115 free AWS DOP-C02 practice questions from the CertStash pack of 460, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 115 free here, all 480 in the pack, and each step includes the one before it.
Get all 480 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user-agent header that is sent with all requests to the API. After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user-agent header and response code. Which additional set of actions should the DevOps engineer take to gather the required metrics?
Show answer and explanation
Correct answer: A. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group. Configure a CloudWatch Logs metric filter that increments a metric for each API operation name. Specify response code and application version as dimensions for the metric.
The solution requires extracting the API operation name, response code, and application version from the Lambda function and creating custom metrics with these dimensions. Option A correctly identifies that CloudWatch Logs metric filters can parse log lines and create metrics with multiple dimensions (response code and application version) for each API operation. This is the standard, native approach for converting log data into metrics. Option B suggests using CloudWatch Logs Insights, which is a query tool and does not automatically populate metrics; it requires manual queries. Option C incorrectly focuses on ALB access logs and response metadata, which would not contain the API operation details. Option D uses X-Ray, which adds complexity and requires additional configuration without the direct metric dimension support needed.
Why the other options are wrong
- B. CloudWatch Logs Insights is a query tool for analyzing logs, not a mechanism for automatically populating CloudWatch metrics.
- C. ALB access logs don't contain API operation details, and response metadata cannot be parsed by ALB to extract this information.
- D. X-Ray adds unnecessary complexity and does not provide the straightforward metric filtering with dimensions that metric filters offer.
Question 2
A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function. On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long coldstart times of 8-10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured. Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total. A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Configure provisioned concurrency on the Lambda function. Configure AWS Application Auto Scaling on the Lambda function with provisioned concurrency values set to a minimum of 1 and a maximum of 100.
The problem involves variable traffic patterns with peak demand 10 times normal and end-of-day valleys at 10% of normal, combined with 8-10 second cold start times. Provisioned concurrency eliminates cold starts by maintaining pre-initialized Lambda instances, and Application Auto Scaling allows the provisioned concurrency to scale dynamically based on demand. Setting a minimum of 1 ensures some warm instances always exist to handle baseline traffic, while a maximum of 100 accommodates the 10x peak demand periods. This directly addresses the cold start latency issue and scales cost-effectively with traffic variations. Option A sets concurrency to only 1, which cannot handle peak traffic. Option B uses reserved concurrency with value 0, which doesn't reduce cold starts. Option D applies reserved concurrency and scales API Gateway instead of Lambda concurrency directly.
Why the other options are wrong
- A. A concurrency value of 1 cannot handle thousands of daily requests or the 10x peak demand periods, and deleting DAX removes an already-deployed optimization.
- B. Reserved concurrency with value 0 does nothing; it prevents Lambda from scaling and doesn't reduce cold starts.
- D. Scaling API Gateway reserved concurrency does not address Lambda cold starts, which is the root cause of latency.
Question 3
A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production. The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group. How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?
Show answer and explanation
Correct answer: B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file.
CodeDeploy provides built-in environment variables during deployment, including DEPLOYMENT_GROUP_NAME, which identifies the current deployment group without requiring custom tagging, EC2 API calls, or custom runbooks. This variable can be accessed in any lifecycle hook script to dynamically configure settings based on the deployment group. Using it in the BeforeInstall hook allows configuration before the application is installed, which is appropriate for setting log level configurations. The approach requires a single script that uses this variable, avoiding the need for different script versions or applications for each environment. Option A requires EC2 tagging and API calls, adding management overhead. Option C requires creating custom environment variables for each deployment group. Option D references a non-standard environment variable DEPLOYMENT_GROUP_ID and uses the Install hook instead of BeforeInstall.
Why the other options are wrong
- A. Querying EC2 metadata and API to determine deployment group adds unnecessary complexity compared to using built-in CodeDeploy environment variables.
- C. Custom environment variables must be manually created for each deployment group, adding management overhead that the built-in DEPLOYMENT_GROUP_NAME variable eliminates.
- D. DEPLOYMENT_GROUP_ID is not a standard CodeDeploy environment variable; DEPLOYMENT_GROUP_NAME is the correct variable to use.
Question 4
A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes. A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
AWS Config is designed to assess compliance of existing resources against rules and trigger automated remediation. A managed rule specifically for EBS volume tagging (or equivalent EC2 resource tagging rules) can evaluate all existing EBS volumes and detect those missing the Backup_Frequency tag. AWS Config's remediation action can apply a default tag value of 'weekly' to non-compliant volumes automatically. This addresses both new and existing volumes, ensures compliance across the entire account history, and requires less custom development than EventBridge solutions. Option A uses a custom rule instead of a managed rule, requiring more maintenance. Options C and D use EventBridge, which only reacts to new CreateVolume events and cannot enforce tags on existing untagged volumes that were created before the rule was in place.
Why the other options are wrong
- A. Custom rules require more maintenance and development effort than managed rules, which AWS maintains and updates.
- C. EventBridge only responds to CreateVolume events, missing existing untagged volumes already in the account.
- D. EventBridge only responds to volume creation and modification events, not to volumes that already exist without tags from before the rule was enabled.
Question 5
A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint. The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window. What should a DevOps engineer do to meet these requirements?
Show answer and explanation
Correct answer: A. Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster's reader endpoint for reads.
Adding a reader instance to an Aurora cluster enables automatic failover during maintenance. During the maintenance window, if the primary instance is updated, the cluster automatically promotes a reader instance to primary with minimal downtime (typically 1-2 seconds). By updating the application to use the cluster endpoint for writes (which always routes to the primary) and the reader endpoint for reads (which distributes across reader instances), the application maintains availability throughout the update. The reader instance handles read traffic while the original primary is being updated. Option B introduces unnecessary complexity with custom ANY endpoints. Options C and D use Multi-AZ, which applies to the entire cluster but does not provide the same level of granular read-write endpoint control as adding a reader instance.
Why the other options are wrong
- B. Custom ANY endpoints add complexity without providing the automatic failover benefits that having a dedicated reader instance provides.
- C. Multi-AZ on Aurora applies to the database cluster as a whole, not providing the same granular control over read-write operations during maintenance as a dedicated reader instance.
- D. Multi-AZ with a custom ANY endpoint combines unnecessary complexity and does not provide better failover capability than using a reader instance with standard endpoints.
Question 6
A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account. The company has created an AWS Key Management Service (AWS KMS) key in the source account. Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)
Show answer and explanation
Correct answer: A, D, F. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action; In the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role; In the source account, share the encrypted AMI with the target account.
