AWS DOP-C02 Chapter 2 Practice Questions (100 Questions)

Practice questions for the AWS DOP-C02 (DevOps Engineer Professional) exam, Chapter 2.

1. Q1. A company wants to use AWS Systems Manager Documents to guide developers on physical laptops. The guidance program code is stored in GitHub. Developers and deployment engineers have already created a Systems Manager activation, installed the Systems Manager Agent and registration code, and installed an activation identity on the laptops.

   • A. Configure the Systems Manager document to use the aws:runShellScript command to copy files from GitHub to Amazon S3, then use the aws:downloadContent plugin with sourceType S3.
   • B. Configure the Systems Manager document to use the aws:configurePackage plugin with install action and point to the Git repository.
   • C. Configure the Systems Manager document to use the aws:downloadContent plugin with sourceType GitHub and provide repository details and source information.
   • D. Configure the Systems Manager document to use the aws:softwareInventory plugin and run scripts from the Git repository.

   View question →

2. Q2. A company is evaluating its disaster recovery capabilities and wants to fail over its daily operations to a secondary AWS Region. The company uses AWS CodeCommit as its source control tool in the primary Region. A DevOps engineer wants to enable developers to write code in the secondary Region. If the company needs to use the secondary Region, developers can add an additional remote URL in their local Git configuration.

   • A. Create a CodeCommit repository in the secondary Region. Create an AWS CodeBuild project to perform Git mirroring from the primary Region's CodeCommit repository to the secondary Region's CodeCommit repository. Create an AWS Lambda function that invokes the CodeBuild project. Create an Amazon EventBridge rule that responds to merge events in the primary Region's CodeCommit repository. Configure the EventBridge rule to invoke the Lambda function.
   • B. Create an Amazon S3 bucket in the secondary Region. Create an AWS Fargate task to perform Git mirroring from the primary Region's CodeCommit repository and copy results to the S3 bucket. Create an AWS Lambda function that launches the Fargate task. Create an Amazon EventBridge rule that responds to merge events in the CodeCommit repository. Configure the EventBridge rule to invoke the Lambda function.
   • C. Create an AWS CodeArtifact repository in the secondary Region. Create an AWS CodePipeline that uses the primary Region's CodeCommit repository for the source action. Add a cross-Region stage in the pipeline that packages the CodeCommit repository contents and stores them in the CodeArtifact repository upon pull request merge to the CodeCommit repository.
   • D. Create an AWS Cloud9 environment and a CodeCommit repository in the secondary Region. Configure the primary Region's CodeCommit repository as a remote repository in the AWS Cloud9 environment. Connect the secondary Region's CodeCommit repository to the AWS Cloud9 environment.

   View question →

3. Q3. A company runs an application behind an Application Load Balancer (ALB) on Amazon EC2 instances located across multiple Availability Zones. The application experienced an outage due to misconfiguration in a single Availability Zone.

   • A. Disable cross-zone load balancing on the ALB. Use Amazon Route 53 Application Recovery Controller to initiate regional failover from the affected Availability Zone.
   • B. Disable cross-zone load balancing on the ALB target group. Use Amazon Route 53 Application Recovery Controller to initiate regional failover from the affected Availability Zone.
   • C. Create an Amazon Route 53 Application Recovery Controller resource set using the ALB's DNS hostname. Initiate regional failover from the resource set starting from the affected Availability Zone.
   • D. Create an Amazon Route 53 Application Recovery Controller resource set using the ALB's target group ARN. Create a readiness check using the ELBv2 target health rule.

   View question →

4. Q4. A developer manages the company's Amazon Elastic Container Service (ECS) cluster. The cluster runs on several Amazon EC2 instances located in an Auto Scaling group. The developer wants to implement a solution that logs and reviews stopped tasks to identify errors.

   • A. Create an Amazon EventBridge rule to capture task state changes. Send events to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to investigate stopped tasks.
   • B. Configure tasks to write embedded metric format log data. Store these logs in Amazon CloudWatch Logs. Monitor container instance metrics for changes.
   • C. Configure EC2 instances to store logs in Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule using EC2 instance log data. Use the Contributor Insights rule to investigate stopped tasks.
   • D. Configure EC2 Auto Scaling lifecycle hooks for EC2_INSTANCE_TERMINATING scale events. Write system event log files to Amazon S3. Use Amazon Athena to query log files for errors.

   View question →

5. Q5. A highly regulated company has established a policy stating that DevOps engineers must not log in to Amazon EC2 instances unless an emergency occurs. If DevOps engineers do log in, the security team must be notified within 15 minutes of the event.

   • A. Install the Amazon Inspector agent on each EC2 instance. Subscribe to Amazon EventBridge notifications. Invoke an AWS Lambda function to check whether the message relates to a user login. If so, send a notification to the security team using Amazon SNS.
   • B. Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up CloudWatch metric filters to search for user login events. If a login is found, send a notification to the security team using Amazon SNS.
   • C. Configure AWS CloudTrail with Amazon CloudWatch Logs. Subscribe CloudWatch Logs to Amazon Kinesis. Attach an AWS Lambda function to Kinesis to parse and determine whether logs contain user login events. If so, send a notification to the security team using Amazon SNS.
   • D. Set up a script on each Amazon EC2 instance to push all logs to Amazon S3. Configure an S3 event to invoke an AWS Lambda function that runs an Amazon Athena query. The Athena query checks for logins and sends output to the security team using Amazon SNS.

   View question →

6. Q6. A company is building web and mobile applications powered by a serverless architecture using AWS Lambda and Amazon API Gateway. The company wants to fully automate backend Lambda deployments based on code pushed to appropriate environment branches in an AWS CodeCommit repository.

   • A. Configure a new AWS CodePipeline service. Create a separate CodeCommit repository for each environment. Configure CodePipeline to retrieve source code from the appropriate repository. Set up deployment steps to deploy Lambda functions using AWS CloudFormation.
   • B. Create two AWS CodePipeline configurations—one for test and one for production environments. Configure the production pipeline with a manual approval step. Create a separate CodeCommit repository for each environment. Configure each CodePipeline to retrieve source code from its respective repository. Set up deployment steps to deploy Lambda functions using AWS CloudFormation.
   • C. Create two AWS CodePipeline configurations—one for test and one for production environments. Configure the production pipeline with a manual approval step. Create a single CodeCommit repository with separate branches for each environment. Configure each CodePipeline to retrieve source code from the appropriate branch in the repository. Set up deployment steps to deploy Lambda functions using AWS CloudFormation.
   • D. Create AWS CodeBuild configurations for test and production environments. Configure the production pipeline with a manual approval step. Create a single CodeCommit repository with separate branches for each environment. Push Lambda function code to an Amazon S3 bucket. Set up deployment steps to deploy Lambda functions from the S3 bucket.

   View question →

7. Q7. A large company runs critical workloads across multiple AWS accounts. All accounts are managed under a single AWS Organization, and all organizational features are enabled. The company stores its customer data in Amazon S3 buckets. Access to these S3 buckets requires multi-layered authorization.

   • A. Create an AWS CloudTrail trail in each AWS account, delivering logs to Amazon CloudWatch Logs. Enable data event logging for all S3 buckets. Use Amazon GuardDuty across all AWS accounts to detect anomalies. Use Amazon Athena to run SQL queries against custom metrics derived from CloudTrail logs.
   • B. Create an AWS CloudTrail organization-level trail, delivering logs to Amazon CloudWatch Logs in the organization’s management account. Enable data event logging for all S3 buckets. Use Amazon GuardDuty anomaly detection across all AWS accounts. Use Amazon Athena to run SQL queries against custom metrics derived from CloudTrail logs.
   • C. Create an AWS CloudTrail organization-level trail, delivering logs to Amazon CloudWatch Logs in the organization’s management account. Enable data event logging for all S3 buckets. Use Amazon GuardDuty anomaly detection across all AWS accounts. Use Amazon CloudWatch Metrics to run SQL queries against custom metrics derived from CloudTrail logs.
   • D. Create an AWS CloudTrail trail in each AWS account, delivering logs to Amazon CloudWatch Logs. Enable data event logging for all S3 buckets. Use a custom solution to detect anomalies across all AWS accounts. Use Amazon CloudWatch Metrics to run SQL queries against custom metrics derived from CloudTrail logs.

   View question →

8. Q8. A company uses AWS Organizations to create a separate AWS account for each department. The company needs to automate the following tasks: regularly refresh patch updates on Linux AMIs and generate golden images; install new versions of the Chef agent in the golden images (as needed); and distribute newly generated golden images to departmental accounts.

   • A. Write a script that launches an Amazon EC2 instance from the previous golden AMI, applies patch updates, installs the new Chef agent version, generates a new golden AMI, and then modifies the AMI permissions to share the new image only with the department’s account.
   • B. Use Amazon EC2 Image Builder to create an image pipeline containing a base Linux AMI and components to install the Chef agent. Share the EC2 Image Builder image with departmental accounts using AWS Resource Access Manager.
   • C. Use AWS Systems Manager Automation runbooks to update the Linux AMI based on the previous image. Provide a URL to a script that updates the Chef agent. Use AWS Organizations to replace the previous golden image in departmental accounts.
   • D. Use Amazon EC2 Image Builder to create an image pipeline containing a base Linux AMI and components to install the Chef agent. Create a parameter in AWS Systems Manager Parameter Store to store the new AMI ID, which departmental accounts can reference.

   View question →

9. Q9. A company has deployed a new REST API using Amazon API Gateway. The company uses this API to access its data and requires that the API be accessible only from a specific VPC within the company.

   • A. Create and attach a resource policy to the API Gateway API. Configure the resource policy to allow requests only from the specified VPC ID.
   • B. Add a security group to the API Gateway API. Configure inbound rules to allow only IP address ranges from the specified VPC.
   • C. Create and attach an IAM role to the API Gateway API. Configure the IAM role to allow requests only from the specified VPC ID.
   • D. Add a network ACL to the API Gateway API. Configure outbound rules to allow only IP address ranges from the specified VPC.

   View question →

10. Q10. A company wants to establish a continuous delivery pipeline. The company stores application code in a private GitHub repository and needs to deploy application components to Amazon Elastic Container Service (Amazon ECS), Amazon EC2, and AWS Lambda. The pipeline must support manual approval actions.

    • A. Use AWS CodePipeline integrated with Amazon ECS, Amazon EC2, and AWS Lambda as deployment providers.
    • B. Use AWS CodePipeline with AWS CodeDeploy as the deployment provider.
    • C. Use AWS CodePipeline with AWS Elastic Beanstalk as the deployment provider.
    • D. Use AWS CodeDeploy integrated with GitHub to deploy the application.

    View question →

11. Q11. A company runs an application on Amazon EC2 instances in an Auto Scaling group. Recently, an issue prevented EC2 instances from launching successfully. The support team identified this problem. Whenever an EC2 instance fails to launch successfully, the support team wants to receive an email notification.

    • A. Add health checks to the Auto Scaling group to invoke an AWS Lambda function when instance health status becomes impaired.
    • B. Configure the Auto Scaling group to send notifications to an Amazon SNS topic when instance launch failures occur.
    • C. Create an Amazon CloudWatch alarm that invokes an AWS Lambda function when the AttachInstances Auto Scaling API call fails.
    • D. Create an Amazon EC2 status check alarm that sends a notification to an Amazon SNS topic when status checks fail.

    View question →

12. Q12. A development team uses AWS CodeCommit for application code version control and AWS CodePipeline to orchestrate software deployments. The team decided to use the remote main branch as the pipeline trigger for infrastructure-as-code changes. Developers pushed code changes to the CodeCommit repository but observed no pipeline response—even after 10 minutes. Which action should be taken to resolve this issue?

    • A. Verify whether an Amazon CloudWatch Events rule has been created for the main branch to trigger the pipeline.
    • B. Verify whether the CodePipeline service role has permissions to access the CodeCommit repository.
    • C. Verify whether the developers’ IAM roles have permissions to push to the CodeCommit repository.
    • D. Check whether the pipeline failed to start due to CodeCommit errors logged in Amazon CloudWatch Logs.

    View question →

13. Q13. A company uses multiple AWS accounts. The company uses AWS Toolkit for Microsoft Azure DevOps to integrate with AWS Single Sign-On (AWS SSO). Access control features are enabled in AWS SSO, and attribute mappings are configured. The department attribute is mapped to ${path:enterprise.department}, and the costCenter attribute is mapped to ${path:enterprise.costCenter}. All existing Amazon EC2 instances are tagged with a department tag corresponding to one of three company departments (d1, d2, d3). DevOps engineers want to create policies based on matching attributes. These policies must minimize administrative overhead and grant each Azure AD user access only to EC2 instances tagged with the department name matching their own department attribute. Which condition key should DevOps engineers include in a custom permissions policy to meet these requirements?

    • A. "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": ["department"] } }
    • B. "Condition": { "StringEquals": { "aws:PrincipalTag/department": "${aws:ResourceTag/department}" } }
    • C. "Condition": { "StringEquals": { "ec2:ResourceTag/department": "${aws:PrincipalTag/department}" } }
    • D. "Condition": { "ForAllValues:StringEquals": { "ec2:ResourceTag/department": ["d1", "d2", "d3"] } }

    View question →

14. Q14. A company uses a series of separate Amazon CloudFormation templates to deploy a multi-region application. These templates must be deployed in a specific order. The company is updating the templates more frequently than previously anticipated and wants to deploy new templates more efficiently. Additionally, the company wants to notify the data engineering team about template updates.

    • A. Create an AWS Lambda function to deploy CloudFormation templates in the required order. Use stack policies to alert the data engineering team.
    • B. Host CloudFormation templates in Amazon S3. Use Amazon S3 events to directly trigger CloudFormation updates and Amazon SNS notifications.
    • C. Implement CloudFormation StackSets and use drift detection to trigger update alerts for the data engineering team.
    • D. Use CloudFormation nested stacks and stack sets for deployment. Use Amazon SNS to notify the data engineering team.

