AWS DOP-C02 Chapter 3 Practice Questions (100 Questions)

Practice questions for the AWS DOP-C02 (DevOps Engineer Professional) exam, Chapter 3.

1. Q1. A company grants limited access to airline loyalty programs to its employees. DevOps engineers need the ability to assume administrator roles. To track this, the security team wants to receive near-real-time notifications when an administrator role is assumed.

   • A. Configure AWS Config to publish logs to an Amazon S3 bucket. Use Amazon Athena to query logs and send notifications to the security team when an administrator role is assumed.
   • B. Configure Amazon GuardDuty to monitor when administrator roles are assumed and send notifications to the security team.
   • C. Create an Amazon EventBridge rule using the AWS Management Console sign-in event pattern to publish a message to an Amazon SNS topic when an administrator role is assumed.
   • D. Develop an AWS Lambda function triggered by an AWS CloudTrail event pattern that publishes a message to an Amazon SNS topic when an administrator role is assumed.

   View question →

2. Q2. A company runs multiple applications in the same AWS account. The applications send logs to Amazon CloudWatch. A data analytics team needs to collect performance metrics and custom metrics from the applications. The analytics team needs to transform the metric data first and then store it in an Amazon S3 bucket. The analytics team wants automatic collection of any new metrics added to CloudWatch namespaces. Which solution meets these requirements with the least operational overhead?

   • A. Configure a CloudWatch Metrics Stream to include metrics from the applications and CloudWatch namespaces. Configure the metrics stream to deliver metrics to an Amazon Kinesis Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
   • B. Configure a CloudWatch Metrics Stream to include all metrics and deliver them to an Amazon Kinesis Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
   • C. Configure metric filters on CloudWatch Logs to create custom metrics. Configure a CloudWatch Metrics Stream to deliver application metrics to the S3 bucket.
   • D. Configure subscription filters on the application log groups to target an Amazon Kinesis Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

   View question →

3. Q3. A company uses an Amazon Aurora PostgreSQL DB cluster and loads transactional data into the database every five minutes. Data analysts use the Aurora PostgreSQL database to run short-running queries, create complex aggregations, and generate simple reports based on this data. Data analysts also manually update data, including deleting and inserting records. Data analysts report performance issues. The database team recently identified long-running queries blocking other queries and idle transactions preventing VACUUM operations from maintaining performance. The team wants proactive visibility into these potential operational issues and recommended remediation actions. The company’s AWS account uses Amazon DevOps Guru to monitor operational applications in the account. Which solution meets these requirements?

   • A. Enable Performance Insights and DevOps Guru on the existing Aurora PostgreSQL DB cluster. Configure DevOps Guru to send notifications to the database team using Amazon Simple Notification Service (Amazon SNS).
   • B. Enable Performance Insights on the existing Aurora PostgreSQL DB cluster. Configure Amazon EventBridge to receive events from the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the database team using Amazon Simple Notification Service (Amazon SNS).
   • C. Enable Performance Insights and DevOps Guru on the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the database team using Amazon Simple Email Service (Amazon SES).
   • D. Enable Performance Insights on the existing Aurora PostgreSQL DB cluster. Configure Amazon EventBridge to receive events from the existing Aurora PostgreSQL DB cluster. Configure DevOps Guru to use Amazon Simple Notification Service (Amazon SNS).

   View question →

4. Q4. A company’s DevOps engineer uses AWS Systems Manager to perform maintenance tasks during maintenance windows. The company has an Amazon EC2 instance that must be restarted upon receiving an AWS Health notification. The DevOps engineer needs to implement an automated solution to remediate these notifications. The DevOps engineer creates an Amazon EventBridge rule. How should the DevOps engineer configure the EventBridge rule to meet these requirements?

   • A. Configure AWS Health as the event source, specifying EC2 as the service and events indicating instance maintenance. Use a Systems Manager document as the target to restart the EC2 instance.
   • B. Configure Systems Manager as the event source and events indicating maintenance windows. Use a Systems Manager document as the target to restart the EC2 instance.
   • C. Configure AWS Health as the event source, EC2 as the service, and events indicating instance maintenance. Use a newly created AWS Lambda function as the target, which registers an automation task to restart the EC2 instance during the maintenance window.
   • D. Configure EC2 as the event source and events indicating instance maintenance. Use a newly created AWS Lambda function as the target, which registers an automation task to restart the EC2 instance during the maintenance window.

   View question →

5. Q5. A company’s application development team uses Linux-based Amazon EC2 instances as bastion hosts. SSH access to the bastion hosts is restricted to specific IP addresses, as defined in associated security groups. If the security group rules are modified to allow SSH access from any IP address, the company’s security team wants to receive notifications. What should a DevOps engineer do to meet this requirement?

   • A. Create an Amazon EventBridge rule with aws.cloudtrail as the source and the event name AuthorizeSecurityGroupIngress. Define an Amazon Simple Notification Service (Amazon SNS) topic as the target.
   • B. Enable Amazon GuardDuty and review security group findings in AWS Security Hub. Configure an Amazon EventBridge rule with a custom pattern matching GuardDuty events with output NON_COMPLIANT. Define an Amazon Simple Notification Service (Amazon SNS) topic as the target.
   • C. Create an AWS Config rule using the restricted-ssh managed rule to check whether security groups prohibit unrestricted inbound SSH traffic. Configure auto-remediation to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
   • D. Enable Amazon Inspector. Include the CVE-1.1 rule package to assess security groups associated with bastion hosts. Configure Amazon Inspector to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.

   View question →

6. Q6. A company hosts applications in a single AWS account. The applications use an Amazon S3 bucket to store objects containing sensitive information. The company needs to capture object-level S3 API calls, including calls that are denied due to invalid credentials. Which solution meets these requirements?

   • A. Create an AWS CloudTrail trail in the account. Enable S3 data event logging. Configure the trail to log to Amazon CloudWatch.
   • B. Create a new S3 bucket. Configure access logging on the application’s S3 bucket. Grant permissions to deliver logs to the new S3 bucket.
   • C. Configure Amazon GuardDuty and enable S3 protection for the account. Create an Amazon EventBridge rule matching discoveries associated with the S3 bucket. Configure the rule to use an Amazon Simple Queue Service (Amazon SQS) queue as the target.
   • D. Create an AWS CloudTrail trail and a new S3 bucket in the account. Configure the trail to log to the new S3 bucket.

   View question →

7. Q7. A company has a legacy Go application deployment. DevOps engineers want to migrate the application to AWS. The company’s development team wants to enable blue/green deployments and perform A/B testing. Which solution meets these requirements?

   • A. Deploy the application on Amazon EC2 instances and create an AMI from the instance. Use this AMI to create an Auto Scaling launch configuration used by an Auto Scaling group. Use an Elastic Load Balancer to distribute traffic. When changes are made to the application, create a new AMI, triggering EC2 instance refreshes.
   • B. Deploy the application using Amazon Lightsail. Store the application in compressed format in an Amazon S3 bucket. Deploy new versions of the application to Lightsail using this compressed version. Use Lightsail deployment options to manage deployments.
   • C. Use AWS CodeArtifact to store application code. Use AWS CodeDeploy to deploy the application to a set of Amazon EC2 instances. Use Elastic Load Balancing to route traffic to the EC2 instances. When changes are made to the application, upload the new version to CodeArtifact and create a new CodeDeploy deployment.
   • D. Host the application using AWS Elastic Beanstalk. Store the compressed application version in Amazon S3 and deploy new versions using that location, managing deployments via Elastic Beanstalk.

   View question →

8. Q8. An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). A DevOps engineer is using AWS CodeDeploy to release a new version. The deployment fails during the AllowTraffic lifecycle event, but the deployment logs do not indicate the cause of failure. What could cause this?

   • A. The appspec.yml file contains an invalid script configured to run in the AllowTraffic lifecycle hook.
   • B. The user who initiated the deployment lacks necessary permissions to interact with the ALB.
   • C. The health check configuration specified for the ALB target group is misconfigured.
   • D. The CodeDeploy agent is not installed on the EC2 instances belonging to the ALB target group.

   View question →

9. Q9. A development team is building an e-commerce application and uses Amazon Simple Notification Service (Amazon SNS) to send order messages to multiple endpoints. One of those endpoints is an external HTTP endpoint that is not always available. If an order message fails to be delivered to the HTTP endpoint, the development team needs to be notified. What should a DevOps engineer do to meet these requirements?

   • A. Create an Amazon Simple Queue Service (Amazon SQS) queue. On the SNS topic, configure a redrive policy to send undelivered messages to the SQS queue. Create an Amazon CloudWatch alarm on the new SQS queue to notify the development team when messages arrive in the queue.
   • B. Create an Amazon Simple Queue Service (Amazon SQS) queue. On the HTTP endpoint subscription of the SNS topic, configure a redrive policy to send undelivered messages to the SQS queue. Create an Amazon CloudWatch alarm on the new SQS queue to notify the development team when messages arrive in the queue.
   • C. On the SNS topic, configure an HTTPS delivery policy that retries delivery until the order message is successfully sent. Configure the BackoffFunction parameter in the policy to notify the development team when the message fails to deliver within the configured constraints.
   • D. On the HTTP endpoint subscription of the SNS topic, configure an HTTPS delivery policy that retries delivery until the order message is successfully delivered. Configure the BackoffFunction parameter in the policy to notify the development team when the message fails to deliver within the configured constraints.

   View question →

10. Q10. A DevOps engineer is designing a deployment strategy for a SaaS web application running on AWS. For application and security reasons, customers subscribing to the application are distributed across multiple Application Load Balancers (ALBs), each associated with a dedicated Auto Scaling group and Amazon EC2 instance fleet. The application does not require a build stage; when committed to AWS CodeCommit, the application pipeline triggers a synchronous deployment to the corresponding ALB, Auto Scaling group, and EC2 instance fleet. Which architecture satisfies these requirements with the least configuration?

    • A. Create a single AWS CodePipeline that uses unique AWS CodeDeploy applications and deployment groups—each created for every ALB–Auto Scaling group pair—to deploy the application in parallel.
    • B. Create a single AWS CodePipeline that uses a single AWS CodeDeploy application and a single deployment group to deploy the application.
    • C. Create a single AWS CodePipeline that uses a single AWS CodeDeploy application and unique deployment groups—one for each ALB–Auto Scaling group pair—to deploy the application in parallel.
    • D. Create separate AWS CodePipelines for each ALB–Auto Scaling group pair, using an AWS CodeDeploy application and deployment group created for that same ALB–Auto Scaling group pair to deploy the application.

    View question →

11. Q11. A solutions architect needs to configure a blue/green deployment for an existing three-tier application. The application runs on Amazon EC2 instances and uses an Amazon RDS database. The EC2 instances run behind an Application Load Balancer (ALB) and are part of an Auto Scaling group. A DevOps engineer has created CloudFormation templates, Auto Scaling groups, and ALB target groups for both blue and green environments. Each target group specifies which application version (blue or green) will be loaded on the EC2 instances. Route 53 records point to the ALB endpoint. During deployment, traffic must be switched from the blue environment to the green environment immediately. Which solution satisfies these requirements?

    • A. Restart the Auto Scaling group for the green environment to deploy the new application version to green EC2 instances. After the rolling restart completes, use the AWS CLI command to update the ALB to route traffic to the green target group.
    • B. Use the AWS CLI command to update the ALB to route traffic to the green target group. Then initiate a rolling restart of the green Auto Scaling group to deploy the new application version to green EC2 instances.
    • C. Update the CloudFormation template to deploy the green application version to blue EC2 instances. Do not change target groups or Auto Scaling groups in either environment. Perform a rolling restart of blue EC2 instances.
    • D. Restart the Auto Scaling group for the green environment to deploy the new application version to green EC2 instances. After the rolling restart completes, update Route 53 to point to the green ALB endpoint.

    View question →

12. Q12. A company detects unusual login attempts across many AWS accounts. When multiple failed login attempts occur, a developer or DevOps engineer wants to implement a solution that sends notifications to the company’s security team. The engineer has already created an Amazon Simple Notification Service (Amazon SNS) topic and subscribed the security team to it. Which solution provides the most operational efficiency for delivering notifications?

    • A. Configure AWS CloudTrail to deliver management events to an Amazon CloudWatch Logs log group. Create a CloudWatch Logs metric filter to match failed console login events. Create a CloudWatch alarm based on the metric filter. Configure the alarm action to send a message to the SNS topic.
    • B. Configure AWS CloudTrail to deliver management events to an Amazon S3 bucket. Create an Amazon Athena query that returns failures if it finds failed logins in the S3 logs. Create an Amazon EventBridge rule to run the query periodically. Create a second EventBridge rule to detect when the query fails and send a message to the SNS topic.
    • C. Configure AWS CloudTrail to deliver data events to an Amazon CloudWatch Logs log group. Create a CloudWatch Logs metric filter to match failed console login events. Create a CloudWatch alarm based on the metric filter. Configure the alarm action to send a message to the SNS topic.
    • D. Configure AWS CloudTrail to deliver data events to an Amazon S3 bucket. Configure Amazon S3 event notifications for the s3:ObjectCreated event type. Filter for failure events. Configure the event notification to forward to the SNS topic.

    View question →

13. Q13. A company recently launched an application that became more popular than expected. The company wants to ensure the application can scale to meet growing demand and achieve high availability across multiple Availability Zones (AZs). The application runs on a set of Amazon EC2 instances behind an Application Load Balancer (ALB). A DevOps engineer created an Auto Scaling group spanning multiple AZs for the application. However, EC2 instances launched in newly added AZs receive no traffic from the application. What could cause this issue?

    • A. An Auto Scaling group can launch new instances only in a single AZ.
    • B. EC2 instances have not been manually registered with the ALB.
    • C. The ALB should be replaced with a Network Load Balancer (NLB).
    • D. The new AZ has not been added to the ALB.

    View question →

14. Q14. A company is deploying a new application using Amazon EC2 instances. The company needs a solution to query application logs and AWS account API activity. Which solution satisfies these requirements?