To share an encrypted AMI across accounts with KMS encryption, three steps are required. First, the unencrypted AMI must be copied and re-encrypted with the source account's KMS key (Option A). Second, the source account's KMS key policy must be modified to allow the target account to use the key and create grants, and the target account must create a grant delegating permissions to the Auto Scaling service-linked role (Option D). Third, the encrypted AMI must be shared with the target account (Option F). Option B incorrectly suggests using the default EBS encryption key instead of the specified KMS key. Option C creates a grant in the wrong direction. Option E shares the unencrypted AMI, which violates the requirement that all shared AMIs must be encrypted.
Why the other options are wrong
- B. The default EBS encryption key is not appropriate; the specified KMS key in the source account must be used.
- C. A grant cannot be created in the source account for a target account service-linked role; the target account must create its own grant.
- E. Sharing an unencrypted AMI violates the company requirement that all shared AMIs must be encrypted.
Question 7
A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines. The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI. Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. Create a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the EC2 instances to allow access to CodeDeploy; Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.
To deploy applications to EC2 instances in an Auto Scaling group using CodeDeploy, two key steps are required. First, a new AMI must be created with the CodeDeploy agent installed, and the IAM role must be updated to grant CodeDeploy access (Option A). Second, a CodeDeploy application with in-place deployment type must be created, targeting the Auto Scaling group, and the CodePipeline pipeline must be updated to use the CodeDeploy action (Option D). This allows CodeDeploy to automatically deploy the application to all instances in the group. Option B incorrectly suggests the AppSpec file grants CodeDeploy access, which is handled by IAM roles. Option C adds unnecessary EC2 Image Builder complexity beyond the requirements. Option E specifies individual instances rather than the Auto Scaling group, which would not scale properly.
Why the other options are wrong
- B. The AppSpec file defines deployment steps but does not grant AWS service permissions; those are controlled by IAM roles.
- C. Using EC2 Image Builder to create a new AMI during deployment is unnecessary and adds complexity; the existing AMI is already built.
- E. Specifying individual instances instead of the Auto Scaling group means new instances added to the group will not automatically receive deployments.
Question 8
A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs. Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)
Show answer and explanation
Correct answer: A, C. Delegate AWS Firewall Manager to a security account; Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
To enforce WAF compliance across hundreds of accounts in an organization, AWS Firewall Manager is the appropriate solution. Firewall Manager must first be delegated to a security account (Option A), which provides centralized management and policy deployment across all organization accounts. Then, an AWS Firewall Manager policy (Option C) can be created to automatically attach AWS WAF web ACLs to all newly created ALBs and API Gateway APIs, ensuring future resources are compliant from creation. This organization-wide approach prevents violations prospectively. Option B references GuardDuty, which is a threat detection service unrelated to WAF management. Option D suggests GuardDuty policies for WAF attachment, which is not a GuardDuty function. Option E uses AWS Config managed rules, which are useful for compliance checking but not for organization-wide policy deployment across multiple accounts.
Why the other options are wrong
- B. Amazon GuardDuty is a threat detection service and is not used for managing WAF policies across accounts.
- D. GuardDuty does not have policies for attaching WAF web ACLs; that is a Firewall Manager function.
- E. AWS Config managed rules can detect compliance issues but cannot enforce policies across multiple accounts in an organization; Firewall Manager is required for that capability.
Question 9
A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days. Which solution will accomplish this?
Show answer and explanation
Correct answer: C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
AWS Config custom rules can evaluate the compliance of AWS resources against desired configurations and detect when KMS keys haven't been rotated within a specified timeframe. A custom rule can be triggered on configuration changes and integrated with SNS for notifications. AWS KMS itself does not have a built-in publish feature for age-based key rotation events, Trusted Advisor does not provide KMS key rotation metrics, and Security Hub does not natively track KMS key rotation age.
Why the other options are wrong
- A. AWS KMS does not have native functionality to publish messages based on key age thresholds.
- B. AWS Trusted Advisor does not provide specific metrics for KMS key rotation age tracking.
- D. AWS Security Hub does not have built-in checks for KMS key rotation age.
Question 10
A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project. How can this issue be corrected in the MOST secure manner?
Show answer and explanation
Correct answer: C. Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script.
The most secure approach removes unauthenticated access entirely via bucket policy, then grants the CodeBuild service role explicit S3 permissions through IAM policy, allowing authenticated access through the role's credentials. The AWS CLI automatically uses the service role's temporary credentials for authentication. This follows the principle of least privilege by removing public access and granting only the necessary permissions to the CodeBuild service. Options A and B introduce configuration complexity without proper authentication mechanisms, and option D requires hardcoded long-term credentials which is a security anti-pattern.
Why the other options are wrong
- A. AllowedBuckets is not a valid CodeBuild setting, and this approach doesn't properly address authentication.
- B. S3 does not support HTTPS basic authentication; this approach would require credential exposure in the build spec.
- D. Using long-term IAM access keys in build specs is insecure and violates the principle of least privilege compared to temporary role credentials.
What people say about the full DOP-C02 pack 4.9 from 11
Honestly, I was a bit skeptical about Certstash at first, but these DOP-C02 dumps were a total game-changer. I saw at least 80% of these exact questions on the real exam. Passed this morning with a great score. Seriously, don't hesitate.
Simple and effective. The Certstash material is accurate, the site is easy to use, and it helped me pass the DOP-C02. What more can you ask for? A+ product.
Passed the DOP-C02 today! I was really struggling with the breadth of topics, but the questions from Certstash helped me zero in on what was important. The interface is clean and easy to use. Great resource, worth every penny.
Question 11
A DevOps engineer used an AWS CloudFormation custom resource to set up AD Connector. The AWS Lambda function ran and created AD Connector, but CloudFormation is not transitioning from CREATE_IN_PROGRESS to CREATE_COMPLETE. Which action should the engineer take to resolve this issue?
Show answer and explanation
Correct answer: B. Ensure the Lambda function code returns a response to the pre-signed URL.
CloudFormation custom resources require the Lambda function to send a response back to a pre-signed URL that CloudFormation provides. Without this callback, CloudFormation cannot determine whether the custom resource creation succeeded or failed, so the stack remains in CREATE_IN_PROGRESS indefinitely. The Lambda function must explicitly return a success or failure response to the pre-signed S3 URL provided in the request context.