    View question →

15. Q15. A company has selected AWS to host a new application and needs to implement a multi-account strategy. A DevOps engineer creates new AWS accounts and an organization in AWS Organizations. The DevOps engineer builds an organizational unit (OU) structure and uses AWS Control Tower to set up guardrails. The DevOps engineer must implement a solution that automatically deploys resources to new accounts created via the AWS Control Tower Account Factory. When a new account is created, the solution must automatically deploy AWS CloudFormation templates and service control policies (SCPs) scoped to the OU or account, attaching additional resources to the account. All OUs are automatically registered in AWS Control Tower.

    • A. Use AWS Service Catalog with AWS Control Tower. Create portfolios and products in AWS Service Catalog. Grant fine-grained permissions to provision these resources. Deploy SCPs using the AWS CLI and JSON documents.
    • B. Deploy CloudFormation stack sets with the required templates. Enable automatic deployment. Deploy stack instances to the required accounts. Deploy CloudFormation stack sets from the organization’s management account to deploy SCPs.
    • C. Create an Amazon EventBridge rule to detect CreateManagedAccount events. Configure AWS Service Catalog to deploy resources to any new account. Deploy SCPs using the AWS CLI and JSON documents.
    • D. Deploy the Customizations for AWS Control Tower (CfCT) solution. Use AWS CodeCommit as the source repository. In the repository, create a customization package containing CloudFormation templates and SCP JSON documents.

    View question →

16. Q16. A company uses a single AWS account to test an application on Amazon EC2 instances. The company has enabled AWS Config in the AWS account and activated the restricted-ssh AWS Config managed rule. The company requires an automated monitoring solution that sends a custom notification whenever any security group in the account violates the restricted-ssh rule. The custom notification must include the name and ID of the noncompliant security group. A DevOps engineer has created an Amazon Simple Notification Service (Amazon SNS) topic in the account and subscribed appropriate personnel to it. What should the DevOps engineer do next to meet these requirements?

    • A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches NON_COMPLIANT AWS Config evaluation results for the restricted-ssh rule. Configure an input transformer for the EventBridge (CloudWatch Events) rule. Configure the EventBridge (CloudWatch Events) rule to publish notifications to the SNS topic.
    • B. Configure AWS Config to send all evaluation results for the restricted-ssh rule to the SNS topic. Configure a filter policy on the SNS topic to deliver only notifications containing the text 'NON_COMPLIANT'.
    • C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches NON_COMPLIANT AWS Config evaluation results for the restricted-ssh rule. Configure the EventBridge (CloudWatch Events) rule to invoke AWS Systems Manager Run Command on the SNS topic to generate a custom notification and publish it to the SNS topic.
    • D. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches all NON_COMPLIANT AWS Config evaluation results. Configure an input transformer for the restricted-ssh rule. Configure the EventBridge (CloudWatch Events) rule to publish notifications to the SNS topic.

    View question →

17. Q17. A company wants to reduce the lead time required to develop new features. The company uses AWS CodeBuild and AWS CodeDeploy to build and deploy its application. The company uses AWS CodePipeline to deploy each microservice and maintain its own CI/CD pipelines. The company needs greater visibility into the average lead time from releasing a new feature to recovering after a deployment failure.

    • A. Schedule an AWS Lambda function that creates Amazon CloudWatch custom metrics containing information about each pipeline’s successful and failed runs. Create an Amazon EventBridge rule every 5 minutes to invoke the Lambda function. Build a CloudWatch dashboard using the metrics.
    • B. Schedule an AWS Lambda function that creates Amazon CloudWatch custom metrics containing information about each pipeline’s successful and failed runs. Create an Amazon EventBridge rule to invoke the Lambda function after each successful run and each failed run. Build a CloudWatch dashboard using the metrics.
    • C. Program an AWS Lambda function that writes information about successful and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule to invoke the Lambda function after each successful run and each failed run. Build an Amazon QuickSight dashboard displaying information from DynamoDB.
    • D. Develop an AWS Lambda function that writes information about successful and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule every 5 minutes to invoke the Lambda function. Build an Amazon QuickSight dashboard displaying information from DynamoDB.

    View question →

18. Q18. A company’s security policy requires using hardened AMIs in production environments. A DevOps engineer used EC2 Image Builder to create a pipeline for building AMIs on a recurring schedule. The DevOps engineer must update the company’s Auto Scaling group launch template. During Amazon EC2 instance launches, the Auto Scaling group must use the latest AMI.

    • A. Configure an Amazon EventBridge rule to receive new AMI events from Image Builder. Target an AWS Systems Manager Run Command document that updates the Auto Scaling group’s launch template with the latest AMI ID.
    • B. Configure an Amazon EventBridge rule to receive new AMI events from Image Builder. Target an AWS Lambda function that updates the Auto Scaling group’s launch template with the latest AMI ID.
    • C. Configure the launch template to use a value from AWS Systems Manager Parameter Store as the AMI ID. Configure the Image Builder pipeline to update the Parameter Store value with the latest AMI ID.
    • D. Configure the Image Builder distribution settings to update the launch template with the latest AMI ID. Configure the Auto Scaling group to use the latest version of the launch template.

    View question →

19. Q19. A company runs an application on Amazon EC2 instances in an Amazon EC2 Auto Scaling group. The EC2 instances are behind an Application Load Balancer (ALB). Users recently began experiencing errors when traffic was routed to certain EC2 instances. DevOps engineers found that the Auto Scaling group reported those problem instances as healthy, despite application-level errors. After resolving the issue, users confirmed normal behavior resumed on the affected instances. The company wants to ensure traffic routes only to instances that are both EC2-healthy and application-healthy. The company also wants the support team to receive notifications when traffic routing issues occur.

    • A. Configure the Auto Scaling group to use ELB health checks. Enable AWS Config. Create an AWS Config rule to ensure any new Auto Scaling groups use ELB health checks. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the support team of traffic routing configuration changes. Configure the AWS Config rule to send notifications to the topic.
    • B. Configure the Auto Scaling group to use EC2 health checks. Enable AWS Config. Create an AWS Config rule to ensure any new Auto Scaling groups use EC2 health checks. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the support team of traffic routing configuration changes. Configure the AWS Config rule to send notifications to the topic.
    • C. Configure the Auto Scaling group to use EC2 health checks. Create an Amazon CloudWatch Synthetics canary to monitor the application. Create a CloudWatch alarm that triggers when the CloudWatch Synthetics canary fails. Configure the alarm to notify the support team when in ALARM state.
    • D. Configure the Auto Scaling group to use ELB health checks. Create an Amazon CloudWatch Synthetics canary to monitor the application. Create a CloudWatch alarm that triggers when the CloudWatch Synthetics canary fails. Configure the alarm to notify the support team when in ALARM state.

    View question →

20. Q20. A company deploys an application across multiple AWS Regions. The application creates and stores artifacts in an Amazon S3 bucket located in the same Region as the application. All deployments of the application require access to artifacts and associated metadata from every Region. The company has configured bidirectional replication between S3 buckets and enabled S3 Replication Metrics on each bucket. If an object fails to replicate, developers must implement a solution that retries the replication process.

    • A. Create an Amazon EventBridge rule to listen for S3 event notifications of failed replication events. Create an AWS Lambda function that downloads the failed replication object and then runs the aws s3 cp command to the destination bucket. Configure the EventBridge rule to invoke the Lambda function to handle unrepliable objects.
    • B. Create an Amazon Simple Queue Service (SQS) queue. Configure S3 event notifications to send failed replication notifications to the SQS queue. Create an AWS Lambda function that downloads the failed replication object and then runs the aws s3 cp command to the destination bucket. Configure the Lambda function to poll the queue to process notifications.
    • C. Create an Amazon EventBridge rule that listens for S3 event notifications of failed replication. Create an AWS Lambda function that downloads the failed replication object and then runs the aws s3 cp command to the destination bucket.
    • D. Use S3 Batch Operations to retry replication on existing objects that failed. Configure S3 event notifications to send failed replication notifications to a Lambda function.

    View question →

21. Q21. A company uses AWS Organizations and AWS Control Tower to manage its AWS accounts. The company has an Enterprise Support plan. A DevOps engineer is using Terraform Account Factory for AWS (AFT) to provision new accounts. During provisioning, the DevOps engineer notices that the new accounts are configured with the Basic Support plan. The DevOps engineer needs to implement a solution to provide the Enterprise Support plan to new accounts. Which solution meets these requirements?

    • A. Use AWS Config conformance packs to deploy account-level AWS Config rules and automatically remediate any noncompliant accounts.
    • B. Create an AWS Lambda function that creates a support case with AWS Support to add the customer to the Enterprise Support plan. Grant the Lambda function the Support:ResolveCase permission.
    • C. Add an additional value to the control_tower_parameters input to set the AWSEnterpriseSupport parameter on the organization’s management account.
    • D. Set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration. Redeploy AFT and apply the changes.

    View question →

22. Q22. A company recently migrated a legacy application from on-premises to AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer, which is itself behind Amazon API Gateway. The company wants to minimize disruption to users during deployment of new application versions. The company also wants to ensure rapid rollback if issues arise. Which solution satisfies these requirements with minimal changes to the application?

    • A. Introduce the change as a separate, parallel environment alongside the existing environment. Configure API Gateway to use canary deployment to route a small percentage of user traffic to the new environment.
    • B. Introduce the change as a separate, parallel environment alongside the existing environment. Update the application’s DNS alias record to point to the new environment.
    • C. Introduce the change as a separate target group behind the existing Application Load Balancer. Configure API Gateway to gradually route user traffic to the new target group.
    • D. Introduce the change as a separate target group behind the existing Application Load Balancer. Configure API Gateway to route all traffic to the Application Load Balancer, which then forwards traffic to the new target group.

    View question →

23. Q23. A company running many workloads on AWS observes increasing Amazon EBS costs over time. The DevOps team notices many unattached EBS volumes. Although some unattached volumes are associated with active workloads, volumes older than 14 days are confirmed idle and no longer needed. A DevOps engineer must create automation to delete unattached EBS volumes that have been unattached for 14 days.

    • A. Use AWS Config with a configuration change trigger type and the EC2 volume resource type, and configure the managed rule `ec2-volume-inuse-check`. Create a new Amazon CloudWatch Events rule scheduled to run an AWS Lambda function every 14 days to delete specified EBS volumes.
    • B. Configure a volume lifecycle policy using Amazon EC2 and Amazon Data Lifecycle Manager. Set the interval for unattached EBS volumes to 14 days and the retention rule to delete. Set the policy target volumes to *.
    • C. Create an Amazon CloudWatch Events rule to run an AWS Lambda function daily. The Lambda function should locate unattached EBS volumes, tag them with the current date, and delete unattached volumes whose tag date is older than 14 days.
    • D. Use AWS Trusted Advisor to detect EBS volumes detached for more than 14 days. Execute an AWS Lambda function to create snapshots, then delete the EBS volumes.

    View question →

24. Q24. A company uses AWS CodeDeploy to automate deployments of a Java-Apache Tomcat application running on Apache web servers. The development team begins with a proof-of-concept, creating a deployment group for the development environment and performing functional tests in that environment. After successful validation, the team will create additional deployment groups for staging and production. Currently, log levels are configured in Apache settings, but the team wants to dynamically adjust this configuration during deployment so they can set different log levels per deployment group without requiring separate application revisions for each group. How can these requirements be met with minimal administrative overhead and without using different script versions per deployment group?

    • A. Tag Amazon EC2 instances by deployment group. Then embed a script in the application revision that calls the metadata service and EC2 API to identify which deployment group the instance belongs to. Use this information to configure the log level setting. Reference the script in the appspec.yml file as part of the AfterInstall lifecycle hook.
    • B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_NAME to identify which deployment group the instance belongs to. Use this information to configure the log level setting. Reference this script in the appspec.yml file as part of the BeforeInstall lifecycle hook.
    • C. Create a CodeDeploy custom environment variable for each environment. Embed a script in the application revision that checks this environment variable to determine which deployment group the instance belongs to. Use this information to configure the log level setting. Reference this script in the appspec.yml file as part of the ValidateService lifecycle hook.
    • D. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance belongs to, to configure the log level setting. Reference this script in the appspec.yml file as part of the Install lifecycle hook.

    View question →

25. Q25. A company sells products through an e-commerce web application. The company wants a dashboard displaying a pie chart of product transaction details. The company wants to integrate this dashboard with its existing Amazon CloudWatch dashboards.

    • A. Update the e-commerce application to emit a JSON object to a CloudWatch Logs log group for each processed transaction. Use CloudWatch Logs Insights to query the log group and display results in pie chart format. Attach the results to the desired CloudWatch dashboard.
    • B. Update the e-commerce application to emit a JSON object to an Amazon S3 bucket for each processed transaction. Use Amazon Athena to query the S3 bucket and display results in pie chart format. Export results from Athena and attach them to the desired CloudWatch dashboard.
    • C. Update the e-commerce application to be instrumented with AWS X-Ray. Create a new X-Ray segment. Add annotations for each processed transaction. Use X-Ray traces to query the data and display results in pie chart format. Attach the results to the desired CloudWatch dashboard.
    • D. Update the e-commerce application to emit a JSON object to a CloudWatch Logs log group for each processed transaction. Create an AWS Lambda function to aggregate and write results to Amazon DynamoDB. Create a Lambda subscription filter for the log group. Attach the results to the desired CloudWatch dashboard.

    View question →

26. Q26. A company developed an AWS Lambda function to process orders received via an API. The company uses AWS CodeDeploy to deploy the Lambda function as the final stage of its CI/CD pipeline. A DevOps engineer notices intermittent failures in the order API within seconds after deployment. After investigation, the DevOps engineer determines the failures occur because database schema changes have not yet propagated fully before the Lambda function is invoked.

    • A. Add a BeforeAllowTraffic hook to the AppSpec file that tests and waits for any required database changes before traffic is routed to the new version of the Lambda function.
    • B. Add an AfterAllowTraffic hook to the AppSpec file that forces traffic to wait for pending database changes before allowing the new version of the Lambda function to respond.
    • C. Add a BeforeInstall hook to the AppSpec file that tests and waits for any required database changes before deploying the new version of the Lambda function.
    • D. Add a ValidateService hook to the AppSpec file that inspects incoming traffic and rejects payloads when dependent services (e.g., database) are not ready.