    • A. Use the Amazon CloudWatch Agent to send logs from EC2 instances to Amazon CloudWatch Logs. Configure AWS CloudTrail to deliver API logs to Amazon S3. Use CloudWatch to query both log sets.
    • B. Use the Amazon CloudWatch Agent to send logs from EC2 instances to Amazon CloudWatch Logs. Configure AWS CloudTrail to deliver API logs to CloudWatch Logs. Use CloudWatch Logs Insights to query both log sets.
    • C. Use the Amazon CloudWatch Agent to send logs from EC2 instances to Amazon Kinesis. Configure AWS CloudTrail to deliver API logs to Kinesis. Use Kinesis to load data into Amazon Redshift. Use Amazon Redshift to query both log sets.
    • D. Use the Amazon CloudWatch Agent to send logs from EC2 instances to Amazon S3. Use AWS CloudTrail to deliver API logs to Amazon S3. Use Amazon Athena to query both log sets in Amazon S3.

    View question →

15. Q15. A DevOps engineer uses AWS WAF to manage web ACLs across AWS accounts. The DevOps engineer wants to ensure AWS WAF is enabled for the Application Load Balancer (ALB) serving the application in each account. The DevOps engineer uses an AWS CloudFormation template to deploy a single ALB and AWS WAF as part of each application stack deployment. After deployment, AWS WAF must be automatically added to the ALB. Which solution meets these requirements with the MOST operational efficiency?

    • A. Enable AWS Config. Add the managed rule 'alb-waf'. Create an AWS Systems Manager Automation document to associate AWS WAF with the ALB. Edit the rule to enable automatic remediation and select the Systems Manager Automation document as the remediation action.
    • B. Enable AWS Config. Add the managed rule 'alb-waf'. Create an Amazon EventBridge rule to send all AWS Config configuration item change notifications to an AWS Lambda function. Configure the Lambda function to call the AWS Config start-resource-evaluation API in detective mode.
    • C. Configure an Amazon EventBridge rule to invoke an AWS Lambda function periodically. The Lambda function calls the CloudFormation drift detection API. Configure the Lambda function to modify the ALB property to 'true' if the AWS::WAFv2::WebACLAssociation resource shows drift and 'waf.alb_open.enabled' is enabled.
    • D. Configure an Amazon EventBridge rule to invoke an AWS Lambda function periodically. The Lambda function calls the CloudFormation drift detection API. Configure the Lambda function to delete and redeploy the CloudFormation stack if the AWS::WAFv2::WebACLAssociation resource shows drift.

    View question →

16. Q16. A DevOps team created a custom AWS Config rule using an AWS Lambda function. The rule monitors ECR repository policy statements for ECR:* actions. When a noncompliant repository is detected, Amazon EventBridge uses Amazon Simple Notification Service (Amazon SNS) to route notifications to the security team. When evaluating the custom AWS Config rule, the AWS Lambda function fails to execute. Which solution resolves this?

    • A. Modify the Lambda function’s resource policy to grant AWS Config permission to invoke the function.
    • B. Modify the SNS topic policy to allow EventBridge to publish to the SNS topic upon configuration changes.
    • C. Modify the Lambda function’s execution role to include permissions for custom AWS Config rule evaluation.
    • D. Modify all ECR repository policies to grant AWS Config access to necessary ECR API operations.

    View question →

17. Q17. A company is implementing a Well-Architected design for a globally accessible API stack. The design must ensure high availability and low latency for customers in North America and Europe. The API stack consists of the following three layers: Amazon API Gateway AWS Lambda Amazon DynamoDB Which solution satisfies these requirements?

    • A. Configure Amazon Route 53 with health checks to route traffic to API Gateway APIs in North America and Europe. Configure the APIs to forward requests to Lambda functions in the same region. Configure Lambda functions to retrieve and update data in DynamoDB tables located in the same region.
    • B. Configure Amazon Route 53 with latency-based routing and health checks to route traffic to API Gateway APIs in North America and Europe. Configure the APIs to forward requests to Lambda functions in the same region. Configure Lambda functions to retrieve and update data in DynamoDB Global Tables.
    • C. Configure Amazon Route 53 to point to the North American API Gateway and create a disaster recovery API in Europe. Configure both APIs to forward requests to Lambda functions in their respective regions. Retrieve data from DynamoDB Global Tables. Deploy Lambda functions to check North American API health every 5 minutes and update Route 53 to point to the disaster recovery API if a failure occurs.
    • D. Configure Amazon Route 53 with latency-based routing to point to the North American API Gateway API. Configure the API to forward requests to Lambda functions in the region closest to the user. Configure Lambda functions to retrieve and update data in DynamoDB tables.

    View question →

18. Q18. A company has migrated a container-based application to Amazon EKS and wants to set up automated email notifications. Each email address should receive notifications for specific activities related to EKS components. The solution will include an Amazon SNS topic and an AWS Lambda function to evaluate individual log events and publish messages to the correct SNS topic. Which logging solution supports these requirements?

    • A. Enable Amazon CloudWatch Logs to log EKS components. Use Lambda as a subscription filter destination to create a CloudWatch Logs subscription filter for each component.
    • B. Enable Amazon CloudWatch Logs to log EKS components. Create a CloudWatch Logs Insights query linked to an Amazon EventBridge event that invokes Lambda.
    • C. Enable Amazon S3 logging for EKS components. Configure Amazon CloudWatch subscription filters with Lambda as the subscription destination for each component.
    • D. Enable Amazon S3 logging for EKS components. Configure S3 PUT object event notifications with AWS Lambda as the target.

    View question →

19. Q19. A security audit found that an AWS CodeBuild project is downloading database population scripts from an Amazon S3 bucket using unauthenticated requests. The security team prohibits unauthenticated requests to the project’s S3 bucket. How can this be corrected in the most secure way?

    • A. Add the bucket name to the AllowedBuckets section in the CodeBuild project settings. Update the buildspec to download the database population script using the AWS CLI.
    • B. Modify the S3 bucket configuration to enable HTTPS basic authentication and specify a token. Update the buildspec to use cURL to pass the token and download the database population script.
    • C. Use a bucket policy to remove unauthenticated access from the S3 bucket. Modify the CodeBuild project’s service role to include Amazon S3 permissions. Use the AWS CLI to download the database population script.
    • D. Use a bucket policy to remove unauthenticated access from the S3 bucket. Use the AWS CLI with IAM access keys and secret access keys to download the database population script.

    View question →

20. Q20. A company uses AWS and operates a VPC containing critical compute infrastructure with predictable traffic patterns. The company has configured VPC Flow Logs, published to a log group in Amazon CloudWatch Logs. The DevOps team needs to configure a monitoring solution for VPC Flow Logs to detect anomalies in network traffic to the VPC within one minute. When an anomaly is detected, the company must be able to initiate a response. How should the DevOps team configure the monitoring solution to meet these requirements?

    • A. Create an Amazon Kinesis data stream. Subscribe the log group to the data stream. Configure Amazon Kinesis Data Analytics to detect anomalies in the log stream. Create an AWS Lambda function as the data stream output. Configure the Lambda function to write to the default Amazon EventBridge event bus when an anomaly is detected.
    • B. Create an Amazon Kinesis Data Firehose delivery stream to deliver events to an Amazon S3 bucket. Subscribe the log group to the delivery stream. Configure Amazon Lookout for Metrics to monitor the S3 bucket for anomalies. Create an AWS Lambda function to run in response to anomaly detection. Configure the Lambda function to publish to the default Amazon EventBridge event bus.
    • C. Create an AWS Lambda function to detect anomalies. Configure the Lambda function to publish events to the default Amazon EventBridge event bus if an anomaly is detected. Subscribe the log group to the Lambda function.
    • D. Create an Amazon Kinesis data stream. Subscribe the log group to the data stream. Create an AWS Lambda function to detect log anomalies. Configure the Lambda function to write to the default Amazon EventBridge event bus when an anomaly is detected. Set the Lambda function as the data stream processor.

    View question →

21. Q21. A company’s DevOps engineer works in a multi-account environment. The company uses AWS Transit Gateway to route cross-account traffic through a network operations account. In the network operations account, all cross-account traffic is inspected by firewall appliances before being routed to the internet gateway. The firewall appliances send logs to Amazon CloudWatch Logs, including events with severity levels: Critical, High, Medium, Low, and Informational. The security team wants to receive alerts whenever any Critical event occurs. How should the DevOps engineer meet these requirements?

    • A. Create an Amazon CloudWatch Synthetics canary to monitor firewall status. Use a CloudWatch alarm to publish notifications to an Amazon Simple Notification Service (Amazon SNS) topic if the firewall reaches a critical state or logs a critical event. Subscribe the security team’s email address to that topic.
    • B. Create an Amazon CloudWatch metric filter by searching for critical events. Publish custom metrics based on the filter results. Use a CloudWatch alarm based on the custom metric to publish notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team’s email address to that topic.
    • C. Enable Amazon GuardDuty in the network operations account. Configure GuardDuty to monitor flow logs. Create an Amazon EventBridge rule triggered by important GuardDuty findings. Define an Amazon Simple Notification Service (Amazon SNS) topic as the target. Subscribe the security team’s email address to that topic.
    • D. Use AWS Firewall Manager to apply consistent policies across all accounts. Create an Amazon EventBridge rule triggered by important Firewall Manager events. Define an Amazon Simple Notification Service (Amazon SNS) topic as the target. Subscribe the security team’s email address to that topic.

    View question →

22. Q22. A company developed a static website hosted on an Amazon S3 bucket. The website serves cloud imagery from astronomical observatories. A CloudFormation template defines the S3 bucket and a custom resource that copies content to the bucket. The company decided to move the website to a new location and attempted to delete and recreate the existing stack. However, CloudFormation reports that the stack cannot be cleanly deleted. What is the most likely cause, and how can this issue be mitigated for both this and future versions of the stack?

    • A. Deletion fails because the S3 bucket has an active website configuration. Modify the CloudFormation template to remove the WebsiteConfiguration property from the S3 bucket resource.
    • B. Deletion fails because the S3 bucket is not empty. Modify the custom resource’s AWS Lambda function code to recursively empty the bucket when a Delete request type is received.
    • C. Deletion fails because the custom resource does not define a deletion policy. Add a DeletionPolicy attribute with value Delete to the custom resource definition.
    • D. Deletion fails because the S3 bucket is not empty. Modify the S3 bucket resource in the CloudFormation template to add a DeletionPolicy attribute with an empty value.

    View question →

23. Q23. A company uses Amazon Elastic Container Registry (Amazon ECR) private registries to store container images. A development team needs to ensure container images are scanned regularly for software vulnerabilities. Which solution meets this requirement?

    • A. Enable enhanced scanning for the Amazon ECR private registry.
    • B. Enable basic continuous scanning for the Amazon ECR private registry.
    • C. Create an AWS Systems Manager Automation document that scans images using the AWS SDK. Configure the Automation document to run when a new image is pushed to the ECR registry.
    • D. Create an AWS Lambda function that scans all images in Amazon ECR using the AWS SDK. Create an Amazon EventBridge rule scheduled daily to invoke the Lambda function.

    View question →

24. Q24. The security team relies on AWS CloudTrail to detect sensitive security issues in the company’s AWS accounts. A DevOps engineer needs a solution to automatically remediate CloudTrail being disabled in AWS accounts. Which solution ensures the shortest possible downtime for CloudTrail log delivery?

    • A. Create an Amazon EventBridge rule for the CloudTrail StopLogging event. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource where StopLogging was invoked. Add the Lambda function ARN as the target of the EventBridge rule.
    • B. Deploy the AWS-managed CloudTrail-enabled AWS Config rule, configured for a 1-hour periodic evaluation. Create an Amazon EventBridge rule for AWS Config rule compliance changes. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource where StopLogging was invoked. Add the Lambda function ARN as the target of the EventBridge rule.
    • C. Create an Amazon EventBridge rule for a scheduled event every 5 minutes. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the CloudTrail trail in the AWS account. Add the Lambda function ARN as the target of the EventBridge rule.
    • D. Launch a t2.nano instance that runs a script every 5 minutes using the AWS SDK to query CloudTrail status in the current account. If the CloudTrail trail is disabled, have the script re-enable it.

    View question →

25. Q25. A DevOps engineer seeks a solution to migrate an application to AWS. The application runs on Linux and requires specific versions of Apache Tomcat, HAProxy, and Varnish Cache to operate correctly. Operating system-level parameters must be tuned. The solution must include automated deployment of new application versions. Infrastructure must be scalable, and failed servers must be automatically replaced.

    • A. Upload the application—including all required software—as a Docker image to Amazon ECR. Create an Amazon ECS cluster using the AWS Fargate launch type and Auto Scaling groups. Create an AWS CodePipeline with Amazon ECR as the source and Amazon ECS as the deployment provider.
    • B. Upload application code to an AWS CodeCommit repository with saved configuration files to install and configure software. Create an AWS Elastic Beanstalk web server environment using the Tomcat solution stack with load balancing. Create an AWS CodePipeline with CodeCommit as the source and Elastic Beanstalk as the deployment provider.
    • C. Upload application code to an AWS CodeCommit repository with .ebextensions files to configure and install software. Create an AWS Elastic Beanstalk worker environment using the Tomcat solution stack. Create an AWS CodePipeline with CodeCommit as the source and Elastic Beanstalk as the deployment provider.
    • D. Upload application code to an AWS CodeCommit repository with an appspec.yml file to configure and install required software. Create an AWS CodeDeploy deployment group associated with an Amazon EC2 Auto Scaling group. Create an AWS CodePipeline using CodeCommit as the source and CodeDeploy as the deployment provider.

    View question →

26. Q26. A company is running a mission-critical application on Amazon Elastic Kubernetes Service (Amazon EKS). The EKS cluster is successfully running multiple pods. The company stores pod images in Amazon Elastic Container Registry (Amazon ECR). The company needs to configure pod identity access for the EKS cluster. The company has already updated node IAM roles to enable pod identity access.

    • A. Create an IAM OpenID Connect (OIDC) provider for the EKS cluster.
    • B. Ensure nodes can reach the EKS API server. Add and configure the EKS Pod Identity Agent plugin for the EKS cluster.
    • C. Create an EKS access entry and use API server and configure cluster authentication mode.
    • D. Develop configuration of the AWS Security Token Service (AWS STS) endpoint for Kubernetes service accounts used by the EKS cluster's expansion components.

