Create a compliance pack containing this rule. Deploy the compliance pack to all AWS accounts in the organization.
- D. Configure AWS Firewall Manager for the organization. In the Firewall Manager administrator account, create an AWS WAF policy defining the Web ACL. Set up the ALB_WAF_ENABLED AWS Config managed rule with auto-remediation enabled. Configure the rule to attach the Web ACL to all ALBs in the AWS account. Deploy the rule to all AWS accounts in the organization.
View question →
Q86. A company runs an application on an Amazon EC2 instance. Application metadata is stored in Amazon S3, and the instance retrieves this metadata upon restart. If the instance becomes unresponsive, it must automatically restart or reboot.
- A. Create an Amazon CloudWatch alarm for the StatusCheckFailed metric. Use the recovery action to stop and start the instance. When the instance is back online, use S3 event notifications to push metadata to the instance.
- B. Configure AWS OpsWorks and use its auto-healing feature to stop and start the instance. Use OpsWorks lifecycle events to fetch metadata from Amazon S3 and update it on the instance.
- C. Use EC2 Auto Recovery to automatically stop and start the instance when failures occur. When the instance is back online, use S3 event notifications to push metadata to the instance.
- D. Use AWS CloudFormation to create an EC2 instance with the UserData property. Include a command in UserData to retrieve application metadata from Amazon S3.
View question →
Q87. A company developed a serverless web application hosted on AWS. The application consists of Amazon S3, Amazon API Gateway, multiple AWS Lambda functions, and an Amazon RDS for MySQL database. The company uses AWS CodeCommit to store source code. The source code comprises an AWS Serverless Application Model (AWS SAM) template and Python code. Security audits and penetration tests revealed that database credentials are hardcoded in the CodeCommit repository. A DevOps engineer wants to implement a solution to automatically detect and prevent hardcoded secrets. What is the most secure solution that meets these requirements?
- A. Enable Amazon CodeGuru Profiler. Decorate handler functions with @with_lambda_profiler(). Manually review recommendation reports. Store credentials as secure strings in AWS Systems Manager Parameter Store. Update the SAM template and Python code to retrieve secrets from Parameter Store.
- B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually inspect code reviews for any recommendations. Select the protect secrets option. Update the SAM template and Python code to retrieve credentials from AWS Secrets Manager.
- C. Enable Amazon CodeGuru Profiler. Decorate handler functions with @with_lambda_profiler(). Manually review recommendation reports. Select the protect secrets option. Update the SAM template and Python code to retrieve credentials from AWS Secrets Manager.
- D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually inspect code reviews for any recommendations. Store credentials as strings in AWS Systems Manager Parameter Store. Update the SAM template and Python code to retrieve secrets from Parameter Store.
View question →
Q88. A company hosts a security audit application in an AWS account. The audit application uses IAM roles to access other AWS accounts. All audited accounts belong to the same organization in AWS Organizations. A recent security audit revealed that users in audited AWS accounts can modify or delete the IAM roles used by the audit application. The company needs to prevent any entity—except trusted administrator IAM roles—from modifying the audit application’s IAM roles.
- A. Create a Service Control Policy (SCP) containing a Deny statement for modifications to the audit application’s IAM roles. Include a condition allowing changes by trusted administrator IAM roles. Attach the SCP to the organization root.
- B. Create an SCP containing an Allow statement permitting trusted administrator IAM roles to modify the audit application’s IAM roles. Include Deny statements blocking all other IAM principals from making such changes. Attach the SCP to the IAM service in each AWS account where the audit application has IAM roles.
- C. Create an IAM permissions boundary containing a Deny statement for modifications to the audit application’s IAM roles. Include a condition allowing changes by trusted administrator IAM roles. Attach the permissions boundary to the audited AWS account.
- D. Create an IAM permissions boundary containing a Deny statement for modifications to the audit application’s IAM roles. Include a condition allowing changes by trusted administrator IAM roles. Attach the permissions boundary to the IAM role used by the audit application in the AWS account.
View question →
Q89. A company hosts a web application in an AWS Region. For disaster recovery purposes, a second Region is designated as the disaster recovery (DR) Region. The disaster recovery requirements specify that session data must be replicated nearly in real time between Regions, and 1% of requests should be routed to the secondary Region to maintain system functionality validation. Additionally, if the primary Region experiences service interruption, traffic must automatically fail over to the secondary Region, and the secondary Region must scale to handle the full traffic load.