    View question →

27. Q27. A developer maintains a fleet of 50 Amazon EC2 Linux servers. These servers are part of an Amazon EC2 Auto Scaling group and use Elastic Load Balancing for load distribution. Occasionally, some application servers are terminated after failing ELB HTTP health checks. The developer wants to perform root cause analysis but cannot access application logs before the servers terminate.

    • A. Use an Auto Scaling lifecycle hook to place the instance in Pending:Wait state. Create an Amazon CloudWatch alarm for EC2 Instance Terminate Successful and trigger an AWS Lambda function to invoke SSM Run Command to collect logs, push them to Amazon S3, and complete the lifecycle action after collection.
    • B. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an AWS Config rule for EC2 instance termination lifecycle operations and trigger a Step Functions workflow that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action after collection.
    • C. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an Amazon CloudWatch subscription filter for EC2 Instance Terminate Successful and trigger the CloudWatch agent to run a script that collects logs, pushes them to Amazon S3, and completes the lifecycle action after collection.
    • D. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an Amazon EventBridge rule for EC2 instance termination lifecycle operations and trigger an AWS Lambda function to invoke SSM Run Command to collect logs, push them to Amazon S3, and complete the lifecycle action after collection.

    View question →

28. Q28. A company builds container images in an AWS CodeBuild project by running Docker commands. After building the container image, the CodeBuild project uploads the image to an Amazon S3 bucket. The CodeBuild project uses an IAM service role with permissions to access the S3 bucket. A DevOps engineer needs to replace the S3 bucket with an Amazon Elastic Container Registry (Amazon ECR) repository to store container images. The DevOps engineer creates a private ECR image repository in the same AWS Region as the CodeBuild project. The DevOps engineer updates the IAM service role with permissions required to use the new ECR repository. The DevOps engineer also updates the `buildspec.yml` file to use the new ECR repository in the `docker build` and `docker push` commands. When the CodeBuild project runs a build job, the job fails when attempting to access the ECR repository.

    • A. Update the `buildspec.yml` file to use the `aws ecr get-login-password` AWS CLI command to authenticate to the ECR repository and retrieve an authentication token. Update the `docker login` command to use this token to access the ECR repository.
    • B. Add an environment variable of type SECRETS_MANAGER to the CodeBuild project. Include the ARN of the CodeBuild project’s IAM service role in the environment variable. Update the `buildspec.yml` file to use the new environment variable with the `docker login` command to access the ECR repository.
    • C. Update the ECR repository to be a public image repository. Add an ECR repository policy that grants access to the IAM service role.
    • D. Update the `buildspec.yml` file to use the AWS CLI to assume the IAM service role for ECR operations. Add an ECR repository policy that grants access to the IAM service role.

    View question →

29. Q29. A company uses an AWS CodeArtifact repository to store Python packages developed internally. A DevOps engineer needs to use AWS CodeDeploy to deploy an application to Amazon EC2 instances. The application depends on Python packages stored in the CodeArtifact repository. The BeforeInstall lifecycle event hook will install the package. The DevOps engineer needs to grant the EC2 instances permissions to access the CodeArtifact repository. Which solution meets this requirement?

    • A. Create a service-linked role for CodeArtifact and associate the role with the EC2 instances. Use the aws codeartifact get-authorization-token CLI command on the instances.
    • B. Configure a resource-based policy on the CodeArtifact repository to allow the EC2 instance principal to perform the ReadFromRepository action.
    • C. Configure an ACL on the CodeArtifact repository to allow EC2 instances to access the Python packages.
    • D. Create an instance profile containing an IAM role with permissions to access CodeArtifact. Associate the instance profile with the EC2 instances. Use the aws codeartifact login CLI command on the instances.

    View question →

30. Q30. A company uses AWS Storage Gateway in file gateway mode across multiple resources with Amazon S3 buckets. At the start of business each morning, users cannot see objects processed overnight by a third party. When a DevOps engineer directly inspects the S3 buckets, the data is present, but it is missing in Storage Gateway. Which solution ensures updated third-party files are available each morning?

    • A. Configure an Amazon EventBridge rule to run nightly and invoke an AWS Lambda function to execute the RefreshCache command on Storage Gateway.
    • B. Instruct the third party to use AWS Transfer for SFTP to place data into the S3 buckets.
    • C. Modify Storage Gateway to run in volume gateway mode.
    • D. Use S3 Same-Region Replication to replicate any changes made directly to the S3 bucket into Storage Gateway.

    View question →

31. Q31. A company is divided into teams. Each team has its own AWS account, and all accounts reside within an organization in AWS Organizations. Each team requires full security administrative privileges over its AWS account. Additionally, each team must be restricted to only approved AWS services. AWS services are granted access through a formal request and approval process. How should a DevOps engineer configure the accounts to meet these requirements?

    • A. Use AWS CloudFormation StackSets to deploy IAM policies in each account denying access to restricted AWS services. In each account, configure AWS Config rules to ensure those policies are attached to IAM principals.
    • B. Use AWS Control Tower to provision accounts into OUs within the organization. Configure AWS Control Tower to enable AWS IAM Identity Center (AWS SSO). Configure IAM Identity Center to provide administrative access, including deny policies for restricted AWS services in user roles.
    • C. Place all accounts under a new top-level OU within the organization. Create a Service Control Policy (SCP) denying access to restricted AWS services and attach it to the OU.
    • D. Create an SCP that allows access only to approved AWS services. Attach the SCP to the organization’s root OU. Remove the FullAWSAccess SCP from the organization’s root OU.

    View question →

32. Q32. A company uses AWS WAF to protect its cloud infrastructure. A DevOps engineer needs to enable the operations team to analyze log messages from AWS WAF. The operations team also needs to create alerts for specific patterns in the log output. Which solution meets these requirements with minimal operational overhead?

    • A. Create an Amazon CloudWatch Logs log group. Configure the appropriate AWS WAF web ACL to send logs to the log group. Guide the operations team to create CloudWatch metric filters.
    • B. Create an Amazon OpenSearch Service cluster and appropriate index. Configure an Amazon Kinesis Data Firehose delivery stream to deliver log data to the index. Use OpenSearch Dashboards to create filters and widgets.
    • C. Create an Amazon S3 bucket for log output. Configure AWS WAF to send log output to the S3 bucket. Instruct the operations team to create an AWS Lambda function to detect each required log pattern. Configure the Lambda function to publish to an Amazon Simple Notification Service (Amazon SNS) topic.
    • D. Create an Amazon S3 bucket for log output. Configure AWS WAF to send log output to the S3 bucket. Use Amazon Athena to create an external table definition matching the log message pattern. Guide the operations team to write SQL queries and create Amazon CloudWatch metric filters for Athena queries.

    View question →

33. Q33. A company deploys a critical application across an entire AWS Region. The application uses an Application Load Balancer (ALB) in each Availability Zone. The company configures Amazon Route 53 latency-based DNS records for each ALB. The company uses Amazon Route 53 Application Recovery Controller (ARC) to ensure the application can fail over across Regions. The Route 53 ARC configuration includes routing controls for each Region. The company performs quarterly disaster recovery (DR) tests using Route 53 ARC. During the most recent DR test, a DevOps engineer accidentally disabled all routing controls. The company needs to ensure that at least one routing control remains enabled at all times. Which solution meets this requirement?

    • A. In Route 53 ARC, create a new assertion safety rule. Apply the assertion safety rule to both routing controls. Configure the rule with type AT_LEAST and threshold value 1.
    • B. In Route 53 ARC, create a new gating safety rule. Apply the gating safety rule to both routing controls. Configure the rule with type OR and threshold value 1.
    • C. In Route 53 ARC, create a new resource set. Configure the resource set with resource type AWS::Route53::HealthCheck. Specify the ARNs of both routing controls as target resources. Create a new readiness check for the resource set.
    • D. In Route 53 ARC, create a new resource set. Configure the resource set with resource type AWS::Route53RecoveryReadiness::DNSTargetResource. Add the domain names of the two Route 53 alias DNS records as target resources. Create a new readiness check for the resource set.

    View question →

34. Q34. A company has multiple development groups working in a shared AWS account. When resource creation approaches account service quotas, senior managers want to receive alerts via a third-party API. Which solution accomplishes this task with minimal development effort?

    • A. Create an Amazon CloudWatch Events rule that runs on a schedule and targets an AWS Lambda function. In the Lambda function, evaluate the current AWS environment state and compare deployed resource counts against account quotas. Notify senior managers if the account is approaching service limits.
    • B. Deploy an AWS Lambda function that refreshes AWS Trusted Advisor checks, and configure an Amazon CloudWatch Events rule to run the Lambda function on a schedule. Create another CloudWatch Events rule with an event pattern matching Trusted Advisor events and the same Lambda function as target. In the target Lambda function, notify senior managers.
    • C. Deploy an AWS Lambda function that refreshes AWS Personal Health Dashboard checks, and configure an Amazon CloudWatch Events rule to run the Lambda function on a schedule. Create another CloudWatch Events rule with an event pattern matching Personal Health Dashboard events and the same Lambda function as target. In the target Lambda function, notify senior managers.
    • D. Add a scheduled AWS Config custom rule to check AWS service quota status and stream notifications to an Amazon SNS topic. Deploy an AWS Lambda function to notify senior managers and subscribe the Lambda function to the SNS topic.

    View question →

35. Q35. A company hosts a web application in an AWS Region. For disaster recovery purposes, a second Region is designated as a standby region. Disaster recovery requirements specify that data must be replicated nearly in real time across Regions, and 1% of requests must be routed to the secondary Region to continuously validate system functionality. Additionally, if the primary Region experiences service interruption, traffic must automatically fail over to the secondary Region, and the secondary Region must scale to handle the full traffic load. How should a DevOps engineer meet these requirements?

    • A. Deploy the application on AWS Elastic Beanstalk in both Regions and use Amazon DynamoDB Global Tables to store session data. Use Amazon Route 53 weighted routing policy with health checks to distribute traffic across Regions.
    • B. Launch the application in Auto Scaling groups in both Regions and use DynamoDB to retrieve session data. Use Route 53 failover routing policy with health checks to distribute traffic across Regions.
    • C. Deploy the application in AWS Lambda, exposed by Amazon API Gateway, in both Regions, and use Amazon RDS for PostgreSQL with cross-Region replication for session data. Deploy the web application with client-side logic to call API Gateway directly.
    • D. Launch the application in Auto Scaling groups in both Regions and use DynamoDB Global Tables for session data. Enable Amazon CloudFront weighted distribution across Regions. Point the Amazon Route 53 DNS record to the CloudFront distribution.

    View question →

36. Q36. A company is developing infrastructure for a web application using cloud-native architecture. The database engineering team maintains database resources in CloudFormation templates, and the software development team maintains web application resources in separate CloudFormation templates. As the application evolves, the software development team needs to consume resources maintained by the database engineering team. Both teams have independent review and lifecycle management processes they wish to preserve. Both teams also require resource-level change tracking. The software development team wants to use its CI/CD pipeline to deploy updates to its template. Which solution meets these requirements?

    • A. Create stack exports from the database CloudFormation template and import those references into the web application CloudFormation template.
    • B. Create a CloudFormation nested stack to make cross-stack resource references and parameters available across both stacks.
    • C. Create a CloudFormation stack set to make cross-stack resource references and parameters available across both stacks.
    • D. Define input parameters in the web application CloudFormation template and pass resource names and IDs from the database stack.

    View question →

37. Q37. A company uses AWS CloudFormation stacks to deploy and update applications. The stack consists of various resources, including an AWS Auto Scaling group, Amazon EC2 instances, an Application Load Balancer (ALB), and other resources required to launch and maintain the independent stack. No changes to application resources outside of CloudFormation stack updates are permitted. Recently, the company attempted to update the application stack using the AWS CLI. The stack update failed and returned the following error message: "Error: Deployment and CloudFormation stack rollback both failed. Deployment failed because the following resource failed to update: [AutoScalingGroup]." The stack remains in the UPDATE_ROLLBACK_FAILED state. Which solution resolves this issue?

    • A. Update the subnet mappings configured for the ALBs. Run the AWS cloudformation update-stack-set AWS CLI command.
    • B. Update the IAM role by providing the permissions required to update the stack. Run the AWS cloudformation continue-update-rollback AWS CLI command.
    • C. Submit a quota increase request for the number of EC2 instances in the account. Run the AWS cloudformation cancel-update-stack AWS CLI command.
    • D. Delete the Auto Scaling group resource. Run the AWS cloudformation rollback-stack AWS CLI command.

    View question →

38. Q38. A company operates a data ingestion application across multiple AWS accounts within an AWS Organization. The company needs to monitor the application and consolidate access to it. Currently, the application runs on Amazon EC2 instances in an Auto Scaling group. The EC2 instances cannot access the internet because the data is sensitive. Engineers have deployed necessary VPC endpoints. The EC2 instances run a custom AMI built specifically for the application. For maintenance and troubleshooting, system administrators need to log in to the EC2 instances. This access must be automated and centrally controlled. Each time an instance is accessed, the company’s security team must receive a notification.

    • A. Create an Amazon EventBridge rule to notify the security team when a user logs into an EC2 instance. Use EC2 Instance Connect to log in to the instance. Deploy the Auto Scaling group using AWS CloudFormation. Use the cfn-init helper script to deploy appropriate VPC routing for external access. Rebuild the custom AMI to include the AWS Systems Manager Agent.
    • B. Deploy a NAT gateway and a bastion host with internet access. Create a security group allowing inbound traffic from the bastion host to all EC2 instances. Install the AWS Systems Manager Agent on all EC2 instances. Use Auto Scaling group lifecycle hooks to monitor and audit access. Log in to instances using Systems Manager Session Manager. Send logs to an Amazon CloudWatch Logs log group. Export data to Amazon S3 for auditing. Use S3 event notifications to alert the security team.
    • C. Rebuild the custom AMI using EC2 Image Builder. Include the latest version of the AWS Systems Manager Agent in the image. Configure the Auto Scaling group to attach the AmazonSSMManagedInstanceCore IAM role to all EC2 instances. Use Systems Manager Session Manager to log in to instances. Log session details to Amazon S3. Create S3 event notifications for new file uploads to send messages to the security team via an Amazon Simple Notification Service (Amazon SNS) topic.
    • D. Use AWS Systems Manager Automation to build the Systems Manager Agent into the custom AMI. Configure AWS Config to attach a Service Control Policy (SCP) to the root organizational unit to allow EC2 instances to connect to Systems Manager. Use Systems Manager Session Manager to log in to instances. Log session details to Amazon S3. Create S3 event notifications for new file uploads to send messages to the security team via an Amazon SNS topic.