    View question →

27. Q27. A company is testing a web application running on Amazon EC2 instances behind an Application Load Balancer. These instances run in an Auto Scaling group spanning multiple Availability Zones. During deployment of new software, the company uses a blue/green deployment process. During the testing period, users are automatically logged out of the application. Testers report that all users are logged out when deploying the new version of the application. The development team needs a solution to ensure users remain logged in during scaling events and application deployments.

    • A. Enable intelligent session stickiness on the load balancer and modify the application to check for existing sessions.
    • B. Enable session sharing on the load balancer and modify the application to read from the session store.
    • C. Store user session information in an Amazon S3 bucket and modify the application to read session information from the bucket.
    • D. Modify the application to store user session information in an Amazon ElastiCache cluster.

    View question →

28. Q28. A DevOps engineer manages several legacy applications, each generating different log formats. The engineer wants to first standardize the formats and then write them to Amazon S3 for querying and analysis.

    • A. Have the applications send their logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3.
    • B. Have the applications send their logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs and perform analysis directly from Amazon QuickSight.
    • C. Store the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in-place.
    • D. Use Amazon Kinesis Agent on each server to upload logs, and use Amazon Kinesis Data Firehose with an AWS Lambda function to normalize the logs before writing them to Amazon S3.

    View question →

29. Q29. A company has 20 service teams. Each service team owns its own microservice and uses a separate AWS account with a VPC using the 192.168.0.0/22 CIDR block. The company manages AWS accounts using AWS Organizations. Each service team hosts its microservice on multiple Amazon EC2 instances behind an Application Load Balancer. Microservices communicate over the public internet. The company's security team issued a new policy requiring all inter-microservice communication to occur over private network connections using HTTPS, without traversing the public internet.

    • A. Create a new AWS account in AWS Organizations. In this account, create a VPC and share its private subnets with the organization using AWS Resource Access Manager. Instruct service teams to launch new Network Load Balancers (NLBs) and EC2 instances using the shared private subnets. Use NLB DNS names for inter-microservice communication.
    • B. Create a Network Load Balancer (NLB) in each microservice VPC. Use AWS PrivateLink to create VPC endpoints for each NLB in each AWS account. Create subscriptions to each VPC endpoint in every other AWS account. Use VPC endpoint DNS names for inter-microservice communication.
    • C. Create a Network Load Balancer (NLB) in each microservice VPC. Create VPC peering connections between each microservice VPC. Update routing tables in each VPC to use the peering connections. Use NLB DNS names for inter-microservice communication.
    • D. Create a new AWS account in AWS Organizations. In this account, create a Transit Gateway and share it with the organization using AWS Resource Access Manager. In each microservice VPC, create a Transit Gateway attachment to the shared Transit Gateway. Update routing tables in each VPC to route through the Transit Gateway. In each microservice VPC, create a Network Load Balancer (NLB). Use NLB DNS names for inter-microservice communication.

    View question →

30. Q30. A company runs applications on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster uses an Application Load Balancer to route traffic to applications running in the cluster. A newly migrated application performs poorly. All other applications in the EKS cluster continue operating normally. After deployment, the new application immediately scales horizontally to its preconfigured maximum number of pods before any user traffic is routed to the web application.

    • A. Implement Horizontal Pod Autoscaler (HPA) in the EKS cluster.
    • B. Implement Vertical Pod Autoscaler (VPA) in the EKS cluster.
    • C. Implement Cluster Autoscaler.
    • D. Implement AWS Load Balancer Controller in the EKS cluster.

    View question →

31. Q31. A company has an application using an Amazon Aurora MySQL-compatible multi-AZ DB cluster as its database. A cross-Region read replica has been created for disaster recovery purposes. A DevOps engineer wants to automatically promote the replica so it becomes the primary DB instance upon failure.

    • A. Configure a latency-based Amazon Route 53 CNAME with health checks pointing to the primary and replica endpoints. Subscribe an Amazon SNS topic to Amazon RDS failure notifications from AWS CloudTrail and trigger an AWS Lambda function via that topic to promote the replica instance to primary.
    • B. Create an Aurora custom endpoint pointing to the primary DB instance. Configure the application to use this endpoint. Configure AWS CloudTrail to invoke an AWS Lambda function to promote the replica instance and modify the custom endpoint to point to the newly promoted instance.
    • C. Create an AWS Lambda function to modify the application's AWS CloudFormation template to promote the replica, apply the template update to the stack, and reconfigure the application to point to the newly promoted instance. Create an Amazon CloudWatch alarm to trigger this Lambda function after a failure event.
    • D. Store the Aurora endpoint in AWS Systems Manager Parameter Store. Create an Amazon EventBridge (Amazon CloudWatch Events) event to detect database failure and run an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Systems Manager Parameter Store. Code the application to reload the endpoint from Parameter Store upon database connection failure.

    View question →

32. Q32. An application running on a set of Amazon EC2 instances in an Auto Scaling group requires configuration files to operate. These instances are created and maintained using AWS CloudFormation. A DevOps engineer wants instances to have the latest configuration files at launch and wants updates to configuration files reflected on running instances with minimal delay after CloudFormation template updates. Company policy requires application configuration files to be maintained alongside AWS infrastructure configuration files in source control.

    • A. In the CloudFormation template, add an AWS Config rule. Place configuration file content in the rule's InputParameters property and set the Scope property to the EC2 Auto Scaling group. Add an AWS Systems Manager Resource Data Sync resource to the template to poll for configuration updates.
    • B. In the CloudFormation template, add an EC2 Launch Template resource. Place configuration file content in the launch template. Configure the cfn-init script to run at instance launch and configure the cfn-hup script to poll for configuration updates.
    • C. In the CloudFormation template, add an EC2 Launch Template resource. Place configuration file content in the launch template. Add an AWS Systems Manager Resource Data Sync resource to the template to poll for configuration updates.
    • D. In the CloudFormation template, add CloudFormation Init metadata. Place configuration file content in the metadata. Configure the cfn-init script to run at instance launch and configure the cfn-hup script to poll for configuration updates.

    View question →

33. Q33. A company has containerized all its internal applications. The company runs Jenkins on Amazon EC2 instances, which require patching and upgrading. A compliance officer has directed the DevOps engineer to begin encrypting build artifacts, as they contain the company's intellectual property.

    • A. Use AWS Systems Manager to automatically patch and upgrade EC2 instances by default, and encrypt Amazon EBS volumes.
    • B. Deploy Jenkins to an Amazon ECS cluster and copy build artifacts to an Amazon S3 bucket with default encryption enabled.
    • C. Leverage AWS CodePipeline for build operations and use AWS Secrets Manager to encrypt artifacts.
    • D. Replace the Jenkins instance running on EC2 with AWS CodeBuild, which includes artifact encryption.

    View question →

34. Q34. A healthcare services company is concerned about escalating software licensing costs for applications that monitor patient health conditions. The company wants to create an audit process to ensure these applications run only on Amazon EC2 Dedicated Hosts. A DevOps engineer needs to build an automated workflow to audit the applications and ensure compliance. What steps should the engineer take to meet this requirement with minimal management overhead?

    • A. Use AWS Systems Manager Compliance. Use calls to the put-compliance-items API operation to scan and build a database of noncompliant EC2 instances based on host placement configuration. Store these instance IDs in an Amazon DynamoDB table for fast access. Generate reports via Systems Manager by calling the list-compliance-summaries API operation.
    • B. Use custom Java code running on EC2 instances. Set up EC2 Auto Scaling based on the number of instances to check. Send a list of noncompliant EC2 instance IDs to an Amazon SQS queue. Set up another worker instance to process instance IDs from the SQS queue and write them to Amazon DynamoDB. Use an AWS Lambda function to terminate noncompliant instances retrieved from the queue and send notifications to an Amazon SNS email topic.
    • C. Use AWS Config. Enable configuration recording for all Amazon EC2 resources in the region to identify all EC2 instances to be audited. Create a custom AWS Config rule using the 'config-rule-change-trigger' blueprint to invoke an AWS Lambda function. Modify the Lambda evaluateCompliance() function to verify host placement, returning a NON_COMPLIANT result if the instance is not running on an EC2 Dedicated Host. Use AWS Config reports to address noncompliant instances.
    • D. Use AWS CloudTrail. Identify all EC2 instances to be audited by analyzing all calls to the EC2 RunCommand API operation. Invoke an AWS Lambda function to analyze the instance's host placement. Store the EC2 instance IDs of noncompliant resources in an Amazon RDS for MySQL DB instance. Generate reports by querying the RDS instance and exporting results to a CSV text file.

    View question →

35. Q35. A company uses AWS Organizations to manage its AWS accounts. The organization root contains an organizational unit (OU) named Environments. The Environments OU contains two child OUs: Development and Production. Both the Environments OU and its child OUs have the default FullAWSAccess service control policy (SCP) attached. A DevOps engineer plans to remove the FullAWSAccess SCP from the Development OU and replace it with a new SCP that allows only actions on Amazon EC2 resources. What is the outcome of this policy replacement?

    • A. All users in the Development OU will be allowed to perform all API operations on all resources.
    • B. All users in the Development OU will be allowed to perform all API operations on EC2 resources. All other API operations will be denied.
    • C. All users in the Development OU will be denied all API operations on all resources.
    • D. All users in the Development OU will be denied all API operations on EC2 resources. All other API operations will be allowed.

    View question →

36. Q36. A company manages AWS accounts for application teams within an AWS Control Tower environment. Each application team is responsible for securing its own AWS account. A DevOps engineer needs to enable Amazon GuardDuty for AWS accounts where it has not yet been enabled. The DevOps engineer is using AWS CloudFormation StackSets from the AWS Control Tower management account. How should the DevOps engineer configure the CloudFormation template to prevent failures during StackSet deployments?

    • A. Create a CloudFormation custom resource that invokes an AWS Lambda function. Configure the Lambda function to conditionally enable GuardDuty only if it is not already enabled in the account.
    • B. Use the Conditions section of the CloudFormation template to enable GuardDuty in accounts where it is not yet enabled.
    • C. Use the CloudFormation Fn::GetAtt intrinsic function to check whether GuardDuty is enabled. If not enabled, use the Resources section of the CloudFormation template to enable GuardDuty.
    • D. Manually discover the list of AWS account IDs where GuardDuty is not enabled. Import this list into the CloudFormation template using the CloudFormation Fn::ImportValue intrinsic function to skip deployment for those AWS accounts.

    View question →

37. Q37. A company is migrating its container-based applications to Amazon EKS and wants to establish automated email notifications. Notifications sent to each email address must correspond to specific events related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate log events and publish messages to the appropriate SNS topic. Which logging solution supports these requirements?

    • A. Enable Amazon CloudWatch Logs to capture EKS component logs. Use Lambda as a subscription destination and create a CloudWatch Logs subscription filter for each component.
    • B. Enable Amazon CloudWatch Logs to capture EKS component logs. Create a CloudWatch Logs Insights query linked to an Amazon EventBridge event that invokes Lambda.
    • C. Enable Amazon S3 logging for EKS components. Use Lambda as a subscription destination and configure an Amazon CloudWatch Logs subscription filter for each component.
    • D. Enable Amazon S3 logging for EKS components. Configure S3 PUT object event notifications with AWS Lambda as the target.

    View question →

38. Q38. A company hosts a security audit application in an AWS account. The audit application uses IAM roles to access other AWS accounts. All target accounts reside in the same organization within AWS Organizations. A recent security audit revealed that users in the audited AWS accounts can modify or delete the IAM roles used by the audit application. The company needs to prevent any entity other than trusted administrator IAM roles from modifying the audit application’s IAM roles. Which solution meets these requirements?

    • A. Create an SCP containing a Deny statement targeting IAM role modifications for the audit application. Include a condition allowing changes by trusted administrator IAM roles. Attach the SCP to the organization root.
    • B. Create an SCP containing an Allow statement permitting trusted administrator IAM roles to modify the audit application’s IAM roles. Include Deny statements for all other IAM principals attempting such modifications. Attach the SCP to the IAM service in each AWS account where the audit application has IAM roles.
    • C. Create an IAM permissions boundary containing a Deny statement targeting IAM role modifications for the audit application. Include a condition allowing changes by trusted administrator IAM roles. Attach the permissions boundary to the audited AWS accounts.
    • D. Create an IAM permissions boundary containing a Deny statement targeting IAM role modifications for the audit application. Include a condition allowing changes by trusted administrator IAM roles. Attach the permissions boundary to the IAM roles used by the audit application in the AWS account.

    View question →

39. Q39. A DevOps engineer is using AWS CodePipeline to build a multi-stage pipeline for building, validating, staging, testing, and deploying applications. A manual approval stage is required between the test and deploy stages. The development team uses a chat tool with webhook support that requires near real-time notifications. How should the DevOps engineer configure channels to deliver pipeline activity and approval request status updates to the chat tool?

    • A. Create an Amazon CloudWatch Logs subscription to filter changes in CodePipeline execution status. Publish subscription events to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the chat webhook URL to the SNS topic and complete subscription verification.
    • B. Create an AWS Lambda function invoked by AWS CloudTrail events. When a CodePipeline pipeline execution status change event is detected, send event details to the chat webhook URL.
    • C. Create an Amazon EventBridge rule to filter CodePipeline execution status changes. Publish events to an Amazon Simple Notification Service (Amazon SNS) topic. Create an AWS Lambda function that sends event details to the chat webhook URL. Subscribe the Lambda function to the SNS topic.
    • D. Modify the pipeline code to send event details to the chat webhook URL at the end of each stage. Parameterize the URL so each pipeline can send to different URLs based on pipeline environment.

    View question →

40. Q40. A company’s web application uses an Application Load Balancer (ALB) to distribute traffic across Amazon EC2 instances in three Availability Zones. The company has deployed a new version of the application to one Availability Zone for testing. If issues are discovered, the company wants to redirect traffic away from the affected Availability Zone back to the previously deployed version before rollback. During the rollback process, the application must remain available and maintain state stability.