Why the other options are wrong
- A. Lambda exiting successfully is necessary but insufficient; the function must also send the response callback to CloudFormation.
- C. CloudFormation:UpdateStack permissions are unrelated to custom resource creation callbacks.
- D. DS:ConnectDirectory permissions are required for AD Connector creation itself, but this doesn't address the callback issue preventing stack transition.
Question 12
A company has a guideline that every Amazon EC2 instance must be launched from an AMI that the company’s security team produces. Every month, the security team sends an email message with the latest approved AMIs to all the development teams. The development teams use AWS CloudFormation to deploy their applications. When developers launch a new service, they have to search their email for the latest AMIs that the security department sent. A DevOps engineer wants to automate the process that the security team uses to provide the AMI IDs to the development teams. What is the MOST scalable solution that meets these requirements?
Show answer and explanation
Correct answer: C. Direct the security team to use Amazon EC2 Image Builder to create new AMIs and to place the AMI ARNs as parameters in AWS Systems Manager Parameter Store. Instruct the developers to specify a parameter of type SSM in their CloudFormation stack to obtain the most recent AMI ARNs from Parameter Store.
AWS Systems Manager Parameter Store provides a centralized, scalable way for the security team to publish AMI IDs that CloudFormation can reference directly using SSM parameter types. EC2 Image Builder automates AMI creation with versioning capabilities. This eliminates manual email distribution, requires no cross-stack references or SNS notifications with manual Lambda functions, and allows developers to simply reference the parameter in their CloudFormation templates without searching emails or managing S3 objects. Parameters are automatically updated when the security team publishes new AMI IDs, making this the most scalable solution.
Why the other options are wrong
- A. Cross-stack references cannot load encrypted S3 objects; this approach requires manual S3 object management and doesn't integrate naturally with CloudFormation.
- B. CodePipeline is unnecessary for this workflow since EC2 Image Builder already manages AMI building, and S3 object cross-stack references are overly complex.
- D. Requiring developers to write Lambda functions to update stacks when notifications arrive defeats automation and places maintenance burden on every development team.
Question 13
A company has deployed an application in a production VPC in a single AWS account. The application is popular and is experiencing heavy usage. The company’s security team wants to add additional security, such as AWS WAF, to the application deployment. However, the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary. The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional security. The DevOps engineer creates a VPC flow log for the production VPC. Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Create a log group in Amazon CloudWatch Logs. Configure the VPC flow log to capture accepted traffic and to send the data to the log group. Create an Amazon CloudWatch metric filter for IP addresses on the deny list. Create a CloudWatch alarm with the metric filter as input. Set the period to 5 minutes and the datapoints to alarm to 1. Use an Amazon Simple Notification Service (Amazon SNS) topic to send alarm notices to the security team.
Option A is the most cost-effective solution for near-real-time alerting. CloudWatch Logs captures VPC flow data for accepted traffic only (reducing storage costs), a CloudWatch metric filter identifies denied-list IP addresses, and a CloudWatch alarm with a 5-minute period and 1-datapoint threshold triggers immediate SNS notifications to the security team. This approach provides the required near-real-time detection while minimizing costs through selective traffic capture and native AWS monitoring services.
Why the other options are wrong
- B. S3 with Athena and QuickSight provides analytics dashboards but lacks near-real-time alerting; QuickSight dashboards do not automatically notify users, requiring manual checking.
- C. OpenSearch Service adds unnecessary complexity and cost for a simple IP-based filtering use case; Lambda scheduled every 5 minutes introduces processing delays and operational overhead.
- D. Combines CloudWatch Logs with Athena and S3, adding unnecessary architectural complexity; Athena queries are not real-time and S3 event notifications cannot trigger based on query results.
Question 14
A company has an application that runs on Amazon EC2 instances. The company uses an AWS CodePipeline pipeline to deploy the application into multiple AWS Regions. The pipeline is configured with a stage for each Region. Each stage contains an AWS CloudFormation action for each Region. When the pipeline deploys the application to a Region, the company wants to confirm that the application is in a healthy state before the pipeline moves on to the next Region. Amazon Route 53 record sets are configured for the application in each Region. A DevOps engineer creates a Route 53 health check that is based on an Amazon CloudWatch alarm for each Region where the application is deployed. What should the DevOps engineer do next to meet the requirements?
Show answer and explanation
Correct answer: A. Create an AWS Step Functions workflow to check the state of the CloudWatch alarm. Configure the Step Functions workflow to exit with an error if the alarm is in the ALARM state. Create a new stage in the pipeline between each Region deployment stage. In each new stage, include an action to invoke the Step Functions workflow.
Step Functions provides a robust mechanism to check CloudWatch alarm states between pipeline stages. By creating a Step Functions workflow that evaluates the alarm state and exits with an error if the alarm is in ALARM state, the pipeline will automatically fail and prevent progression to the next region if the application is unhealthy. Inserting this workflow as a separate stage between each region deployment ensures sequential validation and allows for controlled remediation.
Why the other options are wrong
- B. CodeDeploy is designed for application deployment, not health monitoring, and would require removing existing CloudFormation actions, creating unnecessary architectural changes.
- C. CloudWatch alarms cannot be configured as pipeline stage actions; this feature does not exist in CodePipeline's native capabilities.
- D. CloudWatch agents report to CloudWatch Metrics, not directly to Route 53 health checks, and CloudWatch alarm actions cannot be configured as pipeline stage actions.
Question 15
A company manages a multi-tenant environment in its VPC and has configured Amazon GuardDuty for the corresponding AWS account. The company sends all GuardDuty findings to AWS Security Hub. Traffic from suspicious sources is generating a large number of findings. A DevOps engineer needs to implement a solution to automatically deny traffic across the entire VPC when GuardDuty discovers a new suspicious source. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Configure a firewall in AWS Network Firewall. Create an AWS Lambda function that will create a Drop action rule in the firewall policy. Configure the Lambda function to run in response to new Security Hub findings that come from GuardDuty.
AWS Network Firewall operates at the VPC perimeter and can block traffic from specific sources across all traffic entering or exiting the VPC. A Lambda function triggered by Security Hub findings can create Drop action rules in the Network Firewall policy to deny traffic from suspicious sources discovered by GuardDuty. This solution automatically denies traffic VPC-wide in response to new findings without requiring manual rule management.
Why the other options are wrong
- A. GuardDuty threat lists are for input to GuardDuty detection, not for output blocking; this does not actually block traffic in the VPC.