    View question →

39. Q39. A development team recently expanded, increasing the number of projects hosted in separate code repositories. Current processes involve manually configuring AWS CodePipeline. A service limit alert has been triggered regarding the number of existing Amazon S3 buckets.

    • A. Merge multiple independent code repositories into one and deploy using a single AWS CodePipeline with project-specific logic.
    • B. Use the AWS API or AWS CLI to create new pipelines and configure them to use a single S3 bucket, with each project assigned a unique prefix.
    • C. Create a new pipeline in a different Region for each project to bypass the S3 bucket service limit in a single Region.
    • D. Use the AWS API or AWS CLI to bypass the S3 bucket service limit per account and create a new pipeline and S3 bucket for each project.

    View question →

40. Q40. A company operates an application that monitors customer activity on its website and mobile app. The application uses Amazon ElastiCache for Redis as a write-through cache and Amazon RDS for PostgreSQL for longer-term storage. When the application receives requests to record customer actions, it writes synchronously to both the Redis cluster and the database. The recommendation application uses this data to generate content recommendations for each customer. During peak hours, the recommendation application fails to generate recommendations due to stale or missing data. The Redis cache is configured without cluster mode enabled, and the database is configured with a single read replica. The company wants to ensure the recommendation application can generate content recommendations during peak hours. A DevOps engineer has already created a new ElastiCache cluster with cluster mode enabled.

    • A. Create a target tracking scaling policy for the ElastiCachePrimaryEngineCPUUtilization metric of the Redis cluster. Configure the scaling policy to add and remove shards from the Redis cluster. Update the recommendation application to use the cluster configuration endpoint to access Redis.
    • B. Create a target tracking scaling policy for the ElastiCachePrimaryEngineCPUUtilization metric of the Redis cluster. Configure the scaling policy to add and remove shards from the Redis cluster. Update the recommendation application to use the cluster’s read replica endpoint to access Redis.
    • C. Create a scheduled scaling policy for the ElastiCachePrimaryEngineCPUUtilization metric of the Redis cluster. Configure the scaling policy to add read replicas to the Redis cluster. Update the recommendation application to use the cluster configuration endpoint to access Redis.
    • D. Create a scheduled scaling policy for the ElastiCachePrimaryEngineCPUUtilization metric of the Redis cluster. Configure the scaling policy to add read replicas to the Redis cluster. Update the recommendation application to use the database’s read replica endpoint instead of Redis.

    View question →

41. Q41. A DevOps engineer uses an AWS CloudFormation custom resource to set up an AD Connector. An AWS Lambda function runs and creates the AD Connector, but CloudFormation does not transition from CREATE_IN_PROGRESS to CREATE_COMPLETE.

    • A. Ensure the Lambda function code exits successfully.
    • B. Ensure the Lambda function code returns a response containing a presigned URL.
    • C. Ensure the Lambda function’s IAM role has the cloudformation:UpdateStack permission for the stack ARN.
    • D. Ensure the Lambda function’s IAM role has the ds:ConnectDirectory permission for the AWS account.

    View question →

42. Q42. A company runs an application on Amazon EC2 instances in an Auto Scaling group. When the application starts, it must first process data from an Amazon S3 bucket before it can begin serving requests. The data in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before it can serve requests. The company wants to reduce the time new EC2 instances take to become ready to serve requests.

    • A. Configure a warm pool for the Auto Scaling group where warm EC2 instances are in a stopped state. Configure an Autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when it is ready to serve requests.
    • B. Increase the maximum number of instances in the Auto Scaling group. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when it is ready to serve requests.
    • C. Configure a warm pool for the Auto Scaling group where warm EC2 instances are in a running state. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when it is ready to serve requests.
    • D. Increase the maximum number of instances in the Auto Scaling group. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook and place the new instance in Standby state when it is ready to serve requests.

    View question →

43. Q43. A cloud team manages a company’s AWS accounts using AWS Organizations and AWS Identity Center (formerly AWS Single Sign-On). The company recently formed a research team. The research team needs delegated administrative access to resources in a dedicated AWS account. The research team must not be allowed to create IAM users. The cloud team created a Research Administrator permission set in IAM Identity Center and attached the AdministratorAccess AWS managed policy. The cloud team wants to ensure no one in the research team can create IAM users.

    • A. Create an IAM policy denying the iam:CreateUser action and attach it to the Research Administrator permission set.
    • B. Create an IAM policy allowing all actions except iam:CreateUser and use it as a permissions boundary for the Research Administrator permission set.
    • C. Create a Service Control Policy (SCP) denying iam:CreateUser and attach it to the research team’s AWS account.
    • D. Develop an AWS Lambda function that deletes IAM users. Create an Amazon EventBridge rule to detect iam:CreateUser events and configure it to invoke the Lambda function.

    View question →

44. Q44. A company grants external customers access to its AWS account by creating an IAM user for each external customer. A DevOps engineer wants to implement a solution to revoke access for IAM users who have not accessed the account for 90 days.

    • A. Enable AWS Config in the AWS account. Deploy the iam-user-unused-credentials-check AWS Config managed rule to run periodically. Configure automatic remediation to run the AWSConfigRemediation-RevokeUnusedIAMUserCredentials AWS Systems Manager Automation runbook.
    • B. Create an IAM Access Analyzer in the AWS account. Create an Amazon EventBridge rule matching IAM user access analyzer events indicating last access occurred over 90 days ago. Configure the rule to run the AWSConfigRemediation-DetachIAMPolicy AWS Systems Manager Automation runbook to detach any policies attached to the IAM user.
    • C. Enable AWS Trusted Advisor in the AWS account. Use the AWS Developer Support plan to access the AWS Support API. Configure an Amazon EventBridge scheduled rule to use the Trusted Advisor IAM access key rotation check to identify IAM credentials unused for over 90 days. Configure another EventBridge rule using the Trusted Advisor Check Item Refresh Status event type and run the AWSConfigRemediation-RevokeUnusedIAMUserCredentials AWS Systems Manager Automation runbook.
    • D. Enable AWS Security Hub in the AWS account. Configure a Security Hub rule to determine the last time an IAM user was accessed. Configure an Amazon EventBridge rule to match the Security Hub rule and run the AWSConfigRemediation-RevokeUnusedIAMUserCredentials AWS Systems Manager Automation runbook.

    View question →

45. Q45. A DevOps engineer manages a legacy web application running on Amazon EC2. The application uses Amazon Kinesis Data Streams to ingest and process web logs. The DevOps engineer also manages a Kinesis consumer application running on Amazon EC2. A sudden surge in data volume causes the Kinesis consumer application to fall behind, and Kinesis data is discarded before it can be processed. The DevOps engineer wants to implement a solution to scale processing capacity. Which solution meets these requirements with the highest operational efficiency?

    • A. Modify the Kinesis consumer application to persist logs in Amazon S3. Use Amazon EMR to process the data directly in Amazon S3 for customer insights. Store results in Amazon S3.
    • B. Horizontally scale the Kinesis consumer application by adding more EC2 instances based on the Amazon CloudWatch GetRecords.IteratorAgeMilliseconds metric. Increase the retention period of the Kinesis Data Stream.
    • C. Refactor the Kinesis consumer application to run as an AWS Lambda function. Configure the Kinesis Data Stream as an event source for the Lambda function to process the data stream.
    • D. Increase the number of shards in the Kinesis Data Stream to improve overall throughput so the consumer application can process data faster.

    View question →

46. Q46. A company is using AWS Database Migration Service (AWS DMS) to replicate data from an on-premises source database to a target Amazon Aurora PostgreSQL database. The company created a DMS replication task with change data capture (CDC). Replication experiences unplanned interruptions that impact critical functionality. The company wants to improve replication resilience and receive notifications about such interruptions. Which solution meets these requirements with the least operational overhead?

    • A. Use AWS DataSync to copy data from the source database to Amazon S3. Configure an AWS Lambda function to copy data from S3 to the target database. Configure Amazon CloudWatch alarms to monitor Lambda errors and throttling. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notifications.
    • B. Create Amazon CloudWatch alarms to monitor DMS replication task metrics and host metrics. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notifications and invoke an AWS Lambda function to provision a standby DMS replication instance in a different AWS Region.
    • C. Create Amazon CloudWatch alarms to monitor DMS replication task metrics and host metrics. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notifications. After receiving notification, configure a new DMS replication task in the same AWS Region.
    • D. Modify the DMS replication instance to enable Multi-AZ support. Create Amazon CloudWatch alarms to monitor DMS replication task metrics and host metrics. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notifications.

    View question →

47. Q47. A DevOps engineer is using AWS CodePipeline to deploy an AWS Service Catalog portfolio. The pipeline must create products and templates from manifest files in JSON or YAML format and enforce security requirements on AWS Service Catalog products managed through the pipeline. Which solution automates fulfillment of these requirements?

    • A. Use the AWS Service Catalog deployment action in AWS CodeDeploy, pushing new product versions to AWS Service Catalog via validation steps in the CodeDeploy AppSpec file.
    • B. Use the AWS Service Catalog deployment action in AWS CodeBuild to validate new product versions and push them to AWS Service Catalog.
    • C. Use an AWS Lambda action in CodePipeline to run a Lambda function that validates new product versions and pushes them to AWS Service Catalog.
    • D. Use an AWS Lambda action in AWS CodeBuild to run a Lambda function that validates new product versions and pushes them to AWS Service Catalog.

    View question →

48. Q48. A company wants to use AWS Systems Manager documents to bootstrap physical laptops for developers. The bootstrap program code is stored in GitHub. A DevOps engineer has already created a Systems Manager activation, installed the Systems Manager Agent on the laptops, and registered the activation ID. What set of steps should be taken next?

    • A. Configure the Systems Manager document to use the AWS-RunShellScript command to copy files from GitHub to Amazon S3, then use the aws-downloadContent plugin with sourceType set to S3.
    • B. Configure the Systems Manager document to use the aws-configurePackage plugin with an install action pointing to the Git repository.
    • C. Configure the Systems Manager document to use the aws-downloadContent plugin with sourceType set to GitHub and SourceInfo containing repository details.
    • D. Configure the Systems Manager document to use the aws:softwareInventory plugin and run scripts from the Git repository.

    View question →

49. Q49. A company’s organization is structured under a single organizational unit (OU) governed by enterprise security policies. The company runs Amazon EC2 instances in OU accounts. It needs to restrict credential usage so that credentials assigned to a specific EC2 instance can only be used on that instance. Architects want to configure security for the EC2 instances. Which solution meets these requirements?

    • A. Create a service control policy (SCP) specifying a VPC CIDR block. Configure the SCP to check whether the aws:Vpc31-slp condition key falls within the specified block. In the same SCP statement, check whether aws:EC2--------------- ----------------------------------------------------------------- If both conditions evaluate to false, deny access. Apply the SCP to the OU.
    • B. Create an SCP that checks whether the values of the aws:EC2即决-cevpc and aws:SourceVpc condition keys match. Deny access if they differ. In the same SCP statement, check whether the value of aws:EC2快捷来源 matches the aws:Vpc31-ceip condition key. Deny access if they differ. Apply the SCP to the OU.
    • C. Create an SCP containing an allowed list of VPC values and verify whether the aws:SourceVpc condition key value is in that list. In the same SCP statement, define an allowed list of IP address values and verify whether the aws:Vpc31-ceip condition key is in that list. Deny access if both conditions evaluate to false. Apply the SCP to each account in the organization.
    • D. Create an SCP that checks whether the aws:EC2即时程序 and aws:Vpc31-ceip condition keys match. Deny access if they differ. In the same SCP statement, check whether the aws:EC2 value matches itself. Deny access if they differ. Apply the SCP to each account in the organization.

    View question →

50. Q50. A company wants to migrate its monolithic web application—currently hosted on Amazon EC2—to a serverless architecture. Currently, it deploys the application using a new EC2 Auto Scaling group and a new Elastic Load Balancer, then shifts traffic using Amazon Route 53 routing policies. For the new serverless application, the company plans to use Amazon API Gateway and AWS Lambda. It will need to update its deployment process accordingly. Before rolling out new features to all customers, it must retain the ability to test them with a small subset of users. Which deployment strategy meets these requirements?

    • A. Deploy the API Gateway and Lambda functions using AWS CDK. When code changes are needed, update the AWS CloudFormation stack and deploy new versions of the API and Lambda functions. Use Route 53 failover routing for canary releases.
    • B. Deploy API Gateway and Lambda functions using AWS CloudFormation with Lambda function versions. When code changes are needed, update the CloudFormation stack with new Lambda code and update the API version using a canary release strategy. Promote the new version after testing.
    • C. Deploy API Gateway and Lambda functions using AWS Elastic Beanstalk. When code changes are needed, deploy new versions of the API and Lambda functions. Use Elastic Beanstalk blue/green deployments to gradually shift traffic.
    • D. Deploy API Gateway at the service layer and Lambda functions at the custom layer using AWS OpsWorks. When code changes are needed, use OpsWorks to execute blue/green deployments and gradually shift traffic.

    View question →

51. Q51. A company wants to build a continuous delivery pipeline. It stores application code in a private GitHub repository. The company needs to deploy application components to Amazon Elastic Container Service (Amazon ECS), Amazon EC2, and AWS Lambda. The pipeline must support manual approval actions. Which solution meets these requirements?

    • A. Use AWS CodePipeline with Amazon ECS, Amazon EC2, and Lambda as deployment providers.
    • B. Use AWS CodePipeline and AWS CodeDeploy as deployment providers.
    • C. Use AWS CodePipeline and AWS Elastic Beanstalk as deployment providers.
    • D. Use AWS CodeDeploy integrated with GitHub to deploy the application.