    • A. Disable cross-zone load balancing on the ALB target group. Initiate zone draining on the ALB to divert traffic away from the affected Availability Zone.
    • B. Disable cross-zone load balancing on the ALB target group. Manually deregister instances in the affected Availability Zone from the target group.
    • C. Configure cross-zone load balancing on the ALB target group to inherit settings from the ALB. Initiate zone draining on the ALB to divert traffic away from the affected Availability Zone.
    • D. Configure cross-zone load balancing on the ALB target group to inherit settings from the ALB. Delete the subnet associated with the affected Availability Zone.

    View question →

41. Q41. A company has 20 service teams. Each service team owns its microservice and uses a separate AWS account with a VPC using the 192.168.0.0/22 CIDR block. The company manages AWS accounts using AWS Organizations. Each service team hosts its microservice on multiple Amazon EC2 instances behind an Application Load Balancer. Microservices communicate over the public internet. The company’s security team issued a new directive requiring all inter-microservice communication to occur over private network connections using HTTPS, without traversing the public internet. A DevOps engineer must implement a solution to comply with these requirements while minimizing changes required for each service team. Which solution meets these requirements?

    • A. Create a new AWS account in AWS Organizations. In this account, create a VPC and share its private subnets with the organization using AWS Resource Access Manager. Instruct service teams to launch new Network Load Balancers (NLBs) and EC2 instances using the shared private subnets. Use NLB DNS names for inter-microservice communication.
    • B. Create a Network Load Balancer (NLB) in each microservice VPC. Use AWS PrivateLink to create VPC endpoints for the NLB in each AWS account. Create subscriptions to each VPC endpoint in every other AWS account. Use VPC endpoint DNS names for inter-microservice communication.
    • C. Create a Network Load Balancer (NLB) in each microservice VPC. Create VPC peering connections between each microservice VPC. Update routing tables in each VPC to use the peering connections. Use NLB DNS names for inter-microservice communication.
    • D. Create a new AWS account in AWS Organizations. In this account, create a Transit Gateway and share it with the organization using AWS Resource Access Manager. In each microservice VPC, create a Transit Gateway attachment to the shared Transit Gateway. Update routing tables in each VPC to route via the Transit Gateway. Create an NLB in each microservice VPC. Use NLB DNS names for inter-microservice communication.

    View question →

42. Q42. An application running on a set of Amazon EC2 instances in an Auto Scaling group requires configuration files to operate. These instances are created and maintained using AWS CloudFormation. A DevOps engineer wants instances to have the latest configuration files upon launch and wants changes to the configuration files in the CloudFormation template to be reflected on running instances with minimal delay. Company policy requires application configuration files to be maintained alongside AWS infrastructure configuration files in source control.

    • A. In the CloudFormation template, add an AWS Config rule. Place the configuration file content in the rule's InputParameters property and set the Scope property to the EC2 Auto Scaling group. Add an AWS Systems Manager Resource Data Sync resource to the template to poll for configuration updates.
    • B. In the CloudFormation template, add an EC2 Launch Template resource. Place the configuration file content in the launch template. Configure the cfn-init script to run at instance launch and configure the cfn-hup script to poll for configuration updates.
    • C. In the CloudFormation template, add an EC2 Launch Template resource. Place the configuration file content in the launch template. Add an AWS Systems Manager Resource DataSync resource to the template to poll for configuration updates.
    • D. In the CloudFormation template, add CloudFormation Init metadata. Place the configuration file content in the metadata. Configure the cfn-init script to run at instance launch and configure the cfn-hup script to poll for configuration updates.

    View question →

43. Q43. A company uses Amazon S3 to store sensitive information. The development team creates new buckets daily for new projects. The security team wants to ensure that both existing and newly created buckets have encryption, logging, and versioning enabled. Additionally, no bucket should be publicly writable.

    • A. Enable AWS CloudTrail and configure automatic remediation using AWS Lambda.
    • B. Enable AWS Config rules using AWS Systems Manager Documents and configure automatic remediation.
    • C. Enable AWS Trusted Advisor using Amazon EventBridge and configure automatic remediation.
    • D. Enable AWS Systems Manager and configure automatic remediation using Systems Manager Documents.

    View question →

44. Q44. A company wants to replace its current bash deployment scripts with AWS developer tools. Currently, it deploys a LAMP application to a set of Amazon EC2 instances behind an Application Load Balancer (ALB). During deployment, the company runs unit tests on the submitted application, stops and starts services, deregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to retain the same deployment functionality by adopting AWS services.

    • A. Use AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services and deregister/register instances with the ALB. Use the appspec.yml file to update file permissions without custom scripts.
    • B. Use AWS CodePipeline to move the application from an AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy's deployment group to test the application, deregister/re-register instances with the ALB, and restart services. Use the appspec.yml file to update file permissions without custom scripts.
    • C. Use AWS CodePipeline to move the application source code from an AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy to test the application. Use CodeDeploy's appspec.yml file to restart services and update permissions without custom scripts. Use AWS CodeBuild to deregister and re-register instances with the ALB.
    • D. Use AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services. Deregister and re-register instances in the ALB from the AWS CodeDeploy deployment group. Update the appspec.yml file to update file permissions without custom scripts.

    View question →

45. Q45. A company uses lift-and-shift strategies to migrate workloads from on-premises to AWS. It has an Amazon EC2 Auto Scaling group. Each EC2 instance runs a web application, a database, and a Redis cache. Users are experiencing significant latency issues with the web application. Requests to the web application are bottlenecked on a single EC2 instance under variable load. The company wants to decouple application components to improve scalability and performance.

    • A. Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Application Load Balancer and an Auto Scaling group for the Redis cache.
    • B. Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database with Multi-AZ deployment. Create a Network Load Balancer and an Auto Scaling group for the Redis cache in a single Availability Zone.
    • C. Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Amazon ElastiCache cluster for caching. Create a target group with DNS target type containing the ElastiCache cluster hostname.
    • D. Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database with Multi-AZ deployment. Create an Amazon ElastiCache cluster for caching.

    View question →

46. Q46. A company has a Go-based internal application. A DevOps engineer is tasked with migrating the application to AWS. The company's development team wants to enable blue/green deployments and perform A/B testing.

    • A. Deploy the application on Amazon EC2 instances and create an AMI of the instance. Use the AMI to create an Auto Scaling launch configuration used by the Auto Scaling group. Use Elastic Load Balancing to distribute traffic. When changes are made to the application, create a new AMI, triggering EC2 instance refreshes.
    • B. Deploy the application using Amazon Lightsail. Store the application in compressed format in an Amazon S3 bucket. Deploy new versions of the application to Lightsail using this compressed version. Use Lightsail deployment options to manage deployments.
    • C. Use AWS CodeArtifact to store application code. Use AWS CodeDeploy to deploy the application to an Amazon EC2 instance fleet. Use Elastic Load Balancing to distribute traffic across EC2 instances. When changes are made to the application, upload a new version to CodeArtifact and create a new CodeDeploy deployment.
    • D. Use AWS Elastic Beanstalk to host the application. Store the compressed application version in Amazon S3. Deploy new application versions using this location. Use Elastic Beanstalk to manage deployment options.

    View question →

47. Q47. A development team uses AWS CodeCommit for version control of application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote main branch as the pipeline's trigger event for infrastructure-as-code changes. After a developer pushes a code change to the CodeCommit repository, they notice the pipeline does not respond—and remains untriggered even after 10 minutes.

    • A. Check whether an Amazon EventBridge rule has been created for the main branch to trigger the pipeline.
    • B. Verify whether the CodePipeline service role has permissions to access the CodeCommit repository.
    • C. Check whether the developer's IAM role has permissions to push to the CodeCommit repository.
    • D. Check whether the pipeline fails to start due to CodeCommit errors in Amazon CloudWatch Logs.

    View question →

48. Q48. A company uses AWS CodeDeploy to automate deployments of a Java-Apache Tomcat application running on Apache web servers. The development team has completed initial setup, creating a deployment group for the development environment and performing functional testing within the application. Next, the team will create additional deployment groups for staging and production.

    • A. Tag Amazon EC2 instances according to the deployment group. Then include a script in the application revision that calls the metadata service and EC2 API to determine which deployment group the instance belongs to. Use this information to configure log level settings. Reference this script in the appspec.yml file as part of the AfterInstall lifecycle hook.
    • B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_NAME to identify which deployment group the instance belongs to. Use this information to configure log level settings. In the appspec.yml file, reference this script as part of the BeforeInstall lifecycle hook.
    • C. Create a CodeDeploy custom environment variable for each environment. Then place a script in the application revision that checks this environment variable to determine which deployment group the instance belongs to. Use this information to configure log level settings. In the appspec.yml file, reference this script as part of the ValidateService lifecycle hook.
    • D. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance belongs to, to configure log level settings. Reference this script in the appspec.yml file as part of the Install lifecycle hook.

    View question →

49. Q49. A company operates a data ingestion application across multiple AWS accounts within an organization in AWS Organizations. The company needs to monitor the application and consolidate access to it. Currently, the application runs on Amazon EC2 instances across multiple Auto Scaling groups. The EC2 instances cannot access the internet because the data is sensitive. Engineers have deployed required VPC endpoints. The EC2 instances run a custom AMI built specifically for the application.

    • A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to notify the security team when users log in to EC2 instances. Use EC2 Instance Connect to log in to instances. Use AWS CloudFormation to deploy the Auto Scaling group. Use the cfn-init helper script to deploy appropriate VPC routes for external access. Rebuild the custom AMI to include the AWS Systems Manager Agent.
    • B. Deploy a NAT gateway and an internet-facing bastion host. Create a security group allowing inbound traffic from the bastion host to all EC2 instances. Install the AWS Systems Manager Agent on all EC2 instances. Use Auto Scaling group lifecycle hooks to monitor and audit access. Use Systems Manager Session Manager to log in to instances. Send logs to a log group in Amazon CloudWatch Logs. Export data to Amazon S3 for auditing. Use S3 event notifications to send alerts to the security team.
    • C. Rebuild the custom AMI using EC2 Image Builder. Include the latest version of the AWS Systems Manager Agent in the image. Configure the Auto Scaling group to attach the AmazonSSMManagedInstanceCore role to all EC2 instances. Use Systems Manager Session Manager to log in to instances. Enable logging of session details to Amazon S3. Create S3 notifications for new file uploads to send messages via an Amazon Simple Notification Service (Amazon SNS) topic to the security team.
    • D. Use AWS Systems Manager Automation to build the Systems Manager Agent into the custom AMI. Configure AWS Config to attach a Service Control Policy (SCP) to the root organizational unit to allow EC2 instances to connect to Systems Manager. Use Systems Manager Session Manager to log in to instances. Enable logging of session details to Amazon S3. Create S3 notifications for new file uploads to send messages via an Amazon Simple Notification Service (Amazon SNS) topic to the security team.

    View question →

50. Q50. A modern enterprise is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. These instances run in an Auto Scaling group spanning multiple Availability Zones. The application stores data in an Amazon RDS for Oracle database instance and Amazon DynamoDB. Separate environments exist for development, testing, and production. What is the most secure and scalable method to retrieve credentials during deployment?

    • A. Retrieve access keys from AWS Systems Manager SecureString parameters to access AWS services. Retrieve database credentials from Systems Manager SecureString parameters.
    • B. Launch EC2 instances with an EC2 IAM role to access AWS services. Retrieve database credentials from AWS Secrets Manager.
    • C. Retrieve access keys from AWS Systems Manager plaintext parameters to access AWS services. Retrieve database credentials from Systems Manager SecureString parameters.
    • D. Launch EC2 instances with an EC2 IAM role to access AWS services. Store database passwords alongside application artifacts in an encrypted configuration file.

    View question →

51. Q51. A software team is using AWS CodePipeline to automate the release pipeline for a Java application. The pipeline consists of source, build, and deploy stages. Each stage contains one action with a runOrder value of 1. The team wants to incorporate unit testing into the existing release pipeline. The team needs a solution that deploys code only if unit tests pass. Which solution meets these requirements?

    • A. Modify the build stage. Add a test action with runOrder value 1. Use AWS CodeDeploy as the action provider to run unit tests.
    • B. Modify the build stage. Add a test action with runOrder value 2. Use AWS CodeBuild as the action provider to run unit tests.
    • C. Modify the deploy stage. Add a test action with runOrder value 1. Use AWS CodeDeploy as the action provider to run unit tests.
    • D. Modify the deploy stage. Add a test action with runOrder value 2. Use AWS CodeBuild as the action provider to run unit tests.

    View question →

52. Q52. AnyCompany uses AWS Organizations to create and manage multiple AWS accounts. AnyCompany recently acquired a competitor, Example Corp. During the acquisition process, Example Corp’s single AWS account joined AnyCompany’s management account via an organization invitation. AnyCompany moved the new member account into an OU dedicated to Example Corp. AnyCompany’s DevOps engineers have an IAM user that assumes a role named OrganizationAccountAccessRole to access member accounts. This role is configured with full administrative permissions. When a DevOps engineer attempts to assume the role in the new Example Corp member account using the AWS Management Console, they receive the following error: 'One or more parameters in the request are invalid. Please check your information or contact your administrator.' Which solution enables the DevOps engineer to access the new member account?

    • A. In the management account, grant the DevOps engineer’s IAM user permission to assume the OrganizationAccountAccessRole IAM role in the new member account.
    • B. In the management account, create a new SCP. In the SCP, grant the DevOps engineer’s IAM user full access to all resources in the new member account. Attach the SCP to the OU containing the new member account.
    • C. In the new member account, create a new IAM role named OrganizationAccountAccessRole. Attach the AdministratorAccess AWS managed policy to the role. In the role’s trust policy, grant the management account permission to assume the role.
    • D. In the new member account, edit the trust policy of the OrganizationAccountAccessRole IAM role. Grant the management account permission to assume the role.

    View question →

53. Q53. A space exploration company receives telemetry data from multiple satellites. Data packets are received via Amazon API Gateway and delivered directly to an Amazon Simple Queue Service (Amazon SQS) standard queue. A corresponding application subscribes to the queue and converts the data into a standardized format. Due to inconsistent data from satellites, the application sometimes fails to convert the data. In such cases, messages remain in the SQS queue. A DevOps engineer needs to develop a solution to retain failed messages and allow scientists to review and further process them. Which solution meets these requirements?