- B. AWS WAF protects web applications at layer 7 and only applies to specific resources; it cannot block traffic across an entire VPC or protect non-web protocols.
- D. Suppression rules in GuardDuty suppress findings from being reported; they do not block traffic from reaching resources.
Question 16
A company has a mission-critical application on AWS that uses automatic scaling. The company wants the deployment lifecycle to meet the following parameters: • The application must be deployed one instance at a time to ensure the remaining fleet continues to serve traffic. • The application is CPU intensive and must be closely monitored. • The deployment must automatically roll back if the CPU utilization of the deployment instance exceeds 85%. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Use AWS CodeDeploy with Amazon EC2 Auto Scaling Configure an alarm tied to the CPU utilization metric. Use the CodeDeployDefault OneAtAtime configuration as a deployment strategy. Configure automatic rollbacks within the deployment group to roll back the deployment if the alarm thresholds are breached.
CodeDeploy with the OneAtATime configuration deploys to one instance at a time, maintaining fleet availability. CloudWatch alarms tied to CPU utilization can automatically trigger rollbacks within CodeDeploy's deployment group if thresholds are breached, providing the required monitoring and automatic rollback mechanism for the CPU-intensive application.
Why the other options are wrong
- A. Step Functions with lifecycle hooks adds unnecessary complexity and doesn't provide built-in CPU monitoring and automatic rollback tied to deployment health.
- C. Elastic Beanstalk rolling deployments don't integrate alarm-based rollbacks directly; enhanced health monitoring is for instance health, not CPU-specific thresholds linked to deployment decisions.
- D. Blue/green deployments require maintaining two complete environments, which is more expensive and complex than the single-instance-at-a-time requirement; Systems Manager doesn't provide the same integrated alarm-driven rollback as CodeDeploy.
Question 17
A large enterprise is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon RDS for Oracle DB instance and Amazon DynamoDB. There are separate environments for development, testing, and production. What is the MOST secure and flexible way to obtain password credentials during deployment?
Show answer and explanation
Correct answer: B. Launch the EC2 instances with an EC2 IAM role to access AWS services. Retrieve the database credentials from AWS Secrets Manager.
Using an EC2 IAM role eliminates the need to manage static access keys on instances, providing superior security and flexibility across development, testing, and production environments. AWS Secrets Manager is the purpose-built service for managing database credentials with automatic rotation, encryption, and audit logging capabilities. This combination represents AWS best practices for credential management in enterprise deployments.
Why the other options are wrong
- A. Storing access keys in parameter store requires managing and rotating keys manually; Systems Manager is not the primary credential store for database passwords.
- C. Plaintext parameters offer no security for access keys; this violates security best practices regardless of database credential storage.
- D. Storing passwords in encrypted config files bundled with application artifacts prevents centralized rotation and creates security vulnerabilities if the artifact is compromised.
Question 18
A company has an AWS Control Tower landing zone that manages its organization in AWS Organizations. The company created an OU structure that is based on the company's requirements. The company's DevOps team has established the core accounts for the solution and an account for all centralized AWS CloudFormation and AWS Service Catalog solutions. The company wants to offer a series of customizations that an account can request through AWS Control Tower. Which combination of steps will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: B, C, F. Create an IAM role that is named AWSControlTowerBlueprintAccess. Configure the role with a trust policy that allows the AWSControlTowerAdmin role in the management account to assume the role. Attach the AWSServiceCatalogAdminFullAccess IAM policy to the AWSControlTowerBlueprintAccess role; Create a Service Catalog product for each CloudFormation template; Create a CloudFormation template that contains the resources for each customization.
Option B creates the IAM role structure necessary for Control Tower to deploy customizations with appropriate permissions to Service Catalog. Option C converts CloudFormation templates into Service Catalog products, enabling account teams to request customizations through the Service Catalog interface. Option F creates the actual CloudFormation templates that define the customizable resources. Together, these three steps establish the infrastructure and permissions required for Control Tower to offer self-service customizations through Service Catalog.
Why the other options are wrong
- A. Enabling trusted access for CloudFormation with Organizations is setup for StackSets deployment, not for Control Tower customizations through Service Catalog.
- D. Creating StackSets with automatic deployment targets specific OUs, which is not the pattern for user-requested customizations; Control Tower customizations are pulled by accounts, not pushed.
- E. Customizations for AWS Control Tower (CfCT) is a separate framework not needed when using Service Catalog for customizations through Control Tower.
Question 19
A space exploration company receives telemetry data from multiple satellites. Small packets of data are received through Amazon API Gateway and are placed directly into an Amazon Simple Queue Service (Amazon SQS) standard queue. A custom application is subscribed to the queue and transforms the data into a standard format. Because of inconsistencies in the data that the satellites produce, the application is occasionally unable to transform the data. In these cases, the messages remain in the SQS queue. A DevOps engineer must develop a solution that retains the failed messages and makes them available to scientists for review and future processing. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create an SQS dead-letter queue. Modify the existing queue by including a redrive policy that sets the Maximum Receives setting to 1 and sets the dead-letter queue ARN to the ARN of the newly created queue. Instruct the scientists to use the dead-letter queue to review the data that is not valid. Reprocess this data at a later time.
Dead-letter queues are designed exactly for this scenario: when a message fails processing a specified number of times, it's automatically moved to the dead-letter queue. Setting Maximum Receives to 1 means any message the application cannot transform is immediately sent to the DLQ. Scientists can review these failed messages in the DLQ and reprocess them after corrections, without complicated custom logic or modifying production queues.
Why the other options are wrong
- A. This approach requires custom Lambda validation logic and manual SQS message updates, which is more complex than using built-in DLQ functionality.
- B. Switching to FIFO and polling every 10 minutes adds unnecessary complexity and delay; standard queues with DLQ are simpler and more efficient.
- D. Creating virtual queues per satellite adds operational complexity without addressing the core issue of retaining and managing failed messages systematically.
Question 20
A developer is maintaining a fleet of 50 Amazon EC2 Linux servers. The servers are part of an Amazon EC2 Auto Scaling group, and also use Elastic Load Balancing for load balancing. Occasionally, some application servers are being terminated after failing ELB HTTP health checks. The developer would like to perform a root cause analysis on the issue, but before being able to access application logs, the server is terminated. How can log collection be automated?
Show answer and explanation
Correct answer: D. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon EventBridge rule for EC2 Instanceterminate Lifecycle Action and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.