    View question →

52. Q52. A company runs an application on current-generation Amazon EC2 instances in a VPC. The EC2 instances run Amazon Linux and launch within an Amazon EC2 Auto Scaling group. The application retrieves data from an Amazon S3 bucket, processes it, and uploads results to a different S3 bucket. Recently, application performance degraded. Manual investigation revealed that outbound network bandwidth utilization is excessively high relative to the EC2 instance type. The company upgraded the EC2 instances to a newer generation. The DevOps team now needs to receive notifications via Amazon CloudWatch alarms when the application attempts to use more outbound network bandwidth than the new EC2 instance type allows.

    • A. Configure EC2 detailed monitoring for the instances. Create an AWS Lambda function that creates CloudWatch alarms for the Bw_out_allowance_exceeded metric for each EC2 instance. Configure the alarms to notify the DevOps team.
    • B. Install the unified CloudWatch agent on the EC2 instances to export the bw_out_allowance_exceeded metric to CloudWatch. Create a CloudWatch composite alarm monitoring all bw_out_allowance_exceeded metrics. Configure the alarm to notify the DevOps team.
    • C. Configure VPC Flow Logs to Amazon CloudWatch Logs for the EC2 instances. Create a CloudWatch Logs metric filter matching events where bandwidth allowance is exceeded. Create a CloudWatch composite alarm monitoring all bw_out_allowance_exceeded metrics. Configure the alarm to notify the DevOps team.
    • D. Install the unified CloudWatch agent on the EC2 instances to export the Bw_out_allowance_exceeded metric to CloudWatch. Create an AWS Lambda function that creates CloudWatch alarms for the bw_out_allowance_exceeded metric for each EC2 instance. Configure the alarms to notify the DevOps team.

    View question →

53. Q53. A security team is concerned that developers might attach an Elastic IP address to production Amazon EC2 instances. Attaching Elastic IP addresses to instances is prohibited for all developers. If any production server has an Elastic IP address attached at any time, the security team must be notified. How can this task be automated?

    • A. Use Amazon Athena to query AWS CloudTrail logs to check for any associate-address attempts. Create an AWS Lambda function to disassociate the Elastic IP address from the instance and alert the security team.
    • B. Attach an IAM policy to the developers' IAM group to deny the associate-address permission. Create a custom AWS Config rule to check whether Elastic IP addresses are associated with any instances tagged as production and alert the security team.
    • C. Ensure that all IAM groups associated with developers lack the associate-address permission. Create a scheduled AWS Lambda function to check whether Elastic IP addresses are associated with any instances tagged as production, and alert the security team if an instance has an associated Elastic IP address.
    • D. Create an AWS Config rule to verify that all production instances have an EC2 IAM role containing a deny permission for associate-address. Validate whether any Elastic IP address is associated with any instance, and alert the security team if an instance has an associated Elastic IP address.

    View question →

54. Q54. A company uses Amazon S3 buckets to store critical documents. The company discovers that some S3 buckets are unencrypted. Currently, IAM users in the company can create new S3 buckets without encryption. The company is implementing a new requirement mandating that all S3 buckets must be encrypted. A DevOps engineer must implement a solution to ensure server-side encryption is enabled on both existing and newly created S3 buckets. Encryption must be enabled immediately after an S3 bucket is created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256). Which solution meets these requirements?

    • A. Create an AWS Lambda function invoked regularly by an Amazon EventBridge scheduled rule. Program the Lambda function to scan the encryption status of all current S3 buckets and set AES-256 as the default encryption for any S3 bucket lacking encryption configuration.
    • B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule. Configure the rule to use the AWS-EnableS3BucketEncryption AWS Systems Manager Automation runbook as the remediation action. Manually run the re-evaluation process to ensure compliance of existing S3 buckets.
    • C. Create an AWS Lambda function invoked by an Amazon EventBridge event rule. Define the rule using an event pattern matching new S3 bucket creation. Program the Lambda function to parse the EventBridge event, inspect the S3 bucket configuration from the event, and set AES-256 as the default encryption.
    • D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key value is not AES-256. Create an IAM group for all IAM users in the company and attach the IAM policy to the IAM group.

    View question →

55. Q55. A DevOps engineer manages a web application running on Amazon EC2. The application uses Amazon Kinesis Data Streams to ingest and process web logs. The DevOps engineer also manages a Kinesis consumer application running on Amazon EC2. A sudden spike in data volume causes the Kinesis consumer application to fall behind, and Kinesis data is discarded before records can be processed. The DevOps engineer must implement a solution to improve processing throughput. Which solution meets these requirements with the highest operational efficiency?

    • A. Modify the Kinesis consumer application to persist logs in Amazon S3. Use Amazon EMR to process data directly on Amazon S3 for customer insights. Store results in Amazon S3.
    • B. Horizontally scale the Kinesis consumer application by adding more EC2 instances based on the Amazon CloudWatch GetRecords.IteratorAgeMilliseconds metric. Increase the retention period of the Kinesis data stream.
    • C. Refactor the Kinesis consumer application to run as an AWS Lambda function. Configure the Kinesis data stream as an event source for the Lambda function to process the data stream.
    • D. Increase the number of shards in the Kinesis data stream to increase overall throughput so the consumer application processes data faster.

    View question →

56. Q56. A multi-tier application requires deleting and repopulating a table in an Amazon RDS MySQL database instance during each deployment. This process may take several minutes and renders the web tier unavailable until completion. Currently, the web tier is configured in an Amazon EC2 Auto Scaling group, where instances are terminated and replaced during each deployment. An AWS CodeBuild job runs SQL queries to populate the MySQL table. What should be done to ensure the web tier does not come online before the database is fully configured?

    • A. Use Amazon Aurora as a direct replacement for RDS MySQL. Use snapshots to populate the table with correct data.
    • B. Modify the Auto Scaling group's launch configuration to pause user data execution for 600 seconds, allowing time for table population.
    • C. Use AWS Step Functions to monitor and maintain the data population status. Mark the database as 'in service' before continuing deployment.
    • D. Use EC2 Auto Scaling lifecycle hooks to pause web tier instance configuration until the table is populated.

    View question →

57. Q57. A company operates an organization within AWS Organizations, consisting of many accounts belonging to different business units. The organization has a dedicated master AWS account. The company needs to enforce server-side encryption for Amazon Elastic Block Store (Amazon EBS) volumes and Amazon Simple Queue Service (Amazon SQS) queues created or updated in the AWS cloud across accounts in an organizational unit (OU). Which solution must be implemented before CloudFormation stack operations to enforce this policy?

    • A. Enable trusted access for AWS CloudFormation. Create a CloudFormation hook to enforce server-side encryption for EBS volumes and SQS queues. Deploy the hook across accounts in the OU using StackSets.
    • B. Deploy a workstation across all accounts. Use AWS Systems Manager to deploy AWS Config rules enforcing server-side encryption for EBS volumes and SQS queues in accounts within the OU.
    • C. Write a Service Control Policy (SCP) denying creation of EBS volumes and SQS queues unless they have server-side encryption enabled. Attach the SCP to the OU.
    • D. Develop an AWS Lambda function in the authorized administrator account that checks whether EBS volumes and SQS queues enforce server-side encryption. Create an IAM role granting Lambda access to accounts in the OU.

    View question →

58. Q58. A company uses AWS CodeDeploy blue/green deployments to deploy an application. The deployment includes Amazon EC2 Auto Scaling groups launching instances running Amazon Linux 2. A valid appspec.yml file exists in the code repository containing the following text: A DevOps engineer must ensure that a script downloads and installs a license file on the instance before replacement instances begin handling traffic. The DevOps engineer adds a hooks section to the appspec.yml file. Which hook should the DevOps engineer use to run the script that downloads and installs the license file?

    • A. AfterTrafficHook
    • B. BeforeTrafficHook
    • C. BeforeInstall
    • D. DownloadBundle

    View question →

59. Q59. A DevOps engineer manages a web application running on Amazon EC2. The application uses Amazon Kinesis Data Streams to ingest and process web logs. The DevOps engineer also manages a Kinesis consumer application running on Amazon EC2. A sudden spike in data volume causes the Kinesis consumer application to fall behind, and Kinesis data is discarded before records can be processed. The DevOps engineer must implement a solution to improve processing throughput. Which solution meets these requirements with the highest operational efficiency?

    • A. Modify the Kinesis consumer application to persist logs in Amazon S3. Use Amazon EMR to process data directly on Amazon S3 for customer insights. Store results in Amazon S3.
    • B. Horizontally scale the Kinesis consumer application by adding more EC2 instances based on the Amazon CloudWatch GetRecords.IteratorAgeMilliseconds metric. Increase the Kinesis data stream retention period.
    • C. Refactor the Kinesis consumer application to run as an AWS Lambda function. Configure the Kinesis data stream as an event source for the Lambda function to process the data stream.
    • D. Increase the number of shards in the Kinesis data stream to increase overall throughput so the consumer application processes data faster.

    View question →

60. Q60. A company uses AWS CloudFormation stacks to deploy updates to an application. The stack comprises various resources, including an AWS Auto Scaling group, Amazon EC2 instances, an Application Load Balancer (ALB), and other resources required to launch and maintain independent stacks. Modifications to application resources outside CloudFormation stack updates are prohibited. The company recently attempted to update the application stack using the AWS CLI. The stack update failed with the error message: 'Error: Deployment and CloudFormation stack rollback both failed. Deployment failed because the following resource could not be updated: [AutoScalingGroup].' The stack remains in UPDATE_ROLLBACK_FAILED state. Which solution resolves this issue?

    • A. Update the subnet mappings configured for the ALB. Run the aws cloudformation update-stack-set AWS CLI command.
    • B. Update the IAM role by providing permissions required to update the stack. Run the aws cloudformation continue-update-rollback AWS CLI command.
    • C. Submit a request to increase the account’s EC2 instance quota. Run the aws cloudformation cancel-update-stack AWS CLI command.
    • D. Delete the Auto Scaling Group resource. Run the aws cloudformation rollback-stack AWS CLI command.

    View question →

61. Q61. A company uses Amazon EC2 instances backed by Amazon EBS storage to host a temporary web application. The company wants to recover quickly with minimal data loss when the EC2 instance experiences network connectivity issues or power failures.

    • A. Add the instance to an EC2 Auto Scaling group with minimum capacity, maximum capacity, and desired capacity all set to 1.
    • B. Add the instance to an EC2 Auto Scaling group with a lifecycle hook to detach the EBS volume when the EC2 instance is shut down or terminated.
    • C. Create an Amazon CloudWatch alarm for the StatusCheckFailed system metric and select the EC2 action to recover the instance.
    • D. Create an Amazon CloudWatch alarm for the StatusCheckFailed Instance metric and select the EC2 action to reboot the instance.

    View question →

62. Q62. A company managing electronic patient health records runs a fleet of Amazon EC2 instances using Amazon Linux operating systems. The company requires ensuring that EC2 instances run operating system patches and application patches compliant with current privacy regulations. The company uses a custom repository to store application patches.

    • A. Use AWS Systems Manager to create a new custom patch baseline that includes both the default OS repository and the custom repository. Use Run Command to execute the AWS-RunPatchBaseline document to verify and install patches. Configure the new custom patch baseline using the BaselineOverride API.
    • B. Use AWS Direct Connect to integrate the custom repository with EC2 instances. Deploy patches using Amazon EventBridge events.
    • C. Use the yum-config-manager command to add the custom repository to the /etc/yum.repos.d configuration. Run the yum-config-manager --enable command to activate the new repository.
    • D. Use AWS Systems Manager to create one patch baseline for the default OS repository and a second patch baseline for the custom repository. Use Run Command to execute the AWS-RunPatchBaseline document to verify and install patches. Configure both the default and custom patch baselines using the BaselineOverride API.

    View question →

63. Q63. A company has multiple development teams working in a shared AWS account. When resource creation approaches account service limits, senior managers want to receive alerts via a third-party API.

    • A. Create a regularly scheduled Amazon EventBridge rule targeting an AWS Lambda function. In the Lambda function, assess the current AWS environment state and compare deployed resource values against account service limits. Notify senior managers if the account is nearing service limits.
    • B. Deploy an AWS Lambda function to refresh AWS Trusted Advisor checks and configure an Amazon EventBridge rule to run the Lambda function periodically. Create another EventBridge rule with an event pattern matching Trusted Advisor events and target the same Lambda function. In the target Lambda function, notify senior managers.
    • C. Deploy an AWS Lambda function to refresh AWS Health Dashboard checks and configure an Amazon EventBridge rule to run the Lambda function periodically. Create another EventBridge rule with an event pattern matching Health Dashboard events and target the Lambda function. In the target Lambda function, notify senior managers.
    • D. Add a regularly scheduled AWS Config custom rule to check AWS service limit status and stream notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Deploy an AWS Lambda function to notify senior managers and subscribe the Lambda function to the SNS topic.

    View question →

64. Q64. A company uses AWS CodeDeploy to automate software deployments. The deployment must meet these requirements: • Multiple instances must be available for communication during deployment; traffic must be load-balanced across them, and instances must auto-heal upon failure. • A new fleet of instances must launch automatically for deploying new revisions, without manual configuration. • Temporary files generated during deployment must be deleted before traffic is routed to the new fleet. • After successful deployment, original instances in the deployment group must be terminated immediately to reduce costs.

    • A. Use Application Load Balancer and in-place deployment. Associate an Auto Scaling group with the deployment group. Use the 'Auto copy Auto Scaling group' option and use the CodeDeploy default deployment configuration. Instruct AWS CodeDeploy to terminate original instances in the deployment group and use the 'AllowTraffic' lifecycle hook in the application to delete temporary files.
    • B. Use Application Load Balancer and blue/green deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the 'Auto copy Auto Scaling group' option, create a custom deployment configuration with minimum healthy hosts set to 50%, and assign it to the deployment group. Instruct AWS CodeDeploy to terminate original instances in the deployment group and use the 'BeforeBlockTraffic' lifecycle hook in the application to delete temporary files.
    • C. Use Application Load Balancer and blue/green deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the 'Auto copy Auto Scaling group' option and use the CodeDeploy default deployment configuration. Instruct AWS CodeDeploy to terminate original instances in the deployment group and use the 'BeforeAllowTraffic' lifecycle hook in the application to delete temporary files.
    • D. Use Application Load Balancer and in-place deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the 'Auto copy Auto Scaling group' option and use the CodeDeploy default deployment configuration. Instruct AWS CodeDeploy to terminate original instances in the deployment group and use application.yml to delete temporary files.