    • A. Configure AWS Lambda to poll the SQS queue and invoke a Lambda function to validate queue messages. If validation fails, send a copy of the invalid data to an Amazon S3 bucket for scientists to review and correct. After correction, use a replay Lambda function with corrected data to modify the message in the SQS queue.
    • B. Convert the SQS standard queue to an SQS FIFO queue. Configure AWS Lambda to poll the SQS queue every 10 minutes using an Amazon EventBridge schedule. Invoke the Lambda function to identify any messages with SentTimestamp older than 5 minutes, push the data to the same output location as the application, and remove the messages from the queue.
    • C. Create an SQS dead-letter queue (DLQ). Modify the existing queue with a redrive policy that sets Maximum Receives to 1 and specifies the ARN of the newly created DLQ. Instruct scientists to use the DLQ to inspect invalid data and reprocess it later.
    • D. Configure API Gateway to send messages to different SQS virtual queues named for each satellite. Update the application to route any data it cannot convert to a new virtual queue and send messages there. Instruct scientists to use the virtual queue to inspect invalid data and reprocess it later.

    View question →

54. Q54. A development team wants to use AWS CloudFormation stacks to deploy an application. However, developers’ IAM roles lack the permissions required to provision the resources specified in the AWS CloudFormation template. A DevOps engineer needs to implement a solution that allows developers to deploy stacks while adhering to the principle of least privilege. Which solution meets these requirements?

    • A. Create an IAM policy that allows developers to provision the required resources. Attach this policy to the developers’ IAM roles.
    • B. Create an IAM policy that allows full access to AWS CloudFormation. Attach this policy to the developers’ IAM roles.
    • C. Create an AWS CloudFormation service role with the required permissions. Grant the developers’ IAM roles cloudformation:* permissions. Use the new service role during stack deployment.
    • D. Create an AWS CloudFormation service role with the required permissions. Grant the developers’ IAM roles iam:PassRole permission. Use the new service role during stack deployment.

    View question →

55. Q55. A company uses AWS Organizations with the organizational feature enabled to centrally manage AWS accounts. Amazon EC2 instances run in AWS accounts. The company requires all current and future EC2 instances to use Instance Metadata Service version 2 (IMDSv2). The company must block AWS API calls originating from EC2 instances that do not use IMDSv2. Which solution meets these requirements?

    • A. Create a new SCP statement that denies the ec2:RunInstances action when the ec2:MetadataHttpTokens condition key does not equal the required value. Attach the SCP to the organization root.
    • B. Create a new SCP statement that denies the ec2:RunInstances action when the ec2:MetadataHttpPutResponseHopLimit condition key value exceeds 2. Attach the SCP to the organization root.
    • C. Create a new SCP statement that denies '*' when the ec2:RoleDelivery condition key value is less than 2. Attach the SCP to the organization root.
    • D. Create a new SCP statement that denies actions when the ec2:MetadataHttpTokens condition key value does not equal the required value. Attach the SCP to the organization root.

    View question →

56. Q56. A company needs to ensure VPC flow logs are enabled for both existing and new VPCs across its AWS accounts. The company uses AWS CloudFormation stacks to manage VPCs. The company needs a solution applicable to any VPC created by any IAM user.

    • A. Add an AWS::EC2::FlowLog resource to the CloudFormation stack that creates the VPC.
    • B. Create an organization in AWS Organizations. Add the company’s AWS accounts to the organization. Create an SCP to prevent users from modifying VPC flow logs.
    • C. Enable AWS Config. Create an AWS Config rule to check whether VPC flow logs are enabled. Configure automatic remediation to enable VPC flow logs.
    • D. Create an IAM policy to deny API calls related to VPC flow logs. Attach the IAM policy to all IAM users.

    View question →

57. Q57. A DevOps engineer wants to monitor the health of a stateless RESTful service behind a Classic Load Balancer. New application revisions are deployed via a CI/CD pipeline. If service latency exceeds a defined threshold, deployment must halt until the service recovers. Which method enables the fastest detection and response?

    • A. Use Amazon CloudWatch metrics provided by Elastic Load Balancing to calculate average latency. Trigger an alarm and stop deployment when latency exceeds the defined threshold.
    • B. Use AWS Lambda and Elastic Load Balancing access logs to detect average latency. Trigger an alarm and stop deployment when latency exceeds the defined threshold.
    • C. Use AWS CodeDeploy’s MinimumHealthyHosts setting to define rollback thresholds. Roll back the deployment if these thresholds are violated.
    • D. Use metric filters to parse application logs in Amazon CloudWatch Logs. Create a latency filter. Trigger an alarm and stop deployment when latency exceeds the defined threshold.

    View question →

58. Q58. A company runs a three-tier web application in a production environment, built on a single AWS CloudFormation template. The application consists of Amazon EC2 instances behind an Elastic Load Balancing (ELB) Application Load Balancer, running in an EC2 Auto Scaling group across multiple Availability Zones. Data is stored in an Amazon RDS multi-AZ database instance with read replicas. Amazon Route 53 manages the application’s public DNS records. A DevOps engineer needs to create a workflow to enable safe software deployments for new application versions, allowing rapid rollback in production if deployment failures occur. Which steps should the engineer perform to meet these requirements with minimal downtime?

    • A. Deploy an additional staging environment using AWS CloudFormation and configure Route 53 DNS with weighted records. During cutover, adjust Route 53 A-record weights to distribute traffic evenly between the two environments. Validate traffic in the new environment, and immediately terminate the old environment upon successful testing.
    • B. Use a single AWS Elastic Beanstalk environment to host both staging and production environments. Update the environment by uploading a ZIP file containing the new application code. Swap the Elastic Beanstalk environment CNAMEs. Validate traffic in the new environment, and immediately terminate the old environment upon successful testing.
    • C. Use a single AWS Elastic Beanstalk environment and an AWS OpsWorks environment to deploy staging and production environments. Update the Elastic Beanstalk environment—deployed via the OpsWorks stack—by uploading a ZIP file containing the new application code. Validate traffic in the new environment, and immediately terminate the old environment upon successful testing.
    • D. Deploy an additional staging environment using AWS CloudFormation and configure Route 53 DNS with weighted records. During cutover, gradually increase weight allocation to direct more traffic to the new staging environment as workload validation succeeds. Retain the old production environment until the new staging environment handles all traffic.

    View question →

59. Q59. An AWS CodePipeline pipeline has been implemented to automate code releases. The pipeline integrates with AWS CodeDeploy to deploy each CodePipeline stage’s application version to multiple Amazon EC2 instances. During a recent deployment, the pipeline failed due to a CodeDeploy issue. The DevOps team wants to improve monitoring and notifications during deployments to reduce mean time to resolution (MTTR). How should the DevOps engineer configure notifications when issues are detected?

    • A. Implement Amazon CloudWatch Logs for CodePipeline and CodeDeploy, create AWS Config rules to evaluate deployment failures, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.
    • B. Implement Amazon EventBridge for CodePipeline and CodeDeploy, create an AWS Lambda function to evaluate deployment failures, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.
    • C. Implement AWS CloudTrail to log CodePipeline and CodeDeploy API calls, create an AWS Lambda function to evaluate deployment failures, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.
    • D. Implement Amazon EventBridge for CodePipeline and CodeDeploy, create an Amazon Inspector assessment target to evaluate deployment failures, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.

    View question →

60. Q60. A company wants to replace its current bash deployment scripts with AWS developer tools. Currently, it deploys a LAMP application to a set of Amazon EC2 instances behind an Application Load Balancer (ALB). During deployment, the company runs unit tests on the submitted application, stops and restarts services, deregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to retain identical deployment functionality by adopting AWS services.

    • A. Use AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy’s appspec.yml file to restart services and deregister/register instances with the ALB. Use appspec.yml to update file permissions without custom scripts.
    • B. Use AWS CodePipeline to move the application from an AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy’s deployment group to test the application, deregister/re-register ALB instances, and restart services. Use appspec.yml to update permissions without custom scripts.
    • C. Use AWS CodePipeline to move the application source code from an AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy to test the application. Use CodeDeploy’s appspec.yml file to restart services and update permissions without custom scripts. Use AWS CodeBuild to deregister and re-register instances with the ALB.
    • D. Use AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy’s appspec.yml file to restart services. Deregister and re-register instances in the ALB within the AWS CodeDeploy deployment group. Update appspec.yml to update file permissions without custom scripts.

    View question →

61. Q61. • Multiple instances must remain available to serve traffic during deployment. • Traffic must remain balanced across instances, and instances must self-heal upon failure. • A new set of instances must launch automatically to deploy a new revision, requiring no manual configuration. • Traffic must be rerouted to half of the new instances at a time. • Deployment must succeed only if traffic is successfully rerouted to at least half of the new instances; otherwise, it must fail. • Temporary files generated during deployment must be deleted before traffic is routed to the new instance fleet. • Upon successful deployment completion, the original instances in the deployment group must be terminated immediately to reduce cost. How can a DevOps engineer meet these requirements?

    • A. Use an Application Load Balancer with in-place deployments. Associate the Auto Scaling group with the deployment group. Enable the Auto Scaling group copy option and use CodeDeployDefault.OneAtATime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group and delete temporary files using the AllowTraffic lifecycle hook in appspec.yml.
    • B. Use an Application Load Balancer with blue/green deployments. Associate the Auto Scaling group and the Application Load Balancer target group with the deployment group. Enable the Auto Scaling group copy option, create a custom deployment configuration defining minimum healthy hosts as 50%, and assign it to the deployment group. Instruct AWS CodeDeploy to terminate the original instances in the deployment group and delete temporary files using the BeforeBlockTraffic lifecycle hook in appspec.yml.
    • C. Use an Application Load Balancer with blue/green deployments. Associate the Auto Scaling group and the Application Load Balancer target group with the deployment group. Enable the Auto Scaling group copy option and use CodeDeployDefault.HalfAtATime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group and delete temporary files using the BeforeAllowTraffic lifecycle hook in appspec.yml.
    • D. Use an Application Load Balancer with in-place deployments. Associate the Auto Scaling group and the Application Load Balancer target group with the deployment group. Enable the Auto Scaling group copy option and use CodeDeployDefault.AllAtOnce as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group and delete temporary files using the BlockTraffic lifecycle hook in appspec.yml.

    View question →

62. Q62. A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to host machine learning (ML) applications. As ML models and container image sizes grow, new pods take up to 10 minutes to start. A developer needs to reduce startup time to seconds. The solution must reduce startup latency specifically for pods scheduled on recently added nodes in the cluster. The developer created an Amazon EventBridge rule that invokes AWS Systems Manager Automation. When a new image is pushed to the repository, the automation pulls the container image from Amazon Elastic Container Registry (Amazon ECR). The DevOps engineer configured tags on the EKS cluster and node groups. What should the DevOps engineer do to meet these requirements?

    • A. Create an IAM role with a policy allowing EventBridge to invoke Systems Manager on the EKS cluster’s control plane nodes. Create a Systems Manager State Manager association using control plane node tags to prefetch the corresponding container images.
    • B. Create an IAM role with a policy allowing EventBridge to invoke Systems Manager on the EKS cluster’s nodes. Create a Systems Manager State Manager association using node instance size to prefetch the corresponding container images.
    • C. Create an IAM role with a policy allowing EventBridge to invoke Systems Manager on the EKS cluster’s nodes. Create a Systems Manager State Manager association using node tags to prefetch the corresponding container images.
    • D. Create an IAM role with a policy allowing EventBridge to invoke Systems Manager on the EKS cluster’s control plane nodes. Create a Systems Manager State Manager association using node tags to prefetch the corresponding container images.

    View question →

63. Q63. A company has a policy requiring every Amazon EC2 instance to launch from an AMI created by its security team. Each week, the security team emails the development team a release note listing the latest approved AMI IDs. Development teams use AWS CloudFormation to deploy their applications. When launching a new service, developers manually search the email for the latest AMI ID. A DevOps engineer wants to automate the process of delivering AMI IDs from the security team to development teams. What is the most scalable solution to meet these requirements?

    • A. Instruct the security team to use CloudFormation to create new AMI versions and list AMI ARNs in an encrypted Amazon S3 object as part of stack outputs. Instruct developers to use cross-stack references to load the encrypted S3 object and retrieve the latest AMI ID.
    • B. Instruct the security team to use a CloudFormation stack to create an AWS CodePipeline that builds new AMIs and stores the latest AMI ARNs in an encrypted Amazon S3 object as pipeline output. Instruct developers to use cross-stack references in their own CloudFormation templates to fetch the S3 object location and latest AMI ARNs.
    • C. Instruct the security team to use Amazon EC2 Image Builder to create new AMIs and store AMI ARNs as parameters in AWS Systems Manager Parameter Store. Instruct developers to specify an SSM parameter type in their CloudFormation stacks to retrieve the latest AMI ARNs from Parameter Store.
    • D. Instruct the security team to use Amazon EC2 Image Builder to create new AMIs and create an Amazon Simple Notification Service (Amazon SNS) topic so each development team receives notifications. When teams receive notifications, instruct them to write an AWS Lambda function to update their CloudFormation stacks with the latest AMI ARNs.

    View question →

64. Q64. A company wants to replace its current bash deployment scripts with AWS developer tools. Currently, it deploys a LAMP application to a set of Amazon EC2 instances behind an Application Load Balancer (ALB). During deployment, the company runs unit tests on the submitted application, stops and starts services, deregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to retain identical deployment functionality by adopting AWS services.

    • A. Use AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy’s appspec.yml file to restart services and deregister/register instances with the ALB. Use appspec.yml to update file permissions without custom scripts.
    • B. Use AWS CodePipeline to move the application from an AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy’s deployment group to test the application, deregister/re-register ALB instances, and restart services. Use appspec.yml to update permissions without custom scripts.
    • C. Use AWS CodePipeline to move the application source code from an AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy to test the application. Use CodeDeploy’s appspec.yml file to restart services and update permissions without custom scripts. Use AWS CodeBuild to deregister and re-register instances with the ALB.
    • D. Use AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy’s appspec.yml file to restart services. Deregister and re-register instances in the ALB within the AWS CodeDeploy deployment group. Update appspec.yml to update file permissions without custom scripts.