Auto Scaling lifecycle hooks placed in the Terminating:Wait state pause instance termination to allow time for log collection. EventBridge rules can detect EC2 Instance Terminate Lifecycle Action events and trigger a Lambda function, which invokes SSM Run Command to collect and push logs to S3 before completing the lifecycle action. This solution captures logs before termination and automates the entire process.
Why the other options are wrong
- A. Pending:Wait state is used when instances are launching, not terminating; the CloudWatch alarm for EC2 Instance Terminate Successful fires after termination is complete, making it too late to collect logs.
- B. AWS Config rules do not trigger on lifecycle actions and are not the appropriate service for responding to EC2 termination events; Step Functions adds unnecessary complexity compared to Lambda.
- C. CloudWatch subscription filters are designed for processing log stream data, not for triggering actions on EC2 lifecycle events; a CloudWatch agent cannot execute lifecycle action completion.
Question 21
A DevOps engineer is building a solution that uses Amazon Simple Queue Service (Amazon SQS) standard queues. The solution also includes an AWS Lambda function and an Amazon DynamoDB table. The Lambda function pulls content from an SQS queue event source and writes the content to the DynamoDB table. The solution must maximize the scalability of Lambda and must prevent successfully processed SQS messages from being processed multiple times. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Include the ReportBatchItemFailures value in the FunctionResponseTypes list in the Lambda function's event source mapping.
To prevent duplicate processing while maximizing scalability, the Lambda function must report which messages failed so they remain in the queue for retry, while successfully processed messages are deleted. Option C's ReportBatchItemFailures enables partial batch failure responses, allowing Lambda to acknowledge only the messages it successfully processed and wrote to DynamoDB. This prevents message loss and duplicate processing. Option A decreases throughput by reducing concurrency. Option B severely limits concurrency and throughput to one message at a time. Option D addresses invocation throttling but doesn't solve the idempotency requirement.
Why the other options are wrong
- A. A 1-second batch window reduces how many messages can be processed and doesn't address the idempotency requirement.
- B. A batch size of 1 severely limits scalability by processing only one message per invocation, directly contradicting the maximize scalability requirement.
- D. Queue visibility timeout relates to how long a message is hidden after retrieval but doesn't prevent duplicate processing if the function fails or doesn't report failures.
Question 22
A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back. Which strategy will meet these requirements?
Show answer and explanation
Correct answer: C. Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function to run the test scripts. If errors are found, exit the Lambda function with an error to initiate rollback.
The AfterAllowTestTraffic lifecycle event in CodeDeploy AppSpec files is specifically designed to run validation scripts after the green environment receives traffic but before full traffic shift. This allows testing in the actual deployment context. If the Lambda function exits with an error, CodeDeploy automatically triggers a rollback without needing manual CLI commands. This approach keeps the testing logic tightly coupled with the deployment process where it belongs.
Why the other options are wrong
- A. Adding a stage before deployment means tests run against code in isolation, not the actual deployed green environment, which may not catch environment-specific issues.
- B. Testing before deployment misses deployment-specific issues and doesn't align with blue/green testing best practices where validation occurs after green deployment.
- D. AfterAllowTraffic occurs after traffic shift is complete, meaning production traffic has already been affected before test failures are detected.
Question 23
A company wants to migrate its content sharing web application hosted on Amazon EC2 to a serverless architecture. The company currently deploys changes to its application by creating a new Auto Scaling group of EC2 instances and a new Elastic Load Balancer, and then shifting the traffic away using an Amazon Route 53 weighted routing policy. For its new serverless application, the company is planning to use Amazon API Gateway and AWS Lambda. The company will need to update its deployment processes to work with the new application. It will also need to retain the ability to test new features on a small number of users before rolling the features out to the entire user base. Which deployment strategy will meet these requirements?
Show answer and explanation
Correct answer: B. Use AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions. When code needs to be changed, update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Promote the new version when testing is complete.
Option B uses CloudFormation with Lambda function versions and aliases to support canary releases for gradual traffic shifting to new versions, meeting the requirement to test features on a subset of users before full rollout. This approach is directly supported by API Gateway and Lambda integration. Option A uses Route 53 failover (not canary), option C uses Elastic Beanstalk (not appropriate for serverless), and option D uses OpsWorks (not designed for Lambda/API Gateway).
Why the other options are wrong
- A. Route 53 failover routing policy is not a canary release strategy; it's binary failover, not gradual traffic shifting.
- C. Elastic Beanstalk is designed for managed EC2-based deployments, not serverless architectures with API Gateway and Lambda.
- D. OpsWorks is a configuration management service not designed for API Gateway and Lambda deployments.
Question 24
A company has a legacy application. A DevOps engineer needs to automate the process of building the deployable artifact for the legacy application. The solution must store the deployable artifact in an existing Amazon S3 bucket for future deployments to reference. Which solution will meet these requirements in the MOST operationally efficient way?
Show answer and explanation
Correct answer: A. Create a custom Docker image that contains all the dependencies for the legacy application. Store the custom Docker image in a new Amazon Elastic Container Registry (Amazon ECR) repository. Configure a new AWS CodeBuild project to use the custom Docker image to build the deployable artifact and to save the artifact to the S3 bucket.
AWS CodeBuild is the most operationally efficient solution for automating artifact builds. Create a custom Docker image with legacy application dependencies, store it in Amazon ECR, and configure a CodeBuild project to use that image. CodeBuild is fully managed, serverless, scales automatically, and integrates seamlessly with CI/CD pipelines. The built artifact is stored in S3 for future deployments. Launching and managing EC2 instances (option B) requires manual provisioning and ongoing maintenance. EC2 Image Builder (option C) is for building AMIs, adding unnecessary complexity. EKS with Fargate (option D) is over-engineered for a simple build process and adds operational overhead.
Why the other options are wrong
- B. Manual EC2 instance management requires ongoing maintenance and doesn't scale automatically.
- C. EC2 Image Builder is designed for AMI creation, not for running build processes; it adds unnecessary complexity.
- D. EKS with Fargate is over-provisioned for a simple build task and introduces unnecessary operational complexity.
Question 25
A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization. Which combination of access changes will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: B, C, E. Create a trust relationship that allows users in the management account to assume the IAM roles of the member accounts; Create an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess managed policy; Create an I AM role in the management account that allows the sts:AssumeRole action against the member account IAM role's ARN.