- A. Deploy the application on AWS Elastic Beanstalk in both Regions and use Amazon DynamoDB global tables to store session data. Use Amazon Route 53 weighted routing policy with health checks to distribute traffic across Regions.
- B. Launch the application in Auto Scaling groups in both Regions and use DynamoDB for session data. Use Route 53 failover routing policy with health checks to distribute traffic across Regions.
- C. Deploy the application in AWS Lambda in both Regions, exposed by Amazon API Gateway, and use Amazon RDS PostgreSQL with cross-Region replication for session data. Deploy the web application with client-side logic to directly invoke the API Gateway.
- D. Launch the application in Auto Scaling groups in both Regions and use DynamoDB global tables for session data. Enable Amazon CloudFront weighted distribution across Regions. Point Amazon Route 53 DNS records to the CloudFront distribution.
View question →
Q90. A DevOps engineer is designing a continuous deployment strategy for a SaaS web application running on AWS. Due to application and security requirements, customers subscribed to the application are distributed across multiple Application Load Balancers (ALBs), each associated with a dedicated Auto Scaling group and Amazon EC2 instance fleet. The application does not require a build stage, and when committed to AWS CodeCommit, it must trigger synchronous deployments to the corresponding ALB, Auto Scaling group, and EC2 fleet.
- A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB–Auto Scaling group pair.
- B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and a single deployment group.
- C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment groups for each ALB–Auto Scaling group pair.
- D. Create a separate AWS CodePipeline pipeline for each ALB–Auto Scaling group pair, deploying the application using an AWS CodeDeploy application and deployment group created for that same ALB–Auto Scaling group pair.
View question →
Q91. A company operates hundreds of Amazon EC2 instances in a single AWS Region within one AWS account. New EC2 instances are launched and terminated daily in this account. Some EC2 instances have been running for more than one week. The company’s security policy requires all running EC2 instances to use an EC2 instance profile. If an EC2 instance launches without an instance profile attached, it uses the default instance profile with no assigned IAM permissions. A DevOps engineer audits the account and discovers EC2 instances running without attached instance profiles. During the review period, the engineer also observes new EC2 instances launching without instance profiles.
- A. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that responds to EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function that attaches the default instance profile to the EC2 instance.
- B. Configure the ec2-instance-profile-attached AWS Config managed rule with configuration change trigger type. Configure auto-remediation action to invoke an AWS Systems Manager Automation runbook that attaches the default instance profile to the EC2 instance.
- C. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that responds to EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook that attaches the default instance profile to the EC2 instance.
- D. Configure the iam-role-managed-policy-check AWS Config managed rule with configuration change trigger type. Configure auto-remediation action to invoke an AWS Lambda function that attaches the default instance profile to the EC2 instance.
View question →
Q92. To run an application, a DevOps engineer launches Amazon EC2 instances with public IP addresses in a public subnet. A user data script fetches application artifacts and installs them on the instance during launch. A new security classification requirement mandates that instances operate without internet access. Although instances launch successfully and appear healthy, the application appears not to install.
- A. Launch the instance in a public subnet with an Elastic IP address. After the application installs and runs, run a script to disassociate the Elastic IP address.
- B. Set up a NAT gateway. Deploy the EC2 instance into a private subnet. Update the private subnet’s route table to use the NAT gateway as the default route.
- C. Publish the application artifacts to an Amazon S3 bucket and create a VPC endpoint for S3. Assign an IAM instance profile to the EC2 instance to allow reading from the S3 bucket.
- D. Create a security group for the application instance that allows outbound traffic only to the artifact repository. Remove the security group rules after installation.
View question →
Q93. A company runs applications in AWS accounts that reside within an organization in AWS Organizations. These applications use Amazon EC2 instances and Amazon S3. The company wants to detect potentially compromised EC2 instances, suspicious network activity, and anomalous API activity in both existing AWS accounts and any newly created AWS accounts. When such an event is detected, the company wants to use an existing Amazon Simple Notification Service (Amazon SNS) topic to notify the security response team for investigation and remediation.
- A. In the organization’s management account, configure the AWS account as an Amazon GuardDuty administrator account. In the GuardDuty administrator account, add the company’s existing AWS accounts as members to GuardDuty. In the GuardDuty administrator account, create an Amazon EventBridge rule with an event pattern matching GuardDuty findings and forward matched events to the SNS topic.