    View question →

65. Q65. • An Amazon S3 bucket for static content • Amazon EC2 instances for frontend web servers • AWS Lambda functions for image processing • Amazon DynamoDB for storing application metadata The team expects significant traffic growth. The application must handle increased load continuously. Initially, the team tested scaling by adding new EC2 servers behind the ALB—but each instance takes up to 20 minutes to become fully configured. The team wants to reduce this provisioning time. Which solution best meets the expected demand while maximizing elasticity and high availability?

    • A. Use AWS OpsWorks to automatically configure each new EC2 instance at launch. Configure EC2 instances in an Auto Scaling group behind an Application Load Balancer across multiple Availability Zones. Implement Amazon DynamoDB Auto Scaling. Use Amazon Route 53 to point the application DNS record to the Application Load Balancer.
    • B. Deploy a set of EC2 instances, doubling current capacity, and place them behind the Application Load Balancer. Increase Amazon DynamoDB read and write capacity units. Add an alias record pointing to the Application Load Balancer endpoint in the existing Amazon Route 53 DNS record.
    • C. Configure Amazon CloudFront with Amazon S3 as the origin to host the web application. Implement Amazon DynamoDB Auto Scaling. Use Amazon Route 53 to point the application DNS record to the CloudFront domain name.
    • D. Use AWS Elastic Beanstalk with a custom AMI containing all web components. Deploy the platform using an Auto Scaling group behind an Application Load Balancer across multiple Availability Zones. Implement Amazon DynamoDB Auto Scaling. Use Amazon Route 53 to point the application DNS record to the Elastic Beanstalk load balancer.

    View question →

66. Q66. A DevOps engineer is building a container-based architecture. The engineer has decided to use AWS CloudFormation templates to automatically provision an Amazon ECS cluster and an Amazon EC2 Auto Scaling group to launch EC2 container instances. After successfully creating the CloudFormation stack, the engineer notices that although the ECS cluster and EC2 instances have been created successfully and the stack creation has completed, the EC2 instances are still associated with a different cluster.

    • A. Reference the EC2 instances in the AWS::ECS::Cluster resource and reference the ECS cluster in the AWS::ECS::Service resource.
    • B. Reference the ECS cluster in the UserData property of the AWS::AutoScaling::LaunchConfiguration resource.
    • C. Reference the ECS cluster in the UserData property of the AWS::EC2::Instance resource.
    • D. Reference the ECS cluster in an AWS::CloudFormation::CustomResource resource to trigger an AWS Lambda function that registers the EC2 instances with the appropriate ECS cluster.

    View question →

67. Q67. A company has multiple development teams across different business units, all working within a shared AWS account. All Amazon EC2 resources created in the account are tagged to identify the resource creator. Tagging occurs during the first API call after resource creation.

    • A. Create an S3 event notification on the S3 bucket to invoke a Lambda function for s3:ObjectTagging:Put events. Enable versioning on the S3 bucket.
    • B. Enable server access logging on the S3 bucket. Create an S3 event notification on the S3 bucket for s3:ObjectTagging:* events.
    • C. Create an Amazon EventBridge scheduled rule that runs hourly to invoke a Lambda function. Modify the Lambda function to read logs from the S3 bucket.
    • D. Create an Amazon EventBridge rule with Amazon EC2 as the event source. Configure the rule to match CloudTrail-delivered events. Configure the rule to target a Lambda function.

    View question →

68. Q68. A company runs a batch-processing application to handle records. Application components run on Amazon EC2 instances in an Auto Scaling group. Each record’s processing consists of multiple sequential steps, each with predictable duration. Each step completes within five minutes or less.

    • A. Create a web application that writes records to Amazon S3. Use S3 event notifications to publish to an Amazon Simple Notification Service (Amazon SNS) topic. Use an EC2 instance to poll Amazon SNS and initiate processing. Save intermediate results to Amazon S3 after each step.
    • B. Implement logic in the application to execute processing steps. Refactor the application code to run in containers and use AWS Fargate to manage container instances. Configure containers to invoke themselves to pass state from one step to the next.
    • C. Create a web application that sends records to Amazon Kinesis Data Streams. Leverage Kinesis Data Streams and AWS Lambda functions to decouple processing.
    • D. Create a web application that sends records to AWS Step Functions. Decompose processing into Step Functions tasks and AWS Lambda functions.

    View question →

69. Q69. A company grants access permissions to its AWS account to an external third-party software vendor. The vendor performs various AWS operations in the AWS account and requires diverse IAM permissions. The company currently grants access by creating IAM users, attaching IAM policies, and providing IAM user credentials to the vendor.

    • A. Use AWS Identity and Access Management Access Analyzer to generate a new IAM policy based on the IAM user’s AWS CloudTrail history. Replace the IAM user’s policy with the newly generated policy.
    • B. Use AWS Identity and Access Management Access Analyzer to generate a new IAM policy based on the IAM user’s AWS CloudTrail history. Attach the newly generated policy as a permissions boundary to the IAM user.
    • C. Use AWS Identity and Access Management Access Analyzer to discover the IAM user’s last-accessed information and create a new IAM policy that permits only the services and actions identified in the last-access review. Replace the IAM user’s policy with the newly generated policy.
    • D. Use AWS Identity and Access Management Access Analyzer to discover the IAM user’s last-accessed information and create a new IAM policy that permits only the services and actions identified in the last-access review. Attach the newly generated policy as a permissions boundary to the IAM user.

    View question →

70. Q70. A global company uses AWS Control Tower to manage multiple AWS accounts. The company hosts internal applications and public-facing applications. Each application team has its own AWS account to host its application. Accounts are consolidated into a single organization in AWS Organizations. One AWS Control Tower member account serves as a centralized DevOps account hosting CI/CD pipelines; application teams use this account to deploy applications to their respective target AWS accounts. Deployment IAM roles exist in the centralized DevOps account.

    • A. Configure the application account’s deployment IAM role to trust the centralized DevOps account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the application account’s deployment IAM role with permissions required to access the EKS cluster. Configure the EKS cluster’s aws-auth ConfigMap to map the role to appropriate Kubernetes RBAC permissions.
    • B. Configure the centralized DevOps account’s deployment IAM role to trust the application account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the centralized DevOps account’s deployment IAM role with permissions required for CodeBuild.
    • C. Configure the centralized DevOps account’s deployment IAM role to trust the application account. Configure the trust relationship to allow the sts:AssumeRoleWithSAML action. Configure the centralized DevOps account’s deployment IAM role with permissions required for CodeBuild.
    • D. Configure the application account’s deployment IAM role to trust the AWS Control Tower management account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the application account’s deployment IAM role with permissions required to access the EKS cluster. Configure the EKS cluster’s aws-auth ConfigMap to map the role to appropriate Kubernetes RBAC permissions.

    View question →

71. Q71. A company runs an application on Amazon EC2 instances in an Auto Scaling group. The application processes messages from an Amazon Simple Queue Service (SQS) queue.

    • A. Create an AWS Lambda function. Publish per-instance queue message metrics using SQS ApproximateNumberOfMessagesVisible and Auto Scaling Group InstanceCount properties. Configure the Lambda function to publish a custom metric. Schedule an Amazon EventBridge rule hourly to invoke the Lambda function. Create a target tracking scaling policy for the Auto Scaling group using the custom metric.
    • B. Create an AWS Lambda function. Publish per-instance queue message metrics using SQS ApproximateNumberOfMessagesVisible and Auto Scaling Group InstanceCount properties. Configure a CloudWatch Logs subscription filter on application logs targeting the Lambda function. Create a target tracking scaling policy for the Auto Scaling group using the custom metric.
    • C. Create a target tracking scaling policy for the Auto Scaling group. In the policy, use the SQS ApproximateNumberOfMessagesVisible metric and the Auto Scaling Group InstanceCount property with CloudWatch Metric Math to compute the number of messages per instance. Use the computed metric to scale.
    • D. Create an AWS Lambda function that logs the SQS ApproximateNumberOfMessagesVisible metric to a CloudWatch Logs log group. Schedule an Amazon EventBridge rule to run the Lambda function every 5 minutes. Create a metric filter to count log events from the CloudWatch Logs log group. Create a target tracking scaling policy for the Auto Scaling group using the custom metric.

    View question →

72. Q72. A company uses an AWS Cloud Development Kit (AWS CDK) application to manage its infrastructure. The AWS CDK application creates AWS Lambda functions and associated IAM roles. The company follows organizational security standards. Developers can assume the IAM roles deployed by the AWS CDK application.

    • A. Create a Service Control Policy (SCP) denying IAM:CreateRole and IAM:UpdateRole actions for developer roles and the AWS CDK application deployment role. Centrally create new IAM roles to attach to Lambda functions and grant developers access to use them.
    • B. Create an IAM permissions boundary policy. Define the maximum required actions for the AWS CDK application in the policy. Update the account’s AWS CDK bootstrap to use the permissions boundary. Update the AWS CDK application configuration to use this policy as the default permissions boundary.
    • C. Create an IAM permissions boundary policy. Define the maximum required actions for the AWS CDK application in the policy. Instruct developers to specify the permissions boundary policy name when creating roles in the AWS CDK application code.
    • D. Create a Service Control Policy (SCP) denying IAM:CreateRole and IAM:UpdateRole actions for developer roles. Grant the AWS CDK deployment role permission to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to validate that Lambda function roles have no excessive permissions.

    View question →

73. Q73. A large enterprise is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. These instances run in an Auto Scaling group spanning multiple Availability Zones. The application stores data in an Amazon RDS Oracle database instance and Amazon DynamoDB. Separate environments exist for development, testing, and production.

    • A. Retrieve access keys for AWS service access from AWS Systems Manager SecureString parameters. Retrieve database credentials from Systems Manager SecureString parameters.
    • B. Launch EC2 instances with an EC2 IAM role to access AWS services. Retrieve database credentials from AWS Secrets Manager.
    • C. Retrieve access keys for AWS service access from AWS Systems Manager plaintext parameters. Retrieve database credentials from Systems Manager SecureString parameters.
    • D. Launch EC2 instances with an EC2 IAM role to access AWS services. Store the database password alongside application artifacts in an encrypted configuration file.

    View question →

74. Q74. A company performs sensitive workloads in accounts belonging to an AWS Organization. The company uses a single IP address range to scope the Amazon VPC CIDR block and assign IP addresses to on-premises hardware. The company needs a solution to prevent principals outside the company's IP address range from performing AWS operations in the organization's accounts. Which solution meets these requirements?

    • A. Configure AWS Firewall Manager for the organization. Create an AWS Network Firewall policy that allows only source traffic from the company's IP address range. Apply the policy scope to all accounts within the organization.
    • B. Create a Service Control Policy (SCP) in the organization that denies API requests from source IP addresses outside the company's IP address range. Attach the SCP to the organization's root.
    • C. Configure Amazon GuardDuty for the organization. Create a trusted IP address list for the company's IP range. Enable the trusted IP list for the organization.
    • D. Create a Service Control Policy (SCP) in the organization that allows API requests only from source IP addresses within the company's IP address range. Attach the SCP to the organization's root.

    View question →

75. Q75. An Amazon EC2 Auto Scaling group manages EC2 instances launched from an AMI. The company has installed the Amazon Systems Manager Agent on the instances. Tags are applied to EC2 instances when they launch into the Auto Scaling group. EC2 instances launched by the Auto Scaling group must receive correct operating system configurations.

    • A. Create an SSM Run Command document to configure the required instance settings. Set up SSM Compliance to invoke the Run Command document when an EC2 instance is noncompliant with the latest patches.
    • B. Create an SSM State Manager association linked to an SSM Run Command document. Create an immediate-run tag-based query.
    • C. Create an SSM Run Command task specifying the required instance configuration. Create a maintenance window that runs daily using SSM Maintenance Windows. Register the Run Command task on the maintenance window and specify targets.
    • D. Create an SSM Patch Manager patch baseline and a patch group using the same tags as the Auto Scaling group. Register the patch group with the patch baseline. Define an SSM Run Command document to patch instances, and invoke it via SSM Run Command.

    View question →

76. Q76. • The application must deploy one instance at a time to ensure the message queue continues serving traffic. • The application is CPU-intensive and requires monitoring. • If the deployed instance’s CPU utilization exceeds 85%, the deployment must automatically roll back.

    • A. Use AWS CloudFormation to create an AWS Step Functions state machine and Auto Scaling lifecycle hooks to place one instance at a time into a wait state. Use AWS Systems Manager Automation to deploy updates to each instance and use heartbeat timeouts to return it to the Auto Scaling group.
    • B. Use AWS CodeDeploy integrated with Amazon EC2 Auto Scaling. Configure an alarm associated with the CPU utilization metric. Use the CodeDeployDefault.OneAtATime deployment strategy. Configure automatic rollback in the deployment group to revert on alarm threshold violation.
    • C. Use AWS Elastic Beanstalk with load balancing and AWS Auto Scaling. Configure an alarm associated with the CPU utilization metric. Configure a rolling deployment with a fixed batch size of one instance. Enable enhanced health to monitor deployment status and trigger rollback based on the previously created alarm.
    • D. Use AWS Systems Manager to perform blue/green deployments through Amazon EC2 Auto Scaling. Configure an alarm associated with the CPU utilization metric. Deploy one updated instance at a time. Configure automatic rollback in the Auto Scaling group to revert on alarm threshold violation.

    View question →

77. Q77. A development team uses AWS CodeCommit for application version control. They use AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy for their CI/CD infrastructure. Recently, the team merged a pull request in CodeCommit that introduced long-running tests into the main codebase, causing delays and resource exhaustion. A DevOps engineer wants to automatically test pull requests in CodeCommit so reviewers can easily see the results as part of the pull request review process.

    • A. Create an Amazon EventBridge rule to respond to pullRequestStatusChanged events. Create an AWS Lambda function that invokes a CodePipeline pipeline containing a CodeBuild action to run application tests. Program the Lambda function to post a CodeBuild badge as a comment on the pull request so developers can see it during code review.
    • B. Create an Amazon EventBridge rule to respond to pullRequestCreated events. Create an AWS Lambda function that invokes a CodePipeline pipeline containing a CodeBuild action to run application tests. Program the Lambda function to post the CodeBuild test results as a comment on the pull request when testing completes.
    • C. Create an Amazon EventBridge rule that responds to both pullRequestCreated and pullRequestSourceBranchUpdated events. Create an AWS Lambda function that invokes a CodePipeline pipeline containing a CodeBuild action to run application tests. Program the Lambda function to post a CodeBuild badge as a comment on the pull request so developers can see it during code review.
    • D. Create an Amazon EventBridge rule to respond to pullRequestStatusChanged events. Create an AWS Lambda function that invokes a CodePipeline pipeline containing a CodeBuild action to run application tests. Program the Lambda function to post the CodeBuild test results as a comment on the pull request when testing completes.