To retrieve EC2 security group information from member accounts via a Lambda function in the management account: create an IAM role in each member account with EC2ReadOnlyAccess permissions, set up a trust relationship in member account roles allowing the management account role to assume them, and create an IAM role in the management account with permissions to assume the member account roles. This cross-account assume role pattern enables the management account Lambda to access member account resources.
Why the other options are wrong
- A. Trust relationships should allow management account to assume member roles, not the reverse.
- D. Member account roles don't need to assume management account roles; the direction is opposite to what's needed.
- F. The management account role needs sts:AssumeRole permissions, not EC2ReadOnlyAccess directly; the member account roles provide the EC2 read access.
Question 26
A company has many applications. Different teams in the company developed the applications by using multiple languages and frameworks. The applications run on premises and on different servers with different operating systems. Each team has its own release protocol and process. The company wants to reduce the complexity of the release and maintenance of these applications. The company is migrating its technology stacks, including these applications, to AWS. The company wants centralized control of source code, a consistent and automatic delivery pipeline, and as few maintenance tasks as possible on the underlying infrastructure. What should a DevOps engineer do to meet these requirements?
Show answer and explanation
Correct answer: D. Create one AWS CodeCommit repository for each of the applications. Use AWS CodeBuild to build one Docker image for each application in Amazon Elastic Container Registry (Amazon ECR). Use AWS CodeDeploy to deploy the applications to Amazon Elastic Container Service (Amazon ECS) on infrastructure that AWS Fargate manages.
Containerizing applications with Docker addresses the need to support multiple languages and frameworks with minimal maintenance. CodeCommit repositories per application provide source isolation. CodeBuild creates Docker images stored in Amazon ECR. CodeDeploy pushes these images to Amazon ECS on AWS Fargate, which manages the underlying infrastructure automatically. This approach eliminates OS-level maintenance, supports any language or framework, and provides centralized control with minimal infrastructure overhead.
Why the other options are wrong
- A. Using a single repository with branches loses application isolation; attempting to deploy multiple language applications to one centralized server creates dependency and deployment conflicts.
- B. Deploying multiple different-language applications to one centralized server creates maintenance and scaling problems; this approach does not reduce infrastructure complexity.
- C. Creating separate AMIs for each server requires more operational overhead than containerization; StackSets add complexity for managing multiple account deployments when scaling is not mentioned as a requirement.
Question 27
A company uses AWS CloudFormation stacks to deploy updates to its application. The stacks consist of different resources. The resources include AWS Auto Scaling groups, Amazon EC2 instances, Application Load Balancers (ALBs), and other resources that are necessary to launch and maintain independent stacks. Changes to application resources outside of CloudFormation stack updates are not allowed. The company recently attempted to update the application stack by using the AWS CLI. The stack failed to update and produced the following error message: “ERROR: both the deployment and the CloudFormation stack rollback failed. The deployment failed because the following resource(s) failed to update: [AutoScalingGroup].” The stack remains in a status of UPDATE_ROLLBACK_FAILED. Which solution will resolve this issue?
Show answer and explanation
Correct answer: B. Update the IAM role by providing the necessary permissions to update the stack. Run the aws cloudformation continue-update-rollback AWS CLI command.
When a stack enters UPDATE_ROLLBACK_FAILED status, it indicates the stack is stuck and cannot recover automatically. The continue-update-rollback command allows CloudFormation to retry the rollback operation. The error message suggests the issue is likely permission-related (the AutoScalingGroup update failed, and then rollback also failed), so updating the IAM role to grant necessary permissions combined with the continue-update-rollback command resolves the stuck state and allows the stack to recover.
Why the other options are wrong
- A. Updating subnet mappings and using UpdateStackSet does not address the root cause of the UPDATE_ROLLBACK_FAILED state or the permissions issue.
- C. Requesting a quota increase and canceling the update does not resolve the stuck rollback state; the stack remains in UPDATE_ROLLBACK_FAILED status.
- D. Manually deleting resources and using rollback-stack (which is not a valid CloudFormation command) violates the company's policy of only allowing changes through CloudFormation and does not resolve the underlying issue.
Question 28
A company is building a new pipeline by using AWS CodePipeline and AWS CodeBuild in a build account. The pipeline consists of two stages. The first stage is a CodeBuild job to build and package an AWS Lambda function. The second stage consists of deployment actions that operate on two different AWS accounts: a development environment account and a production environment account. The deployment stages use the AWS CloudFormation action that CodePipeline invokes to deploy the infrastructure that the Lambda function requires. A DevOps engineer creates the CodePipeline pipeline and configures the pipeline to encrypt build artifacts by using the AWS Key Management Service (AWS KMS) AWS managed key for Amazon S3 (the aws/s3 key). The artifacts are stored in an S3 bucket. When the pipeline runs, the CloudFormation actions fail with an access denied error. Which combination of actions must the DevOps engineer perform to resolve this error? (Choose two.)
Show answer and explanation
Correct answer: B, E. Create a customer managed KMS key. Configure the KMS key policy to allow the IAM roles used by the CloudFormation action to perform decrypt operations. Modify the pipeline to use the customer managed KMS key to encrypt artifacts; In the development account and in the production account, create an IAM role for CodePipeline. Configure the roles with permissions to perform CloudFormation operations and with permissions to retrieve and decrypt objects from the artifacts S3 bucket. In the CodePipeline account, modify the artifacts S3 bucket policy to allow the roles access. Configure the CodePipeline CloudFormation action to use the roles.
A customer-managed KMS key allows explicit cross-account permissions for decryption operations that the AWS-managed aws/s3 key does not support. The KMS key policy must grant decrypt permissions to the IAM roles used by CloudFormation in the development and production accounts. Additionally, an S3 bucket policy must allow these cross-account roles to retrieve and decrypt artifacts from the build account's bucket. These two actions together enable CloudFormation in other accounts to access encrypted artifacts.
Why the other options are wrong
- A. Creating separate S3 buckets in each account adds operational complexity and bypasses the ability to encrypt artifacts once with cross-account access.
- C. AWS-managed keys cannot have custom policies; cross-account permissions cannot be granted using aws/s3 managed keys.
- D. Configuring roles without modifying the S3 bucket policy fails to grant the cross-account roles permission to access the artifacts bucket in the build account.
Question 29
An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). A DevOps engineer is using AWS CodeDeploy to release a new version. The deployment fails during the AllowTraffic lifecycle event, but a cause for the failure is not indicated in the deployment logs. What would cause this?
Show answer and explanation
Correct answer: C. The health checks specified for the ALB target group are misconfigured.