    View question →

65. Q65. A company operates a single AWS account for active development. Its security team has enabled Amazon GuardDuty, AWS Config, and AWS CloudTrail in the account. The security team wants to receive near real-time notifications only for high-severity findings from GuardDuty. The security team uses an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications from other security tools in the account.

    • A. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect GuardDuty findings. Use an input transformer to filter for high-severity event patterns. Configure the rule to publish messages to the SNS topic.
    • B. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect high-severity GuardDuty findings that violate the 'guardduty-non-archived-findings' AWS Config managed rule. Configure the EventBridge (CloudWatch Events) rule to publish messages to the SNS topic.
    • C. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern matching high-severity GuardDuty ListFindings API calls. Configure the rule to publish messages to the SNS topic.
    • D. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern matching GuardDuty findings in the event where the severity level is high. Configure the rule to publish messages to the SNS topic.

    View question →

66. Q66. A company uses Amazon S3 to store sensitive information. The development team creates new buckets daily for new projects. The security team wants to ensure that both existing and newly created buckets have encryption, logging, and versioning enabled. Additionally, no bucket should be publicly readable or writable.

    • A. Enable AWS CloudTrail and use AWS Lambda to configure automatic remediation.
    • B. Enable AWS Config rules and use AWS Systems Manager Documents to configure automatic remediation.
    • C. Enable AWS Trusted Advisor and use Amazon CloudWatch Events to configure automatic remediation.
    • D. Enable AWS Systems Manager and use Systems Manager Documents to configure automatic remediation.

    View question →

67. Q67. A company is testing a web application running on Amazon EC2 instances behind an Application Load Balancer. Instances run in an Auto Scaling group spanning multiple Availability Zones. During new software deployments, the company uses blue/green deployment to avoid unhealthy instances.

    • A. Enable intelligent session stickiness on the load balancer and modify the application to check for existing sessions.
    • B. Enable session sharing on the load balancer and modify the application to read sessions from a shared store.
    • C. Store user session information in an Amazon S3 bucket and modify the application to read session information from the bucket.
    • D. Modify the application to store user session information in an Amazon ElastiCache cluster.

    View question →

68. Q68. A DevOps engineer is developing an application that persists files to Amazon S3. The application must upload files classified under different security categories defined by the company: confidential, private, and public. Files classified as confidential must be viewable only by the uploading user. The application uses users’ IAM roles to call S3 API operations. The DevOps engineer modified the application to add a DataClassification tag with value 'confidential' and an Owner tag containing the uploading user’s ID to each confidential object uploaded to Amazon S3.

    • A. Modify the S3 bucket ACL to grant the bucket owner read access to the uploading user’s IAM role. Create an IAM policy that grants s3:GetObject permission on the S3 bucket when aws:ResourceTag/DataClassification equals 'confidential' and s3:ExistingObjectTag/Owner equals ${aws:userid}. Attach the policy to the IAM roles of users who need access to the S3 bucket.
    • B. Modify the S3 bucket policy to allow s3:GetObject when aws:ResourceTag/DataClassification equals 'confidential' and s3:ExistingObjectTag/Owner equals ${aws:userid}. Create an IAM policy granting s3:GetObject on the S3 bucket and attach it to the users’ IAM roles.
    • C. Modify the S3 bucket policy to allow s3:GetObject when aws:ResourceTag/DataClassification equals 'confidential' and aws:RequestTag/Owner equals ${aws:userid}. Create an IAM policy granting s3:GetObject on the S3 bucket and attach it to the users’ IAM roles.
    • D. Modify the S3 bucket ACL to grant authenticated users read access when aws:ResourceTag/DataClassification equals 'confidential' and s3:ExistingObjectTag/Owner equals ${aws:userid}. Create an IAM policy granting s3:GetObject on the S3 bucket and attach it to the users’ IAM roles.

    View question →

69. Q69. A development team is deploying microservices on Amazon Elastic Kubernetes Service (Amazon EKS) clusters. The clusters use managed node groups. The team wants to enable automatic scaling of microservice pods based on specific CPU utilization thresholds. The team has already installed the Kubernetes Metrics Server on the clusters. Which solution will meet these requirements in the most efficient way?

    • A. Edit the Auto Scaling group associated with the EKS cluster's worker nodes. Configure the Auto Scaling group to scale using a target tracking scaling policy when the Auto Scaling group's CPU utilization reaches a specific percentage.
    • B. Deploy the Kubernetes Horizontal Pod Autoscaler (HPA) and the Kubernetes Vertical Pod Autoscaler (VPA) in the cluster. Configure the HPA to scale based on target CPU utilization. Configure the VPA to run in recommender mode.
    • C. Run the AWS Systems Manager Run Command automation document for the node group. Modify the node instance type, node labels, and node taints values based on estimated node size requirements.
    • D. Deploy the Kubernetes Horizontal Pod Autoscaler (HPA) and the Kubernetes Cluster Autoscaler in the cluster. Configure the HPA to scale based on target CPU utilization. Configure the Cluster Autoscaler to use auto-discovery settings.

    View question →

70. Q70. A DevOps engineer configured Amazon S3 event notifications for an S3 bucket. When a PUT operation occurs on the bucket, these event notifications are triggered. If a file’s suffix is .csv, one event notification invokes an AWS Lambda function. If a file’s suffix is .xlsx, another event notification invokes an Amazon Simple Notification Service (Amazon SNS) topic. The DevOps engineer observes that files with the .csv suffix successfully invoke the Lambda function. However, files with the .xlsx suffix do not invoke the SNS topic. Which reason explains why the SNS topic is not invoked when an .xlsx file is added to the S3 bucket?

    • A. The S3 console allows only one event notification.
    • B. Amazon S3 requires appropriate permissions to publish event notifications to Amazon SNS.
    • C. Lambda takes precedence over Amazon SNS in processing event notifications.
    • D. Amazon SNS is not a valid destination for certain S3 event notifications, including object PUT events.

    View question →

71. Q71. A company launches a new application in a new AWS account. The application includes an AWS Lambda function that processes messages from an Amazon Simple Queue Service (SQS) standard queue. The Lambda function stores results in an Amazon S3 bucket for further downstream processing. The Lambda function must process messages within one second after they are published. The Lambda function’s batch size is configured for 10 messages, and processing one message takes 0.5 seconds. As application load increases on the first day of service, messages accumulate in the queue faster than the Lambda function can process them. Some messages miss their required processing deadline. Logs indicate many messages in the queue contain invalid data. The company must meet the processing deadline requirement for messages containing valid data. Which solution meets these requirements?

    • A. Increase the Lambda function’s batch size. Change the standard queue to a FIFO queue. Request a synchronous Lambda concurrency increase in the AWS Region.
    • B. Decrease the Lambda function’s batch size. Increase the SQS message throughput quota. Request a synchronous Lambda concurrency increase in the AWS Region.
    • C. Increase the Lambda function’s batch size. Configure S3 Transfer Acceleration on the S3 bucket. Configure a FIFO queue.
    • D. Keep the Lambda function’s batch size unchanged. Configure the Lambda function to report batch item failures. Configure a dead-letter queue.

    View question →

72. Q72. A company wants to migrate its legacy web application—currently hosted on Amazon EC2—to a serverless architecture. The company currently deploys the application using a new EC2 Auto Scaling group and a new Elastic Load Balancer, then uses Amazon Route 53 weighted routing policies to shift traffic gradually. For the new serverless application, the company plans to use Amazon API Gateway and AWS Lambda. The company will need to update its deployment process for the new application. Before rolling out new features to the entire customer base, it must retain the ability to test new features on a subset of customers. Which deployment strategy meets these requirements?

    • A. Use AWS CDK to deploy API Gateway and Lambda functions. When code changes are needed, update the AWS CloudFormation stack and deploy new versions of the API and Lambda functions. Use Route 53 failover routing policy for canary release strategy.
    • B. Use AWS CloudFormation to deploy API Gateway and Lambda functions with Lambda function versions. When code changes are needed, update the CloudFormation stack with new Lambda code and update the API version using canary release strategy. Promote the new version after testing completes.
    • C. Use AWS Elastic Beanstalk to deploy API Gateway and Lambda functions. When code changes are needed, deploy new versions of the API and Lambda functions. Use Elastic Beanstalk blue/green deployment to gradually shift traffic.
    • D. Use AWS OpsWorks to deploy API Gateway at the service layer and Lambda functions at a custom layer. When code changes are needed, use OpsWorks to perform blue/green deployment and gradually shift traffic.

    View question →

73. Q73. A company’s development teams manage a set of accounts inherited from a previous organization. These accounts reside within an organization in AWS Organizations. The company needs a solution to ensure all Amazon EC2 instances use only approved AMIs managed by developers. The solution must automatically remediate usage of unapproved, noncompliant systems. Individual account administrators must not be able to disable enforcement of approved noncompliant system usage.

    • A. Use AWS CloudFormation StackSets to deploy Amazon EventBridge rules to each account. Configure the rule to respond to AWS CloudTrail events for Amazon EC2 and send notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team’s email address to the topic.
    • B. Use AWS CloudFormation StackSets to deploy AWS Config managed rules to each account monthly. Configure the rule against an approved list of noncompliant systems. Configure the rule to run the AWS-STOP2EC2Instances Systems Manager Automation runbook for noncompliant EC2 instances.
    • C. Create an AWS Lambda function for Amazon EC2 to process AWS CloudTrail events. Configure the Lambda function to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team’s email address to the topic. Deploy the Lambda function in each account in the organization. Create an Amazon EventBridge rule in each account. Configure the EventBridge rule for AWS CloudTrail events for Amazon EC2 and invoke the Lambda function.
    • D. Enable AWS Systems Manager Automation Compliance across the organization. Create a compliance pack that uses approved AMIs and deploy it across the organization. Configure the rule to run the AWS-STOP2EC2Instances Systems Manager Automation runbook for noncompliant EC2 instances.

    View question →

74. Q74. A company uses AWS to host digital workloads. Each application team hosts its applications in its own AWS account. Accounts are consolidated into a single organization in AWS Organizations. The company wants to enforce security standards across the organization. To prevent noncompliance due to misconfigurations, the company mandates AWS CloudFormation. Support teams must be able to identify and resolve application-related issues via the AWS Management Console, minimizing impact on production environments. A DevOps engineer must implement a solution to detect any AWS service configuration errors causing noncompliance nearly in real time. The solution must automatically remediate such errors within 15 minutes of detection. The solution must track noncompliant resources and events in a dashboard with accurate timestamps. Which solution meets these requirements with minimal development effort?

    • A. Use CloudFormation drift detection to identify noncompliant resources. Invoke an AWS Lambda function for remediation using drift detection events in CloudFormation. Configure the Lambda function to publish logs to an Amazon CloudWatch Logs log group. Configure an Amazon CloudWatch dashboard to use the log group for tracking.
    • B. Enable AWS CloudTrail in the AWS account. Analyze CloudTrail logs using Amazon Athena to identify noncompliant resources. Use AWS Step Functions to track Athena query results for drift detection and invoke an AWS Lambda function for remediation. Set up an Amazon QuickSight dashboard using Athena as the data source for tracking.
    • C. Enable AWS Config configuration recorders in all AWS accounts to identify noncompliant resources. Enable AWS Security Hub in all AWS accounts using the --no-enable-default-standards option. Set up AWS Config managed rules and custom rules. Configure AWS Config remediation to automatically remediate violations. For tracking, configure the Security Hub dashboard in the designated Security Hub administrator account.
    • D. Enable AWS CloudTrail in the AWS account. Analyze CloudTrail logs using Amazon CloudWatch Logs to identify noncompliant resources. Use CloudWatch Logs filters for drift detection. Use Amazon EventBridge to invoke a Lambda function for remediation. Stream filtered CloudWatch Logs to Amazon OpenSearch Service. Set up a tracking dashboard on OpenSearch Service.

    View question →

75. Q75. 一家公司正在实施AWSCodePipeline以自动化密测试活程。该公司希望在执行才态失败唱收到通知，并在Amazon CloudWatch中使难了以下自定批事件模式： | "source": "aws. Codepipeline" "detail-type": "CodePipeline Action Execution State Change" ], "detail": "state": "FAILED" "type": "category": ["Approval"] } } Which Type of events will match this event pattern?

    • A. 跨所有管道的部署和构建操作失败
    • B. 所有管道中的所有拒绝或失败的批准操作
    • C. 所有管道中的所有事件
    • D. 所有管道的批准行动

    View question →

76. Q76. A company uses AWS CodeCommit for source control. Developers commit changes to various feature branches and create pull requests to merge those changes into the main branch after approval. Developers must not push changes directly to the main branch. The company applies the AWSCodeCommitPowerUser managed policy to developers’ IAM roles, but now developers can push changes directly to the main branch in every repository in the AWS account. How should the company restrict developers from pushing changes directly to the main branch?

    • A. Create an additional policy containing explicit Deny statements for GitPush and PutFile actions, with a condition restricting the policy to the main branch reference for specific repositories.
    • B. Remove the IAM policy and attach the AWSCodeCommitReadOnly managed policy. Add Allow statements for GitPush and PutFile actions in the policy statement, with a condition restricting the policy to the main branch reference for specific repositories.
    • C. Modify the IAM policy to include explicit Deny statements for GitPush and PutFile actions in the policy statement, with a condition restricting the policy to the main branch reference for specific repositories.
    • D. Create an additional policy containing explicit Allow statements for GitPush and PutFile actions, with a condition restricting the policy to feature branch references for specific repositories.

    View question →

77. Q77. An e-commerce company uses Amazon EC2 instances backed by Amazon EBS volumes. To reduce manual effort for managing instances, a DevOps engineer must automatically restart EC2 instances when scheduled maintenance events occur. How can this be achieved?

    • A. Create a scheduled Amazon CloudWatch Events rule to execute an AWS Systems Manager Automation document that checks whether any EC2 instance is scheduled for weekly shutdown. If scheduled, the automation document puts the instance into hibernation.
    • B. Enable EC2 auto-recovery on all instances. Create an AWS Config rule to restrict recovery to occur only during approved maintenance windows.
    • C. Restart all EC2 instances during approved maintenance windows outside standard business hours. Set up Amazon CloudWatch alarms to notify when any instance fails an EC2 instance status check.
    • D. Set up an AWS Health Amazon CloudWatch Events rule to execute an AWS Systems Manager Automation document that stops and starts EC2 instances upon occurrence of a scheduled maintenance event.