    View question →

78. Q78. A DevOps engineer is creating an AWS CloudFormation template to deploy a web service. The web service runs on Amazon EC2 instances in private subnets behind an Application Load Balancer (ALB). The DevOps engineer wants to ensure the service can accept requests from clients with IPv6 addresses.

    • A. Add an IPv6 CIDR block to the VPC and private subnets hosting the EC2 instances. Create a route table entry for IPv6 traffic using IPv6-capable EC2 instance types, and assign IPv6 addresses to each EC2 instance.
    • B. Assign an IPv6 Elastic IP address to each EC2 instance. Create a target group and register the EC2 instances as targets. Create a listener on port 443 of the ALB and associate the target group with the ALB.
    • C. Replace the ALB with a Network Load Balancer (NLB). Add an IPv6 CIDR block to the NLB’s VPC and subnets, and assign an IPv6 Elastic IP address to the NLB.
    • D. Add an IPv6 CIDR block to the ALB’s VPC and subnets. Create a listener on port 443 and specify the dual-stack IP address type on the ALB. Create a target group, register the EC2 instances as targets, and associate the target group with the ALB.

    View question →

79. Q79. A company operates many applications. Different teams develop applications using various languages and frameworks. These applications run locally and on different servers with varying operating systems. Each team maintains its own release process and protocols. The company wants to reduce the complexity of releasing and maintaining these applications. The company is migrating its technology stack—including these applications—to AWS. It seeks centralized source control, consistent and automated delivery pipelines, and minimal underlying infrastructure management.

    • A. Create a single AWS CodeCommit repository for all applications. Store each application’s code in separate branches. Merge branches and use AWS CodeBuild to build applications. Deploy applications to a centralized application server using AWS CodeDeploy.
    • B. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build one application at a time. Deploy applications to a centralized application server using AWS CodeDeploy.
    • C. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build each application and create an AMI per server. Use AWS CloudFormation StackSets with those AMIs to automatically provision and decommission Amazon EC2 fleets.
    • D. Create a separate AWS CodeCommit repository for each application. Use AWS CodeBuild to build a Docker image for each application and push it to Amazon Elastic Container Registry (Amazon ECR). Deploy applications to Amazon Elastic Container Service (Amazon ECS) running on AWS Fargate-managed infrastructure using AWS CodeDeploy.

    View question →

80. Q80. A company deployed an application on AWS Elastic Beanstalk using an all-at-once deployment method. A recent deployment failed due to application misconfiguration, resulting in extended downtime. To prevent recurrence, a DevOps engineer needs to revise the deployment method while maintaining application performance. The DevOps engineer wants to ensure application version and configuration consistency across running instances without creating new environments.

    • A. Switch to a rolling deployment strategy for future application updates.
    • B. Switch to a rolling deployment strategy with an added batch policy for future application updates.
    • C. Switch to an immutable deployment strategy for future application updates.
    • D. Switch to a blue/green deployment strategy for future application updates.

    View question →

81. Q81. A DevOps engineer needs to configure blue/green deployment for an existing three-tier application. The application runs on Amazon EC2 instances and uses an Amazon RDS database. EC2 instances run behind an Application Load Balancer (ALB) and belong to an Auto Scaling group. The DevOps engineer created a launch template and Auto Scaling group for the blue environment and another launch template and Auto Scaling group for the green environment. Each Auto Scaling group deploys to its corresponding blue or green target group. Target groups specify which software (blue or green) loads on the EC2 instances. The ALB routes traffic to either the blue or green target group. An Amazon Route 53 record for www.example.com points to the ALB. The deployment must shift all traffic from the blue environment’s EC2 instances to the green environment’s EC2 instances running the newly deployed software.

    • A. Start a rolling restart of the green Auto Scaling group to deploy the new software to green EC2 instances. After the rolling restart completes, use the AWS CLI to update the ALB to route traffic to the green target group.
    • B. Use the AWS CLI to update the ALB to route traffic to the green target group. Then perform a rolling restart of the green Auto Scaling group to deploy the new software to green EC2 instances.
    • C. Update the launch template to deploy green software onto blue EC2 instances. Keep target groups and Auto Scaling groups unchanged. Perform a rolling restart of blue EC2 instances.
    • D. Start a rolling restart of the green Auto Scaling group to deploy the new software to green EC2 instances. After the rolling restart completes, update the Route 53 DNS record to point to the green endpoint on the ALB.

    View question →

82. Q82. A company has a legacy application. A DevOps engineer needs to automate the process of building deployable artifacts for the legacy application. The solution must store the deployable artifacts in an existing Amazon S3 bucket for future deployment reference.

    • A. Create a custom Docker image that includes all dependencies of the legacy application. Store the custom Docker image in a new Amazon Elastic Container Registry (Amazon ECR) repository. Configure a new AWS CodeBuild project to use the custom Docker image to build deployable artifacts and save the artifacts to the S3 bucket.
    • B. Launch a new Amazon EC2 instance. Install all dependencies of the legacy application on the EC2 instance. Use the EC2 instance to build deployable artifacts and save the artifacts to the S3 bucket.
    • C. Create a custom EC2 Image Builder image. Install all dependencies of the legacy application on the image. Launch a new Amazon EC2 instance from the image. Use the new EC2 instance to build deployable artifacts and save the artifacts to the S3 bucket.
    • D. Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with AWS Fargate profiles running across multiple Availability Zones. Create a custom Docker image that includes all dependencies of the legacy application. Store the custom Docker image in a new Amazon Elastic Container Registry (Amazon ECR) repository. Use the custom Docker image in the EKS cluster to build deployable artifacts and save the artifacts to the S3 bucket.

    View question →

83. Q83. A company operates a globally deployed product serving customers outside its home region. Its development team needs to deploy an API using Amazon API Gateway to support this product. The solution must redundantly deploy the API, provide independent availability for each deployment location, assign custom domain URLs per location, and optimize performance for API client requests.

    • A. Deploy an API Gateway edge-optimized API endpoint in the US East (N. Virginia) Region. Create a custom domain for the API Gateway API. Create an Amazon Route 53 record set with a geoproximity routing policy for the API's custom domain. Set the geoproximity bias to the maximum allowed value.
    • B. Deploy an API Gateway regional API endpoint in the US East (N. Virginia) Region. Integrate the API Gateway API with a public Application Load Balancer (ALB). Create a Global Accelerator standard accelerator. Associate the endpoint with an Amazon Route 53 alias record set pointing the custom domain to the accelerator's DNS name.
    • C. Deploy API Gateway regional API endpoints in each AWS Region where the company’s product is deployed. Create an API Gateway custom domain for the deployed API in each Region. Create an Amazon Route 53 record set with a latency-based routing policy for each deployed API Gateway custom domain.
    • D. Deploy an API Gateway edge-optimized API endpoint in the US East (N. Virginia) Region. Create an Amazon CloudFront distribution. Configure CloudFront with another domain name and specify the API Gateway invoke URL as the origin. Create an Amazon Route 53 alias record set with a simple routing policy pointing to the CloudFront domain name.

    View question →

84. Q84. A security team wants to use AWS CloudTrail to monitor management events and API calls across multiple accounts within the same AWS Organization. The security team needs to ensure that account users cannot disable CloudTrail in their accounts.

    • A. Apply a Service Control Policy (SCP) to all OUs denying the `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` actions.
    • B. Create IAM policies in each account denying the `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` actions.
    • C. Set up Amazon CloudWatch Alarms to notify the security team when a user disables CloudTrail in an account.
    • D. Use AWS Config to automatically re-enable CloudTrail if a user disables it in an account.

    View question →

85. Q85. A DevOps engineer manages an application for a video streaming company that handles video files. The application runs on Amazon EC2 instances behind an Elastic Load Balancing (ELB) Application Load Balancer. These instances run in an Auto Scaling group spanning multiple Availability Zones. Data is stored in an Amazon RDS PostgreSQL Multi-AZ DB instance, and video files are stored in an Amazon S3 bucket. Typically, 50 GB of new video content is added daily to the S3 bucket. The engineer wants to implement a multi-Region disaster recovery plan with minimal data loss and shortest possible recovery time. The current application infrastructure is already defined using AWS CloudFormation. Which deployment option should the engineer choose to meet the application’s uptime and recovery objectives?

    • A. Launch the application from a CloudFormation template in a secondary Region with Auto Scaling group capacity set to 1. Create an Amazon RDS read replica in the secondary Region. Enable cross-Region replication between the original S3 bucket and a new S3 bucket in the secondary Region. For failover, promote the read replica to primary and update the CloudFormation stack to increase Auto Scaling group capacity.
    • B. Launch the application from a CloudFormation template in a secondary Region with Auto Scaling group capacity set to 1. Create a scheduled task to take daily cross-Region Amazon RDS snapshots to the secondary Region. Enable cross-Region replication between the original S3 bucket and Amazon Glacier in the secondary Region. During disaster recovery, launch a new application stack in the secondary Region and restore the database from the latest snapshot.
    • C. Launch the application from a CloudFormation template in a secondary Region with Auto Scaling group capacity set to 1. Use Amazon CloudWatch Events to schedule nightly tasks to take database snapshots, copy them to the secondary Region, and replace the database instance in the secondary Region with the snapshot. Enable cross-Region replication between the original S3 bucket and a new S3 bucket in the secondary Region. For failover, increase Auto Scaling group capacity.
    • D. Use Amazon CloudWatch Events to schedule nightly tasks to take database snapshots and copy them to the secondary Region. Create an AWS Lambda function triggered by S3 event notifications to replicate each object to a new S3 bucket in the secondary Region. In the secondary Region, launch the application from the CloudFormation template and restore the database from the latest snapshot.

    View question →

86. Q86. A company operates an AWS account running hundreds of Amazon EC2 instances in one AWS Region. The account launches and terminates new EC2 instances daily. The account also includes existing EC2 instances that have been running for over a week. Company security policy requires all running EC2 instances to use EC2 instance profiles. If an EC2 instance launches without an instance profile, it must use the default instance profile with no assigned IAM permissions. A DevOps engineer reviewed the account and found EC2 instances running without attached instance profiles. During the review period, the engineer observed new EC2 instances launching without instance profiles. Which solution ensures instance profiles are attached to all currently running and future EC2 instances in the Region?

    • A. Configure an Amazon EventBridge rule to respond to EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function that attaches the default instance profile to the EC2 instance.
    • B. Configure the `ec2-instance-profile-attached` AWS Config managed rule with a configuration change trigger type. Configure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instance.
    • C. Configure an Amazon EventBridge rule to respond to EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instance.
    • D. Configure the `iam-role-managed-policy-check` AWS Config managed rule with a configuration change trigger type. Configure an automatic remediation action that invokes an AWS Lambda function to attach the default instance profile to the EC2 instance.

    View question →

87. Q87. A company runs an application on 12 Amazon EC2 instances. These instances run in an Amazon EC2 Auto Scaling group spanning three Availability Zones. On a typical day, each EC2 instance experiences 30% CPU utilization during business hours and 10% after business hours. CPU utilization spikes sharply during the first five minutes of business hours and increases gradually thereafter. A DevOps engineer needs to optimize cost while maintaining or improving application availability.

    • A. Configure a target tracking scaling policy for the Auto Scaling group based on average CPU utilization, targeting 75%. Create a scheduled action for the Auto Scaling group to adjust desired capacity to six instances before business hours begin.
    • B. Configure the Auto Scaling group with two scheduled actions using Amazon EC2 Auto Scaling. Configure one action to launch nine EC2 instances at the start of business hours. Configure another action to terminate nine EC2 instances at the end of business hours.
    • C. Migrate to AWS Application Auto Scaling. Configure a target tracking scaling policy based on average CPU utilization for the Auto Scaling group, targeting 75%. Create a scheduled action to reduce minimum instances to three at the end of business hours and reset to six before business hours begin.
    • D. Migrate to AWS Application Auto Scaling. Configure a target tracking scaling policy based on average CPU utilization for the Auto Scaling group, targeting 75%. Create a scheduled action to terminate nine instances nightly at the end of business hours.

    View question →

88. Q88. A Software-as-a-Service (SaaS) company deploys its primary .NET application using AWS Elastic Beanstalk. The Elastic Beanstalk environment is configured to use Amazon EC2 Auto Scaling and Elastic Load Balancing (ELB) for underlying EC2 instances. The company experienced incidents where EC2 instances were marked unhealthy and terminated by the Auto Scaling group after failing ELB health checks. The DevOps team wants to build a solution that notifies the operations team whenever the Auto Scaling group terminates any EC2 instance in the production environment.

    • A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe email addresses of all operations team members to the SNS topic. Configure notifications for the `autoscaling:EC2_INSTANCE_LAUNCH` notification type on all existing Auto Scaling groups.
    • B. Create an Amazon Simple Queue Service (Amazon SQS) queue. Add an AWS Lambda function trigger to the SQS queue. Configure notifications for the `autoscaling:EC2_INSTANCE_LAUNCH` notification type on all existing Auto Scaling groups.
    • C. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe email addresses of all operations team members to the SNS topic. Configure notifications for the `autoscaling:EC2_INSTANCE_TERMINATE` notification type on all existing Auto Scaling groups.
    • D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Add an AWS Lambda function trigger to the SQS queue. Configure notifications for the `autoscaling:EC2_INSTANCE_TERMINATE` notification type on all existing Auto Scaling groups.

    View question →

89. Q89. A company uses a single AWS account to test applications on Amazon EC2 instances. The company has enabled AWS Config in the account and activated the `restricted-ssh` AWS Config managed rule. The company requires an automated monitoring solution that sends custom notifications whenever any security group in the account violates the `restricted-ssh` rule. Custom notifications must include the noncompliant security group’s name and ID. A DevOps engineer created an Amazon Simple Notification Service (Amazon SNS) topic and subscribed appropriate personnel. What should the DevOps engineer do next to meet these requirements?