During the AllowTraffic lifecycle event, CodeDeploy waits for the ALB target group's health checks to pass before considering the deployment successful. If health checks are misconfigured, targets will never reach a healthy state, causing the AllowTraffic event to fail without specific error messages in the logs. This is the most likely cause of a silent failure during this phase.
Why the other options are wrong
- A. Invalid scripts in appspec.yml typically fail during their respective lifecycle hooks with explicit error logs, not silently during AllowTraffic.
- B. Permission issues would generate IAM-related errors in deployment logs, not silent failures.
- D. A missing CodeDeploy agent would prevent the entire deployment from starting, not fail specifically at the AllowTraffic stage.
Question 30
A video-sharing company stores its videos in Amazon S3. The company has observed a sudden increase in video access requests, but the company does not know which videos are most popular. The company needs to identify the general access pattern for the video files. This pattern includes the number of users who access a certain file on a given day, as well as the number of pull requests for certain files. How can the company meet these requirements with the LEAST amount of effort?
Show answer and explanation
Correct answer: B. Activate S3 server access logging. Use Amazon Athena to create an external table with the log files. Use Athena to create a SQL query to analyze the access patterns.
S3 server access logging combined with Amazon Athena provides the least effort solution. Enable S3 access logging to capture all object-level requests with minimal configuration. Athena allows querying the log files directly using SQL without requiring database setup, data loading, or infrastructure management. Athena creates an external table over the S3 logs and can immediately analyze access patterns including user counts per day and request frequencies per file.
Why the other options are wrong
- A. While S3 logging combined with Aurora works, it requires additional effort: importing logs into a database, managing Aurora infrastructure, and handling data pipeline operations.
- C. Lambda invocation for every S3 access incurs significant costs and operational overhead; writing to Aurora adds infrastructure management burden compared to serverless Athena queries.
- D. S3 access events do not natively generate CloudWatch Logs entries; this approach requires additional configuration and involves more complex infrastructure (Kinesis Data Analytics) than necessary for simple access pattern analysis.
Question 31
A company runs applications in AWS accounts that are in an organization in AWS Organizations. The applications use Amazon EC2 instances and Amazon S3. The company wants to detect potentially compromised EC2 instances, suspicious network activity, and unusual API activity in its existing AWS accounts and in any AWS accounts that the company creates in the future. When the company detects one of these events, the company wants to use an existing Amazon Simple Notification Service (Amazon SNS) topic to send a notification to its operational support team for investigation and remediation. Which solution will meet these requirements in accordance with AWS best practices?
Show answer and explanation
Correct answer: A. In the organization’s management account, configure an AWS account as the Amazon GuardDuty administrator account. In the GuardDuty administrator account, add the company’s existing AWS accounts to GuardDuty as members. In the GuardDuty administrator account, create an Amazon EventBridge rule with an event pattern to match GuardDuty events and to forward matching events to the SNS topic.
GuardDuty is the AWS service purpose-built for detecting compromised instances, suspicious network activity, and unusual API calls. Configuring it as an administrator account in the organization allows centralized management of existing and future member accounts. EventBridge integration with GuardDuty findings to SNS provides automated notifications to the security team. This approach aligns with AWS best practices for threat detection at organizational scale.
Why the other options are wrong
- B. GuardDuty uses administrator delegation rather than invitation-based models in Organizations; CloudFormation StackSets adds unnecessary complexity.
- C. CloudTrail and VPC Flow Logs provide audit data but do not actively detect suspicious activity; Security Hub requires manual setup in each account.
- D. CloudTrail is for API auditing, not threat detection; there is no such role as 'CloudTrail administrator account' in this context.
Question 32
A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. New EC2 instances are launched and terminated each hour in the account. The account also includes existing EC2 instances that have been running for longer than a week. The company's security policy requires all running EC2 instances to use an EC2 instance profile. If an EC2 instance does not have an instance profile attached, the EC2 instance must use a default instance profile that has no IAM permissions assigned. A DevOps engineer reviews the account and discovers EC2 instances that are running without an instance profile. During the review, the DevOps engineer also observes that new EC2 instances are being launched without an instance profile. Which solution will ensure that an instance profile is attached to all existing and future EC2 instances in the Region?
Show answer and explanation
Correct answer: B. Configure the ec2-instance-profile-attached AWS Config managed rule with a trigger type of configuration changes. Configure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.
The ec2-instance-profile-attached AWS Config managed rule with configuration change triggers detects both existing non-compliant instances and new instances launched without profiles. Automatic remediation invokes a Systems Manager Automation runbook to attach the default instance profile, ensuring all instances, existing and future, remain compliant without manual intervention. EventBridge rules only react to RunInstances API calls, missing existing instances and providing less reliable automation than Config's compliance-driven approach. The iam-role-managed-policy-check rule evaluates policies, not instance profiles, making it unsuitable for this requirement.
Why the other options are wrong
- A. EventBridge RunInstances triggers only catch newly launched instances, not existing ones already running without profiles.
- C. EventBridge StartInstances triggers fire when existing instances start, not when new instances are created, and miss instances already running.
- D. The iam-role-managed-policy-check rule validates IAM policies, not EC2 instance profile attachment.
Question 33
A company has a single developer writing code for an automated deployment pipeline. The developer is storing source code in an Amazon S3 bucket for each project. The company wants to add more developers to the team but is concerned about code conflicts and lost work. The company also wants to build a test environment to deploy newer versions of code for testing and allow developers to automatically deploy to both environments when code is changed in the repository. What is the MOST efficient way to meet these requirements?
Show answer and explanation
Correct answer: A. Create an AWS CodeCommit repository for each project, use the main branch for production code, and create a testing branch for code deployed to testing. Use feature branches to develop new features and pull requests to merge code to testing and main branches.
CodeCommit provides centralized version control that prevents code conflicts through branch management and pull requests, enabling multiple developers to work safely. Using main branch for production, a testing branch for test environment code, and feature branches for development with pull request reviews provides the collaborative workflow needed while enabling automated deployments to both environments through separate pipelines triggered by branch changes.
Why the other options are wrong
- B. S3 buckets are object storage, not version control systems; managing code conflicts and branching strategies manually with Lambda promotion functions is error-prone and lacks proper code review mechanisms.
- C. Using a single main branch for both production and test code creates deployment confusion and doesn't provide branch isolation for feature development and testing workflows.
- D. S3 versioning and branching concepts don't translate to proper source control; developers cannot use pull requests for code review, and managing conflicts between test and production in S3 is inefficient and error-prone.