- B. In the organization’s management account, configure Amazon GuardDuty to add newly created AWS accounts via invitation and send invitations to existing AWS accounts. Create an AWS CloudFormation stack set that accepts GuardDuty invitations and creates an Amazon EventBridge rule. Configure the rule with an event pattern matching GuardDuty findings and forwarding matched events to the SNS topic. Configure the CloudFormation stack set to deploy across all AWS accounts in the organization.
- C. In the organization’s management account, create an AWS CloudTrail organization trail. Activate organization-wide CloudTrail logging for all AWS accounts in the organization. Create a service control policy (SCP) to enable VPC flow logs in every account in the organization. Configure AWS Security Hub for the organization. Create an Amazon EventBridge rule with an event pattern matching Security Hub findings and forward matched events to the SNS topic.
- D. In the organization’s management account, configure the AWS account as an AWS CloudTrail administrator account. In the CloudTrail administrator account, create a CloudTrail organization trail. Add the company’s existing AWS accounts to the organization trail. Create an SCP to enable VPC flow logs in every account in the organization. Configure AWS Security Hub for the organization. Create an Amazon EventBridge rule with an event pattern matching Security Hub findings and forward matched events to the SNS topic.
View question →
Q94. During a security audit, a company discovers some security groups allowing SSH traffic from 0.0.0.0/0. A security team wants to implement a solution to detect and remediate this issue as quickly as possible. The company uses AWS Organizations to centrally manage its security services across all AWS accounts.
- A. Enable AWS Config across all AWS accounts. Use a periodic trigger to invoke the vpc-sg-open-only-to-authorized-ports AWS Config managed rule. Create an AWS Lambda function to remediate any noncompliant resources.
- B. Create an AWS Lambda function in each AWS account to delete all security group rules. Create an Amazon EventBridge rule to match security group update or creation events. Configure the Lambda function in each account as the rule’s target.
- C. Enable AWS Config across all AWS accounts. Create a custom AWS Config rule that runs on configuration change triggers. Configure the rule to invoke an AWS Lambda function to remediate any noncompliant resources.
- D. Develop an AWS Systems Manager Automation document in each account to check all security groups and delete noncompliant rules. Run the automation document hourly using an Amazon EventBridge scheduled rule.
View question →
Q95. A company runs an application on Amazon EC2 instances. The application requires frequent restarts. When a restart is needed, application logs emit error messages. Application logs are published to a log group in Amazon CloudWatch Logs. When log entries contain restart-related error messages, an Amazon CloudWatch alarm notifies application engineers via an Amazon Simple Notification Service (Amazon SNS) topic. After receiving the SNS notification, engineers manually restart the application on the instance.
- A. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instance. Configure the SNS topic to invoke the runbook.
- B. Create an AWS Lambda function that restarts the application on the instance. Configure the Lambda function as the event destination for the SNS topic.
- C. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instance. Create an AWS Lambda function to invoke the runbook. Configure the Lambda function as the event destination for the SNS topic.
- D. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instance. Configure an Amazon EventBridge rule that reacts when the CloudWatch alarm enters the ALARM state. Specify the runbook as the rule’s target.
View question →
Q96. A company requires its internal business teams to deploy resources only through pre-approved AWS CloudFormation templates. When resources drift from their expected state, the security team needs automated monitoring.
- A. Allow users to deploy CloudFormation stacks only using a CloudFormation service role. Use CloudFormation drift detection to detect when resources deviate from their expected state.
- B. Allow users to deploy CloudFormation stacks only using a CloudFormation service role. Use AWS Config rules to detect when resources deviate from their expected state.
- C. Allow users to deploy CloudFormation stacks only using AWS Service Catalog. Enforce launch constraints. Use AWS Config rules to detect when resources deviate from their expected state.
- D. Allow users to deploy CloudFormation stacks only using AWS Service Catalog. Enforce template constraints. Use Amazon EventBridge notifications to detect when resources deviate from their expected state.
View question →
Q97. A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is used in the pipeline with a blue/green deployment model to deploy applications to Amazon Elastic Container Service (Amazon ECS). The company wants to implement script-based tests on the green version of the application before traffic is shifted. These scripts must complete within five minutes or less. If errors are found during these tests, the application should automatically roll back.