    • A. Create an Amazon EventBridge rule matching `NON_COMPLIANT` AWS Config evaluation results for the `restricted-ssh` rule. Configure an input transformer for the EventBridge rule. Configure the EventBridge rule to publish notifications to the SNS topic.
    • B. Configure AWS Config to send all evaluation results for the `restricted-ssh` rule to the SNS topic. Configure a filter policy on the SNS topic to deliver only notifications containing the text 'NON_COMPLIANT'.
    • C. Create an Amazon EventBridge rule matching `NON_COMPLIANT` AWS Config evaluation results for the `restricted-ssh` rule. Configure the EventBridge rule to invoke AWS Systems Manager Run Command on the SNS topic to customize the notification and republish it to the SNS topic.
    • D. Create an Amazon EventBridge rule matching all `NON_COMPLIANT` AWS Config evaluation results. Configure an input transformer for the `restricted-ssh` rule. Configure the EventBridge rule to publish notifications to the SNS topic.

    View question →

90. Q90. A company manages a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run in an Auto Scaling group spanning multiple Availability Zones. The application uses an Amazon RDS for MySQL DB instance to store data. The company has already configured an Amazon Route 53 CNAME record pointing to the ALB. A new corporate policy requires a geographically isolated disaster recovery (DR) site with an RTO of 4 hours and an RPO of 15 minutes. Which DR strategy meets these requirements while minimizing changes to the application stack?

    • A. Launch a copy environment of everything except Amazon RDS in a different Availability Zone. Create an RDS read replica in the new Availability Zone and configure the new stack to point to the local RDS DB instance. Add the new stack to the Route 53 record set using a failover routing policy with health checks.
    • B. Launch a copy environment of everything except Amazon RDS in a different AWS Region. Create an RDS read replica in the new Region and configure the new stack to point to the local RDS DB instance. Add the new stack to the Route 53 record set using a latency routing policy with health checks.
    • C. Launch a copy environment of everything except Amazon RDS in a different AWS Region. During an outage, copy and restore the latest RDS snapshot from the primary Region to the DR Region. Update the Route 53 record set to point to the ALB in the DR Region.
    • D. Launch a copy environment of everything except Amazon RDS in a different AWS Region. Create an RDS read replica in the new Region and configure the new environment to point to the local RDS DB instance. Add the new stack to the Route 53 record set using a failover routing policy with health checks. During an outage, promote the read replica to become the primary instance.

    View question →

91. Q91. A company runs an application using an Amazon Aurora Multi-AZ DB cluster compatible with MySQL. For disaster recovery purposes, a cross-Region read replica has been created. A DevOps engineer wants to automatically promote the replica so it becomes the primary database instance during a failure.

    • A. Configure an Amazon Route 53 CNAME with a latency-based health check pointing to both the primary and replica endpoints. Subscribe Amazon CloudTrail to an Amazon SNS topic for Amazon RDS failure notifications and use that topic to invoke an AWS Lambda function that promotes the replica instance to primary.
    • B. Create an Aurora custom endpoint pointing to the primary database instance. Configure the application to use this endpoint. Configure AWS CloudTrail to trigger an AWS Lambda function that promotes the replica instance and modifies the custom endpoint to point to the newly promoted instance.
    • C. Create an AWS Lambda function that modifies the application’s AWS CloudFormation template to upgrade the replica, applies the template to update the stack, and reconfigures the application to point to the newly promoted instance. Create an Amazon CloudWatch alarm that invokes this Lambda function after a failure event.
    • D. Store the Aurora endpoint in AWS Systems Manager Parameter Store. Create an Amazon EventBridge rule that detects database failures and invokes an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Systems Manager Parameter Store. Code the application to reload the endpoint from Parameter Store upon database connection failure.

    View question →

92. Q92. A development team uses AWS CodeCommit for version control of an application. They use AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy for their CI/CD infrastructure. Recently, the team merged untested code into the main branch via a pull request requiring long-running tests. This caused downtime and required manual rollback. A DevOps engineer wants to automatically test pull requests in CodeCommit so reviewers can easily see test results as part of the pull request review process. What should the DevOps engineer do to meet this requirement?

    • A. Create an Amazon EventBridge rule that responds to pullRequestStatusChanged events. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action to run application tests. Program the Lambda function to post a CodeBuild badge as a comment on the pull request so developers can see it during code review.
    • B. Create an Amazon EventBridge rule that responds to pullRequestCreated events. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action to run application tests. Program the Lambda function to post CodeBuild test results as a comment on the pull request after test completion.
    • C. Create an Amazon EventBridge rule that responds to pullRequestCreated and pullRequestSourceBranchUpdated events. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action to run application tests. Program the Lambda function to post a CodeBuild badge as a comment on the pull request so developers can see it during code review.
    • D. Create an Amazon EventBridge rule that responds to pullRequestStatusChanged events. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action to run application tests. Program the Lambda function to post CodeBuild test results as a comment on the pull request after test completion.

    View question →

93. Q93. A company managing electronic medical records runs an Amazon EC2 instance using Amazon Linux OS. As part of patient privacy requirements, the company must ensure operating system and application patches on the EC2 instance remain compliant.

    • A. Use AWS Systems Manager to create a new patch baseline that includes a custom repository. Use Run Command to execute the AWS-RunPatchBaseline document to verify and install patches.
    • B. Integrate the enterprise repository using AWS Direct Connect and deploy patches using Amazon CloudWatch scheduled events, then create reports using a CloudWatch dashboard.
    • C. Use yum-config-manager to add a custom repository under /etc/yum.repos.d and run yum-config-manager --enable to activate the repository.
    • D. Use AWS Systems Manager to create a new patch baseline that includes the company’s repository. Use Run Command to execute the AWS-AmazonLinuxDefaultPatchBaseline document to verify and install patches.

    View question →

94. Q94. A company uses AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is used in the pipeline with a blue/green deployment model to deploy the application to Amazon ECS. The company wants to run scripts to test the green version of the application before shifting traffic. These scripts must complete within five minutes or less. If errors are detected during this testing period, the company wants to roll back the deployment.

    • A. Add a stage between the source and deploy stages in the CodePipeline pipeline. Use AWS CodeBuild to create an execution environment and define commands in the buildspec file to invoke test scripts. If errors are found, use the aws deploy stop-deployment command to halt deployment.
    • B. Add a stage between the source and deploy stages in the CodePipeline pipeline. Use this stage to execute an AWS Lambda function that runs the test scripts. If errors are found, use the aws deploy stop-deployment command to halt deployment.
    • C. Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function that runs the test scripts. If errors are found, exit the Lambda function with an error to trigger automatic rollback.
    • D. Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTraffic lifecycle event to invoke the test scripts. If errors are found, use the aws deploy stop-deployment CLI command to halt deployment.

    View question →

95. Q95. A company operates a globally distributed organization and wants to implement a governance strategy with the following requirements: • Access to AWS service resources must be restricted to the same Region as the requesting account. • Access to AWS services must be limited to a specific set of approved services per account. • Identity authentication must be provided by an on-premises Active Directory. • Access permissions must be consistent across business functions, with identical limits applied to each account.

    • A. Create an organizational unit (OU) in the management account with a service control policy (SCP) to restrict Regions and authorized services. Use AWS IAM roles for each business function, including IAM trust policies for identity provider authentication in each account.
    • B. Set permission boundaries in the management account to restrict Regions and authorized services. Use AWS IAM roles for each business function, including IAM trust policies for identity provider authentication in each account.
    • C. Establish service control policies (SCPs) in the management account to restrict Regions and authorized services. Use AWS Resource Access Manager (RAM) to share management account roles and grant permissions to each business function, including AWS IAM Identity Center for authentication in each account.
    • D. Establish service control policies (SCPs) in the management account to restrict Regions and authorized services. Use AWS IAM roles for each business function, including IAM trust policies for identity provider authentication in each account.

    View question →

96. Q96. A security team requires that any manually logged-in Amazon EC2 instance must be terminated within 24 hours. All applications in the security account run in Auto Scaling groups configured with the Amazon CloudWatch Logs agent.

    • A. Create a CloudWatch Logs subscription to an AWS Step Functions application. Configure an AWS Lambda function to tag the EC2 instance that generated the login event and mark it for termination. Create an Amazon EventBridge rule to invoke a second Lambda function daily to terminate all instances with this tag.
    • B. Create an Amazon CloudWatch alarm triggered by login events. Send notifications to an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the operations team, and ask them to terminate the EC2 instance within 24 hours.
    • C. Create an Amazon CloudWatch alarm triggered by login events. Configure the alarm to send notifications to an Amazon Simple Queue Service (Amazon SQS) queue. Use a fleet of worker instances to process messages from the queue and then schedule an Amazon EventBridge rule invocation.
    • D. Create a CloudWatch Logs subscription to an AWS Lambda function. Configure the function to tag the EC2 instance that generated the login event and mark it for termination. Create an Amazon EventBridge rule to invoke a daily Lambda function that terminates all instances with this tag.

    View question →

97. Q97. A security team requires that any manually logged-in Amazon EC2 instance must be terminated within 24 hours. All applications in the security account run in Auto Scaling groups configured with the Amazon CloudWatch Logs agent.

    • A. Create a CloudWatch Logs subscription to an AWS Step Functions application. Configure the function to tag the EC2 instance that generated the login event and mark it for termination. Then create a CloudWatch Events rule to trigger a second AWS Lambda function once daily to terminate all instances with this tag.
    • B. Create a CloudWatch alarm triggered by login events. Send notifications to an Amazon SNS topic subscribed to by the operations team, and ask them to terminate the EC2 instance within 24 hours.
    • C. Create a CloudWatch alarm triggered by login events. Configure the alarm to send notifications to an Amazon SQS queue. Use a fleet of worker instances to process messages from the queue and then schedule an Amazon CloudWatch Events rule trigger.
    • D. Create a CloudWatch Logs subscription to an AWS Lambda function. Configure the function to tag the EC2 instance that generated the login event and mark it for termination. Create a CloudWatch Events rule to trigger a daily Lambda function that terminates all instances with this tag.

    View question →

98. Q98. A company operates an application in a single AWS Region. The application runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster and connects to an Amazon Aurora MySQL cluster. The application is built in an AWS CodeBuild project. Container images are published to Amazon Elastic Container Registry (Amazon ECR). The company needs to replicate the container images and database state to a second Region. Which solution meets these requirements most efficiently?

    • A. Enable Amazon S3 Cross-Region Replication (CRR) on the bucket holding ECR container images. Deploy the application to an EKS cluster in the second Region, referencing the new S3 bucket object URL in the Kubernetes deployment files for the container image. Configure cross-Region Aurora replicas in the second Region. Configure the new application deployment to use the endpoint of the cross-Region Aurora replica.
    • B. Create an Amazon EventBridge rule that responds to image pushes to the ECR repository. Configure the EventBridge rule to invoke an AWS Lambda function that copies the image to a new ECR repository in the second Region. Deploy the application to an EKS cluster in the second Region, referencing the new ECR repository in the Kubernetes deployment files. Configure cross-Region Aurora replicas in the second Region. Configure the new application deployment to use the endpoint of the cross-Region Aurora replica.
    • C. Enable cross-Region replication to replicate the ECR repository to the second Region. Deploy the application to an EKS cluster in the second Region, referencing the new ECR repository in the Kubernetes deployment files. Configure an Aurora Global Database spanning the initial Region and the second Region. Configure the new application deployment to use the endpoint of the second Region’s cluster in the Aurora Global Database.
    • D. Modify the CodeBuild project to also push container images to an ECR repository in the second Region. Deploy the application to an EKS cluster in the second Region, referencing the new ECR repository in the Kubernetes deployment files. Configure an Aurora MySQL cluster in the second Region as a binary log replication target from the Aurora MySQL cluster in the initial Region. Configure the new application deployment to use the endpoint of the second Region’s cluster.

    View question →

99. Q99. A company uses Amazon EC2 instances as its primary compute platform. A developer team wants to audit the company’s EC2 instances to check whether any prohibited applications are installed on them. Which solution meets this requirement most efficiently?

    • A. Configure AWS Systems Manager on each instance. Use Systems Manager Inventory. Use Systems Manager Resource Data Sync to synchronize and store results in an Amazon S3 bucket. Create an AWS Lambda function that runs when a new object is added to the S3 bucket. Configure the Lambda function to identify prohibited applications.
    • B. Configure AWS Systems Manager on each instance. Use Systems Manager Inventory to create an AWS Config rule that monitors changes to Systems Manager Inventory data to identify prohibited applications.
    • C. Configure AWS Systems Manager on each instance. Use Systems Manager Inventory. Filter AWS CloudTrail logs for Systems Manager Inventory events to identify prohibited applications.
    • D. Configure Amazon CloudWatch Logs as the log destination for all application instances. Run an automated script on all instances to generate a list of installed applications. Configure the script to forward results to CloudWatch Logs. Create a CloudWatch alarm using a filter pattern to search log data for prohibited applications.

    View question →

100. Q100. A company’s developers use Amazon EC2 instances as remote workstations. The company is concerned that users might create or modify EC2 security group rules allowing unrestricted inbound access. A DevOps engineer must develop a solution to detect when users create unrestricted security group rules. The solution must detect security group rule changes nearly in real time, remove unrestricted rules, and send email notifications to the security team. The DevOps engineer has created an AWS Lambda function that accepts a security group ID as input, removes rules permitting unrestricted access, and sends notifications via Amazon Simple Notification Service (Amazon SNS). What should the DevOps engineer do next to meet the requirements?

     • A. Configure the Lambda function to be invoked by an SNS topic. Create an AWS CloudTrail subscription for the SNS topic. Configure the subscription filter for security group modification events.
     • B. Create an Amazon EventBridge scheduled rule to invoke the Lambda function. Define a schedule mode to run the Lambda function hourly.
     • C. Create an Amazon EventBridge event rule with the default event bus as the source. Define an event pattern matching EC2 security group creation and modification events. Configure the rule to invoke the Lambda function.
     • D. Create an Amazon EventBridge custom event bus and subscribe to events from all AWS services. Configure the Lambda function to be invoked by the custom event bus.

     View question →