    View question →

78. Q78. A security team uses AWS CloudTrail to detect sensitive security issues in the company's AWS account. A DevOps engineer needs a solution to automatically remediate CloudTrail being disabled in the AWS account. Which solution ensures the shortest possible downtime for CloudTrail log delivery?

    • A. Create an Amazon EventBridge rule that triggers on CloudTrail StopLogging events. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource where logging was stopped. Add the Lambda function ARN as the target of the EventBridge rule.
    • B. Deploy an AWS-managed, CloudTrail-enabled AWS Config rule configured to evaluate compliance every hour. Create an Amazon EventBridge rule that triggers on AWS Config rule compliance change events. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource where logging was stopped. Add the Lambda function ARN as the target of the EventBridge rule.
    • C. Create an Amazon EventBridge rule that triggers on a scheduled event every 5 minutes. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on all CloudTrail trails in the AWS account. Add the Lambda function ARN as the target of the EventBridge rule.
    • D. Launch a t2.nano instance with a script that runs every 5 minutes and uses the AWS SDK to query CloudTrail status in the current account. If a CloudTrail trail is disabled, have the script re-enable it.

    View question →

79. Q79. A company wants to deploy a proprietary enterprise in-memory data store using a mesh system on AWS. The system runs across multiple server nodes on any Linux distribution. Whenever nodes are added or removed, the system must reconfigure the entire cluster. Adding or removing nodes requires updating the /etc/cluster/nodes.config file to list the IP addresses of current cluster members.

    • A. Use AWS OpsWorks Stacks to layer the cluster's server nodes. Create a Chef recipe that populates the /etc/cluster/nodes.config file content and restarts the service using the current layer members. Assign the recipe to configuration lifecycle events.
    • B. Store the nodes.config file in version control. Create an AWS CodeDeploy deployment configuration and deployment group based on Amazon EC2 tag values for cluster nodes. When adding a new node to the cluster, update the file with all tagged instances, commit to version control, then deploy the updated file and restart the service.
    • C. Create an Amazon S3 bucket and upload a version of the /etc/cluster/nodes.config file. Create a crontab script that polls the S3 file and downloads it periodically. Use a process manager (e.g., Monit or systemd) to restart the cluster service when a modified file is detected. When adding a node, edit the file to include the latest member and upload the updated file to the S3 bucket.
    • D. Create a user data script that lists all members of the cluster's current security group and automatically updates the /etc/cluster/nodes.config file when a new instance is added to the cluster.

    View question →

80. Q80. An e-commerce company uses Amazon EC2 instances backed by Amazon Elastic Block Store (Amazon EBS). To reduce manual effort required to handle instance retirement, a DevOps engineer must automatically perform a restart operation when an EC2 instance retirement event is scheduled.

    • A. Create a scheduled Amazon EventBridge rule to run an AWS Systems Manager Automation runbook that checks weekly for any EC2 instances scheduled for retirement. If an instance is scheduled for retirement, the runbook puts the instance into hibernation.
    • B. Enable EC2 Auto Recovery on all instances. Create an AWS Config rule to restrict recovery operations to approved maintenance windows only.
    • C. Restart all EC2 instances during approved maintenance windows outside standard business hours. Configure Amazon CloudWatch alarms to notify when any instance fails an EC2 instance status check.
    • D. Set up an AWS Health Amazon EventBridge rule to run an AWS Systems Manager Automation runbook that stops and starts EC2 instances when a scheduled retirement event occurs.

    View question →

81. Q81. A company uses a single AWS account to test applications on Amazon EC2 instances. The company has enabled AWS Config in the AWS account and activated the restricted-ssh AWS Config managed rule. The company needs an automated monitoring solution that sends notifications whenever any security group in the account violates the restricted-ssh rule. Notifications must include the name and ID of noncompliant security groups. A DevOps engineer has created an Amazon Simple Notification Service (Amazon SNS) topic and subscribed appropriate personnel.

    • A. Create an Amazon EventBridge rule matching AWS Config evaluation results with NON_COMPLIANT status for the restricted-ssh rule. Configure an input transformer for the EventBridge rule. Configure the EventBridge rule to publish notifications to the SNS topic.
    • B. Configure AWS Config to send all evaluation results for the restricted-ssh rule directly to the SNS topic. Configure a filter policy on the SNS topic to deliver only notifications containing the text 'NON_COMPLIANT'.
    • C. Create an Amazon EventBridge rule matching AWS Config evaluation results with NON_COMPLIANT status for the restricted-ssh rule. Configure the EventBridge rule to invoke an AWS Systems Manager Run Command on the SNS topic to customize the notification and publish it to the SNS topic.
    • D. Create an Amazon EventBridge rule matching all AWS Config evaluation results with NON_COMPLIANT status. Configure an input transformer for the restricted-ssh rule. Configure the EventBridge rule to publish notifications to the SNS topic.

    View question →

82. Q82. A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to receive notifications if any key has not been rotated within 90 days.

    • A. Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when a key exceeds 90 days since last rotation.
    • B. Configure an Amazon EventBridge event to invoke an AWS Lambda function that calls the AWS Trusted Advisor API and publishes to an Amazon Simple Notification Service (Amazon SNS) topic.
    • C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when a key exceeds 90 days since last rotation.
    • D. Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when a key exceeds 90 days since last rotation.

    View question →

83. Q83. A company requires developers to tag Amazon Elastic Block Store (Amazon EBS) volumes in the account to indicate required backup frequency, including volumes that require no backups. The company uses a custom tag named Backup_Frequency with values none, daily, or weekly. An audit found developers inconsistently applying the Backup_Frequency tag to EBS volumes. A DevOps engineer must ensure all EBS volumes always have the Backup_Frequency tag so the company performs backups at least weekly unless a different value is specified.

    • A. Enable AWS Config in the account. Create a custom rule that returns a noncompliant result for all Amazon EC2 resources missing the backup frequency tag. Configure a remediation action using a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with value weekly.
    • B. Enable AWS Config in the account. Use a managed rule that returns a noncompliant result for EC2::Volume resources missing the backup frequency tag. Configure a remediation action using a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with value weekly.
    • C. Enable AWS CloudTrail in the account. Create an Amazon EventBridge rule that responds to EBS CreateVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with value weekly. Specify the runbook as the rule target.
    • D. Enable AWS CloudTrail in the account. Create an Amazon EventBridge rule that responds to EBS CreateVolume or EBS ModifyVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with value weekly. Specify the runbook as the rule target.

    View question →

84. Q84. A company developed a serverless web application hosted on AWS. The application consists of Amazon S3, Amazon API Gateway, two AWS Lambda functions, and an Amazon RDS database running MySQL. The company uses AWS CodeCommit to store source code, which includes AWS Serverless Application Model (AWS SAM) templates and Python code. Security audits and penetration tests revealed that database credentials were hardcoded in the CodeCommit repository. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.

    • A. Enable Amazon CodeGuru Profiler. Decorate handler functions with @with_lambda_profiler(). Manually review recommendation reports. Store passwords as secure strings in AWS Systems Manager Parameter Store. Update the SAM template and Python code to retrieve secrets from Parameter Store.
    • B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually review code reviews for recommendations. Select the 'protect secrets' option. Update the SAM template and Python code to retrieve secrets from AWS Secrets Manager.
    • C. Enable Amazon CodeGuru Profiler. Decorate handler functions with @with_lambda_profiler(). Manually review recommendation reports. Select the 'protect secrets' option. Update the SAM template and Python code to retrieve secrets from AWS Secrets Manager.
    • D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually review code reviews for recommendations. Store passwords as plaintext strings in AWS Systems Manager Parameter Store. Update the SAM template and Python code to retrieve secrets from Parameter Store.

    View question →

85. Q85. A company needs to implement failover for its application. The application includes an Amazon CloudFront distribution and an Application Load Balancer (ALB) in a primary Region. The company has configured the ALB as the default origin for the distribution. Following recent application outages, the company requires zero-second RTO. The application is deployed to a warm standby configuration in a secondary Region. Architects need to automate failover to the secondary Region so HTTP requests meet the required RTO.

    • A. Create a second CloudFront distribution with the secondary ALB as the default origin. Create an Amazon Route 53 alias record with a failover routing policy, evaluating health checks for both CloudFront distributions with 'Evaluate Target Health' set to 'Yes'. Update the application to use the new record set.
    • B. Add a new origin to the existing distribution, setting the primary ALB as the origin. Configure origin group failure for HTTP 5xx status codes. Update the default cache behavior to use the origin group.
    • C. Create an Amazon Route 53 alias record with a failover routing policy, evaluating health checks for both ALBs with 'Evaluate Target Health' set to 'Yes'. Set TTL for both records to 0. Update the distribution's origin to use the new record set.
    • D. Create a CloudFront Function to detect HTTP 5xx status codes. If the function detects a 5xx status code, configure it to return a 307 Temporary Redirect response pointing to the secondary ALB. Update the distribution's default cache behavior to send origin responses to the function.

    View question →

86. Q86. A DevOps engineer is building a CI/CD pipeline for a serverless application that uses AWS Lambda functions. The company wants to minimize the impact of failed deployments on customers and also wants monitoring capabilities. Which deployment strategy configuration meets these requirements?

    • A. Use an AWS Serverless Application Model (AWS SAM) template to define the serverless application. Deploy the Lambda function using AWS CodeDeploy with a Canary10Percent15Minutes deployment preference type. Use Amazon CloudWatch alarms to monitor the function's health.
    • B. Use AWS CloudFormation to publish new stack updates and include Amazon CloudWatch alarms on all resources. Set up an AWS CodePipeline approval action for developers to verify and approve AWS CloudFormation change sets.
    • C. Use AWS CloudFormation to publish a new version on each stack update and include Amazon CloudWatch alarms on all resources. During stack updates, use the RoutingConfig property of the AWS::Lambda::Alias resource to update traffic routing.
    • D. Use AWS CodeBuild to add sample event payloads for testing Lambda functions. Publish a new version of the function and include Amazon CloudWatch alarms. Update the production alias to point to the new version. Configure rollback to occur when alarms are in ALARM state.

    View question →

87. Q87. A company operates multiple accounts within an AWS Organizations organization. If any account in the organization disables the 'Block Public Access' setting on an Amazon S3 bucket, the company's SecOps team must receive an Amazon Simple Notification Service (Amazon SNS) notification. A DevOps engineer must implement this requirement without impacting any AWS account operations. The implementation must prevent individual member accounts in the organization from disabling notifications.

    • A. Designate one account as the delegated Amazon GuardDuty administrator account. Enable GuardDuty across all accounts in the organization. In the GuardDuty administrator account, create an SNS topic and subscribe the SecOps team's email address. Also in that account, create an Amazon EventBridge rule with an event pattern for GuardDuty findings and the SNS topic as the target.
    • B. Create an AWS CloudFormation template that creates an SNS topic and subscribes the SecOps team's email address. Include in the template an Amazon EventBridge rule with an event pattern for CloudTrail events of s3:PutBucketPublicAccessBlock and the SNS topic as the target. Deploy the stack to every account in the organization using CloudFormation StackSets.
    • C. Enable AWS Config across the entire organization. In the delegated administrator account, create an SNS topic and subscribe the SecOps team's email address. Deploy a conformance pack containing the s3-bucket-level-public-access-prohibited AWS Config managed rule to each account, and use an AWS Systems Manager document to publish events to the SNS topic to notify the SecOps team.
    • D. Enable Amazon Inspector across the organization. In the Amazon Inspector delegated administrator account, create an SNS topic and subscribe the SecOps team's email address. In the same account, create an Amazon EventBridge rule with an event pattern for publicly exposed S3 buckets and publish events to the SNS topic to notify the SecOps team.

    View question →

88. Q88. A company manages a multi-tenant environment in a VPC and has configured Amazon GuardDuty for corresponding AWS accounts. The company forwards GuardDuty investigation results to AWS Security Hub. Volume-based anomalies have been detected from suspicious sources. A DevOps engineer needs to implement a solution that automatically blocks traffic across the entire VPC when GuardDuty identifies new suspicious sources.

    • A. Create a GuardDuty threat list. Configure GuardDuty to reference that list. Create an AWS Lambda function that updates the threat list. Configure the Lambda function to run in response to new Security Hub findings from GuardDuty.
    • B. Configure an AWS WAF web ACL with a custom rule group. Create an AWS Lambda function that adds a block rule to the custom rule group. Configure the Lambda function to run in response to new Security Hub findings from GuardDuty.
    • C. Configure an AWS Network Firewall. Create an AWS Lambda function that adds a drop-action rule to the firewall policy. Configure the Lambda function to run in response to new Security Hub findings from GuardDuty.
    • D. Create an AWS Lambda function that creates a GuardDuty suppression rule. Configure the Lambda function to run in response to new Security Hub findings from GuardDuty.

    View question →

89. Q89. A company manages multiple accounts within an AWS Organizations organization. The company requires a solution to send Amazon CloudWatch Logs data to a dedicated AWS account's Amazon S3 bucket. The solution must support both existing and future CloudWatch Logs log groups.

    • A. Enable an Organization-wide backup policy to back up all log groups to the dedicated S3 bucket. Add an S3 bucket policy allowing access from all company-owned accounts.
    • B. Create a backup plan in AWS Backup. Specify the dedicated S3 bucket as the backup vault. Assign all CloudWatch Logs log group resources to the backup plan. Create resource assignments for all company-owned accounts in the backup plan.
    • C. Create a backup plan in AWS Backup. Specify the dedicated S3 bucket as the backup vault. Assign all existing log groups to the backup plan. Create resource assignments for all company-owned accounts in the backup plan. Create an AWS Systems Manager Automation runbook to assign log groups to the backup plan. Create an AWS Config rule with automatic remediation for noncompliant log groups, specifying the runbook as the rule target.
    • D. Create a CloudWatch Logs destination and an Amazon Kinesis Data Firehose delivery stream in the dedicated AWS account. Specify the S3 bucket as the delivery stream destination. Create subscription filters for all existing log groups across all accounts. Create an AWS Lambda function to invoke the CloudWatch Logs PutSubscriptionFilter API operation. Create an Amazon EventBridge rule to invoke the Lambda function on LogGroup creation events.