- A. Add a stage in the CodePipeline between the source and deploy stages. Use AWS CodeBuild to create a runtime environment and build commands in the buildspec file to invoke the test scripts. If an error is detected, use the aws deploy stop-deployment command to stop the deployment.
- B. Add a stage in the CodePipeline between the source and deploy stages. Use this stage to invoke an AWS Lambda function that runs the test scripts. If an error is detected, use the aws deploy stop-deployment command to stop the deployment.
- C. Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function to run the test scripts. If an error is detected, exit the Lambda function with an error status code to trigger rollback.
- D. Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTraffic lifecycle event to invoke the test scripts. If an error is detected, use the aws deploy stop-deployment CLI command to stop the deployment.
View question →
Q98. A DevOps administrator manages Amazon CloudWatch Logs log groups for the company. Company security policy states that employee IDs must not be visible in logs unless accessed by authorized personnel. Employee IDs follow the pattern Emp-XXXXXX, where each X is a digit. An audit reveals employee IDs appear in individual log files. These log files are accessible to engineers, but engineers must not view employee IDs. Engineers currently have AWS IAM Identity Center permissions allowing login to resources in the account.
- A. Create a new data protection policy on the log group. Add a custom data identifier Emp-\d{6}. Create an IAM policy denying the logs:Unmask permission on the resource. Attach the policy to the engineering account.
- B. Create a new data protection policy on the log group. Add a managed data identifier for Personal Data category. Create an IAM policy denying the logs:Unmask permission using NotAction on the resource. Attach the policy to the engineering account.
- C. Create an AWS Lambda function to parse log file entries, remove employee IDs, and write the results to a new log file. Create a Lambda subscription filter on the log group and select the Lambda function. Grant the log group lambda:InvokeFunction permission.
- D. Create an Amazon Data Firehose delivery stream with an Amazon S3 bucket as destination. Create a Firehose subscription filter on the log group using the Firehose delivery stream. Remove 'logs:*' permissions from the engineering account. Create an Amazon Macie job on the S3 bucket with the Emp-\d{6} custom identifier.
View question →
Q99. A company uses an HPC platform to run data analytics workloads. It uses AWS CodeBuild to create container images and stores them in Amazon Elastic Container Registry (Amazon ECR). These images are then deployed on Amazon Elastic Kubernetes Service (Amazon EKS). To maintain compliance, the company must ensure images are signed before deploying to Amazon EKS. Signing keys must be rotated regularly and managed automatically. The company also needs to track who generated the signature.
- A. Use CodeBuild to retrieve the image previously pushed to Amazon ECR. Use AWS Signer to sign the image. Use AWS CloudTrail to track the signer.
- B. Use AWS Lambda to retrieve the image previously pushed to Amazon ECR. Use the Lambda function to sign the image. Use Amazon CloudWatch to track the signer.
- C. Use AWS Lambda to retrieve the image previously pushed to Amazon ECR. Use AWS Signer to sign the image. Use Amazon CloudWatch to track the signer.
- D. Use CodeBuild to build the image. Sign the image using AWS Signer before pushing it to Amazon ECR. Use AWS CloudTrail to track the signer.
View question →
Q100. A company shares a single AWS account among multiple development teams. Development team managers want to automatically stop Amazon EC2 instances and receive notifications when resources are idle and not tagged as production resources.
- A. Use a scheduled Amazon CloudWatch Events rule to filter Amazon EC2 instance status checks and identify idle EC2 instances. Use the CloudWatch Events rule to target an AWS Lambda function to stop non-production instances and send notifications.
- B. Use a scheduled Amazon CloudWatch Events rule to filter AWS Systems Manager events and identify idle EC2 instances and resources. Use the CloudWatch Events rule to target an AWS Lambda function to stop non-production instances and send notifications.
- C. Use a scheduled Amazon CloudWatch Events rule to invoke a custom AWS Lambda function that runs AWS Trusted Advisor checks. Create a second CloudWatch Events rule to filter Trusted Advisor events to trigger a Lambda function to stop idle non-production instances and send notifications.
- D. Use a scheduled Amazon CloudWatch Events rule targeting Amazon Inspector events for idle EC2 instances. Use the CloudWatch Events rule to target an AWS Lambda function to stop non-production instances and send notifications.
View question →