    View question →

90. Q90. A company is building a solution to store files containing personally identifiable information (PII) on AWS. Requirements include: • Data must be encrypted at rest and in transit. • Data must be replicated to at least two geographically separated locations, each at least 500 miles (805 km) apart.

    • A. Create primary and secondary Amazon S3 buckets in two separate Availability Zones located at least 500 miles (805 km) apart. Use bucket policies to enforce HTTPS-only access. Enforce Amazon S3 SSE-C on all objects uploaded to the buckets. Configure cross-region replication between the two buckets.
    • B. Create primary and secondary Amazon S3 buckets in two separate AWS Regions located at least 500 miles (805 km) apart. Use bucket policies to enforce HTTPS-only access. Enforce S3-managed keys (SSE-S3) on all objects uploaded to the buckets. Configure cross-region replication between the two buckets.
    • C. Create primary and secondary Amazon S3 buckets in two separate AWS Regions located at least 500 miles (805 km) apart. Use IAM roles to enforce HTTPS-only access. Enforce S3-managed keys (SSE-S3) on all objects uploaded to the buckets. Configure cross-region replication between the two buckets.
    • D. Create primary and secondary Amazon S3 buckets in two separate Availability Zones located at least 500 miles (805 km) apart. Use bucket policies to enforce HTTPS-only access. Enforce AWS KMS encryption on all objects uploaded to the buckets. Configure cross-region replication between the two buckets. Create a KMS Customer Master Key (CMK) in the primary region used for object encryption.

    View question →

91. Q91. A DevOps engineer wants to deploy a serverless web application based on AWS Lambda. The deployment must meet the following requirements: • Provide staging and production environments. • Restrict developer access to the production environment. • Avoid hardcoding credentials in Lambda functions. • Store source code in AWS CodeCommit. • Automate deployment using AWS CodePipeline.

    • A. Create separate staging and production accounts to isolate deployment targets. Use AWS Key Management Service (AWS KMS) to store environment-specific values. Use CodePipeline with AWS CodeDeploy to automate deployment.
    • B. Create separate staging and production accounts to isolate deployment targets. Use Lambda environment variables to store environment-specific values. Use CodePipeline with AWS CodeDeploy to automate deployment.
    • C. Define tagging conventions for staging and production environments to separate deployment targets. Use AWS Key Management Service (AWS KMS) to store environment-specific values. Use CodePipeline with AWS CodeDeploy to automate deployment.
    • D. Define tagging conventions for staging and production environments to separate deployment targets. Use Lambda environment variables to store environment-specific values. Use CodePipeline with AWS CodeDeploy to automate deployment.

    View question →

92. Q92. A DevOps engineer needs to apply a set of core security controls across a group of existing AWS accounts. The accounts reside in an AWS Organizations organization. Individual teams will use the AdministratorAccess AWS managed policy to manage their own accounts. The solution must enable AWS CloudTrail and AWS Config in all applicable AWS Regions. Individual account administrators must not be able to edit or delete baseline resources. However, individual account administrators must retain the ability to edit or delete their own CloudTrail trails and AWS Config rules.

    • A. Create an AWS CloudFormation template defining standard account resources. Deploy the template to all accounts using CloudFormation StackSets from the organization’s management account. Set the stack policy to deny Update:Delete actions.
    • B. Enable AWS Control Tower. Register the existing accounts in AWS Control Tower. Grant individual account administrators permissions to manage CloudTrail and AWS Config.
    • C. Designate an AWS Config management account. Use CloudFormation StackSets to create AWS Config recorders in all accounts. Use the AWS Config management account to deploy AWS Config rules across the organization. Create an organization-wide CloudTrail trail in the organization’s management account. Apply a Service Control Policy (SCP) to prevent modification or deletion of AWS Config recorders.
    • D. Create an AWS CloudFormation template defining standard account resources. Deploy the template to all accounts using CloudFormation StackSets from the organization’s management account. Create an SCP to prevent updating or deleting CloudTrail or AWS Config resources unless the principal is an administrator of the organization’s management account.

    View question →

93. Q93. An enterprise application comprises several independent AWS Lambda functions. A DevOps engineer uses AWS CodePipeline and AWS CodeBuild to build a CI/CD pipeline that sequentially builds, tests, packages, and deploys each Lambda function. The pipeline uses Amazon CloudWatch Events rules to trigger execution immediately after changes to the corresponding application source code. After using the pipeline for several weeks, the DevOps engineer observes that pipeline execution takes significantly longer than expected.

    • A. Modify the CodeBuild projects in the pipeline to use a compute type with higher available network throughput.
    • B. Create a custom CodeBuild execution environment that includes symmetric multiprocessing configuration to run builds in parallel.
    • C. Modify the CodePipeline configuration to execute operations for each Lambda function in parallel by specifying identical runOrder values.
    • D. Modify each CodeBuild project to run inside a VPC and use dedicated instances to increase throughput.

    View question →

94. Q94. A company operates a data ingestion application across multiple AWS accounts. These accounts are part of an organization in AWS Organizations. The company needs to monitor the application and consolidate access to it. Currently, the application runs on Amazon EC2 instances across multiple Auto Scaling groups. The EC2 instances cannot access the internet because the data is sensitive. Engineers have deployed required VPC endpoints. The EC2 instances run a custom AMI built specifically for the application. To maintain the application and troubleshoot issues, system administrators need to log in to the EC2 instances. This access must be automated and centrally controlled. Whenever an instance is accessed, the company’s security team must receive a notification. Which solution meets these requirements?

    • A. Create an Amazon EventBridge rule to notify the security team when a user logs into an EC2 instance. Use EC2 Instance Connect to log in to the instance. Deploy the Auto Scaling group using AWS CloudFormation. Use the cfn-init helper script to deploy appropriate VPC routing for external access. Rebuild the custom AMI to include the AWS Systems Manager Agent.
    • B. Deploy a NAT gateway and an internet-facing bastion host. Create a security group allowing inbound traffic from the bastion host to all EC2 instances. Install the AWS Systems Manager Agent on all EC2 instances. Use Auto Scaling group lifecycle hooks to monitor and audit access. Use Systems Manager Session Manager to log in to instances. Send logs to a log group in Amazon CloudWatch Logs. Export data to Amazon S3 for auditing. Use S3 event notifications to notify the security team.
    • C. Rebuild the custom AMI using EC2 Image Builder. Include the latest version of the AWS Systems Manager Agent in the image. Configure the Auto Scaling group to attach the AmazonSSMManagedInstanceCore IAM role to all EC2 instances. Use Systems Manager Session Manager to log in to instances. Enable logging of session details to Amazon S3. Create an S3 event notification for new file uploads to send messages to an Amazon Simple Notification Service (Amazon SNS) topic for the security team.
    • D. Use AWS Systems Manager Automation to build the Systems Manager Agent into the custom AMI. Configure AWS Config to attach a service control policy (SCP) to the root organizational unit to allow EC2 instances to connect to Systems Manager. Use Systems Manager Session Manager to log in to instances. Enable logging of session details to Amazon S3. Create an S3 event notification for new file uploads to send messages to an Amazon Simple Notification Service (Amazon SNS) topic for the security team.

    View question →

95. Q95. A developer maintains approximately 50 Amazon EC2 Linux servers. These servers are part of an Amazon EC2 Auto Scaling group and use Elastic Load Balancing for load distribution. Occasionally, some application servers are terminated after failing ELB HTTP health checks. The developer wants to perform root cause analysis but cannot access application logs before the servers are terminated. How can log collection be automated?

    • A. Use an Auto Scaling lifecycle hook to place the instance in Pending:Wait state. Create an Amazon CloudWatch alarm for 'Terminate Successful' on the EC2 instance and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action after log collection.
    • B. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an AWS Config rule for 'EC2 Instance Terminate Lifecycle Action' and trigger a Step Functions workflow that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action after log collection.
    • C. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an Amazon CloudWatch subscription filter for 'Terminate Successful' on the EC2 instance and trigger a CloudWatch agent that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action after log collection.
    • D. Use an Auto Scaling lifecycle hook to place the instance in Terminating:Wait state. Create an Amazon EventBridge rule for 'EC2 Instance Terminate Lifecycle Action' and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action after log collection.

    View question →

96. Q96. A company operates many applications. Different teams within the company develop applications using various programming languages and frameworks. These applications run on-premises and on different servers with varying operating systems. Each team has its own release protocols and workflows. The company wants to reduce the complexity of releasing and maintaining these applications. The company is migrating its technology stack—including these applications—to AWS. The company wants centralized source code control, consistent and automated delivery pipelines, and minimal underlying infrastructure maintenance tasks. What should a DevOps engineer do to meet these requirements?

    • A. Create a single AWS CodeCommit repository for all applications. Store each application's code in separate branches. Merge branches and use AWS CodeBuild to build applications. Use AWS CodeDeploy to deploy applications to a centralized application server.
    • B. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build one application at a time. Use AWS CodeDeploy to deploy applications to a centralized application server.
    • C. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build one application at a time and create an AMI for each server. Use AWS CloudFormation StackSets to automatically provision and deprovision Amazon EC2 fleets using these AMIs.
    • D. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build a Docker image for each application and store it in Amazon Elastic Container Registry (Amazon ECR). Use AWS CodeDeploy to deploy applications to Amazon Elastic Container Service (Amazon ECS) running on AWS Fargate–managed infrastructure.

    View question →

97. Q97. A DevOps engineer wants to automate the creation of Linux AMIs. Newly created AMIs must be tagged, and the build pipeline must programmatically access the location of the newly tagged AMI. What is the most cost-effective method to perform this operation?

    • A. Build a pipeline in AWS CodePipeline to download the latest OS Open Virtualization Format (OVF) image and save it to an Amazon S3 bucket. Customize the image using the guestfish utility. Convert the OVF to an AMI using the VM import command. Store the AMI identifier output as an AWS Systems Manager Parameter Store parameter.
    • B. Create an AWS Systems Manager Automation runbook containing instructions for creating the image. Build a pipeline in AWS CodePipeline to execute the runbook to create the AMI. Store the AMI identifier output as a Systems Manager Parameter Store parameter.
    • C. Build a pipeline in AWS CodePipeline to take a snapshot of an Amazon EC2 instance running the latest application version. Launch a new EC2 instance from the snapshot and use an AWS Lambda function to update the running instance. Take a snapshot of the updated instance and convert it to an AMI. Store the AMI identifier output in an Amazon DynamoDB table.
    • D. Launch an Amazon EC2 instance and install Packer. Configure a Packer build with values defining how the image is created. Build a Jenkins pipeline to invoke the Packer build to create the AMI. Store the AMI identifier output in an Amazon DynamoDB table.

    View question →

98. Q98. An AWS CodePipeline pipeline has been implemented to automate the code release process. The pipeline integrates with AWS CodeDeploy to deploy versions of the application to multiple Amazon EC2 instances for each CodePipeline stage. During a recent deployment, the pipeline failed due to a CodeDeploy issue. The DevOps team wants enhanced monitoring and notifications during deployments to reduce resolution time. How should a DevOps engineer configure notifications when issues occur?

    • A. Implement Amazon CloudWatch Logs for CodePipeline and CodeDeploy, create AWS Config rules to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues.
    • B. Implement Amazon CloudWatch Events for CodePipeline and CodeDeploy, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues.
    • C. Implement AWS CloudTrail to log CodePipeline and CodeDeploy API calls, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues.
    • D. Implement Amazon CloudWatch Events for CodePipeline and CodeDeploy, create an Amazon Inspector assessment target to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues.

    View question →

99. Q99. A DevOps engineer is evaluating the most cost-effective way to implement an image processing cluster on AWS. The application cannot run in Docker containers and must run on Amazon EC2. The image processing workload stores checkpoint data on an NFS volume and can tolerate interruptions. Provisioning the cluster software on an EC2 Linux AMI takes 30 minutes.

    • A. Use Amazon EFS for checkpoint data. To run the workload, use an EC2 Auto Scaling group with the On-Demand pricing model to temporarily provision EC2 instances.
    • B. Use GlusterFS on EC2 instances for checkpoint data. To run batch jobs, manually configure EC2 instances. After job completion, manually terminate the instances.
    • C. Use Amazon EFS for checkpoint data. Use EC2 Fleet to launch EC2 Spot Instances and use user data scripts to configure EC2 Linux instances at launch.
    • D. Use Amazon EFS for checkpoint data. Use EC2 Fleet to launch EC2 Spot Instances. Create a custom AMI pre-configured with the cluster software and use the latest AMI when launching instances.

    View question →

100. Q100. A DevOps engineer wants a solution to migrate an application from on-premises to AWS. The application runs on Linux and requires specific versions of Apache Tomcat, HAProxy, and Varnish Cache to operate correctly. Operating system-level parameters must also be tuned. The solution must support automated deployment of new application versions. Infrastructure must be scalable, and failed servers must be automatically replaced.

     • A. Upload the application—including all required software—as a Docker image to Amazon ECR. Create an Amazon ECS cluster using the AWS Fargate launch type and an Auto Scaling group. Create an AWS CodePipeline pipeline using Amazon ECR as the source and Amazon ECS as the deployment provider.
     • B. Upload the application code to an AWS CodeCommit repository with saved configuration files to install and configure software. Create an AWS Elastic Beanstalk web server environment using the Tomcat solution stack with load balancing. Create an AWS CodePipeline pipeline using CodeCommit as the source and Elastic Beanstalk as the deployment provider.
     • C. Upload the application code to an AWS CodeCommit repository using .ebextensions files to configure and install software. Create an AWS Elastic Beanstalk worker environment using the Tomcat solution stack. Create an AWS CodePipeline pipeline using CodeCommit as the source and Elastic Beanstalk as the deployment provider.
     • D. Upload the application code to an AWS CodeCommit repository using an appspec.yml file to configure and install required software. Create an AWS CodeDeploy deployment group associated with an Amazon EC2 Auto Scaling group. Create an AWS CodePipeline pipeline using CodeCommit as the source and CodeDeploy as the deployment provider.

     View question →