Question 34
A DevOps engineer manages a large commercial website that runs on Amazon EC2. The website uses Amazon Kinesis Data Streams to collect and process web logs. The DevOps engineer manages the Kinesis consumer application, which also runs on Amazon EC2. Sudden increases of data cause the Kinesis consumer application to fall behind, and the Kinesis data streams drop records before the records can be processed. The DevOps engineer must implement a solution to improve stream handling. Which solution meets these requirements with the MOST operational efficiency?
Show answer and explanation
Correct answer: B. Horizontally scale the Kinesis consumer application by adding more EC2 instances based on the Amazon CloudWatch GetRecords.IteratorAgeMilliseconds metric. Increase the retention period of the Kinesis data streams.
Horizontally scaling the Kinesis consumer application by adding EC2 instances based on the GetRecords.IteratorAgeMilliseconds metric directly addresses the bottleneck, the consumer application falling behind. Increasing retention period ensures records are not dropped while processing catches up. This approach maintains operational control and directly targets the root cause without architectural overhaul.
Why the other options are wrong
- A. Storing in S3 and using EMR changes the architecture significantly and does not address the real-time processing requirement of dropping records.
- C. Lambda auto-scales but has cold start latency and less control over concurrent processing compared to managed EC2 fleet scaling.
- D. Adding shards increases ingestion throughput but does not help if the consumer application remains the bottleneck; the issue is processing speed, not shard capacity.
Question 35
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company’s IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted. A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256). Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule. Configure the rule to use the AWSEnableS3BucketEncryption AWS Systems Manager Automation runbook as the remediation action. Manually run the re-evaluation process to ensure that existing S3 buckets are compliant.
AWS Config managed rules provide continuous compliance monitoring for existing and new resources. The s3-bucket-server-side-encryption-enabled rule automatically detects non-compliant buckets, and the AWSEnableS3BucketEncryption Systems Manager Automation runbook provides automated remediation. This combination ensures both existing buckets are encrypted retroactively and new buckets are compliant immediately upon creation through automatic remediation, meeting all stated requirements with minimal manual intervention.
Why the other options are wrong
- A. Periodic Lambda scanning only addresses existing buckets after creation and requires continuous manual scheduling; it does not prevent creation of unencrypted new buckets automatically.
- C. EventBridge-triggered Lambda only handles new buckets created after the rule is deployed; it does nothing for existing unencrypted buckets.
- D. IAM policy conditions can prevent creation but cannot remediate existing non-compliant buckets and does not set default encryption on new buckets.
Question 36
A DevOps engineer is creating an AWS CloudFormation template to deploy a web service. The web service will run on Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The DevOps engineer must ensure that the service can accept requests from clients that have IPv6 addresses. What should the DevOps engineer do with the CloudFormation template so that IPv6 clients can access the web service?
Show answer and explanation
Correct answer: D. Add an IPv6 CIDR block to the VPC and subnets for the ALB. Create a listener on port 443. and specify the dualstack IP address type on the ALB. Create a target group, and add the EC2 instances as targets. Associate the target group with the ALB.
To enable IPv6 clients to access a web service behind an ALB, the VPC and subnets must have IPv6 CIDR blocks, and the ALB must be configured with dualstack IP address type to accept both IPv4 and IPv6 traffic. A listener on port 443 with dualstack support combined with a target group containing EC2 instances completes the configuration. The EC2 instances themselves do not need IPv6 addresses since the ALB handles protocol translation between clients and targets.
Why the other options are wrong
- A. EC2 instances in a private subnet behind an ALB do not require individual IPv6 addresses; the ALB handles IPv6 client connections and routes to IPv4 targets.
- B. IPv6 Elastic IP addresses are not available in AWS; Elastic IPs are IPv4-only. The ALB dualstack configuration suffices without instance-level IPv6 assignment.
- C. NLB is not necessary for IPv6 support; ALB with dualstack IP address type fully supports IPv6 clients and is simpler for web service use cases.
Question 37
A company uses AWS Organizations and AWS Control Tower to manage all the company's AWS accounts. The company uses the Enterprise Support plan. A DevOps engineer is using Account Factory for Terraform (AFT) to provision new accounts. When new accounts are provisioned, the DevOps engineer notices that the support plan for the new accounts is set to the Basic Support plan. The DevOps engineer needs to implement a solution to provision the new accounts with the Enterprise Support plan. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration. Redeploy AFT and apply the changes.
Account Factory for Terraform includes a feature flag aft_feature_enterprise_support that, when set to True in the AFT deployment input configuration, automatically provisions new accounts with the Enterprise Support plan. This is the native AFT mechanism designed specifically for this use case and requires redeployment to apply the changes.
Why the other options are wrong
- A. AWS Config conformance packs cannot change the support plan of accounts; they only detect and report compliance violations, not provision support plans.
- B. Creating Lambda functions to open support tickets is inefficient and does not automate the provisioning process; support plan assignment occurs at account creation time.
- C. The control_tower_parameters input does not include an AWSEnterpriseSupport parameter; this is not a valid AFT configuration option.
Question 38
A company runs an application with an Amazon EC2 and on-premises configuration. A DevOps engineer needs to standardize patching across both environments. Company policy dictates that patching only happens during non-business hours. Which combination of actions will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: A, B, F. Add the physical machines into AWS Systems Manager using Systems Manager Hybrid Activations; Attach an IAM role to the EC2 instances, allowing them to be managed by AWS Systems Manager; Use AWS Systems Manager Maintenance Windows to schedule a patch window.
Hybrid Activations (A) register on-premises machines with Systems Manager. IAM roles (B) on EC2 instances grant Systems Manager permissions without needing access keys. Maintenance Windows (F) provide scheduled patching during non-business hours. Together these three establish the infrastructure and scheduling for standardized patching across both environments without exposing credentials or using hourly polling.
Why the other options are wrong
- C. IAM access keys should never be used for service authentication; service roles are the proper approach.
- D. Running automation every hour ignores the non-business hours requirement and causes unnecessary overhead.
- E. EventBridge scheduled events are lower-level scheduling; Maintenance Windows are the purpose-built Systems Manager feature for patch management.
Question 39
A company that uses electronic health records is running a fleet of Amazon EC2 instances with an Amazon Linux operating system. As part of patient privacy requirements, the company must ensure continuous compliance for patches for operating system and applications running on the EC2 instances. How can the deployments of the operating system and application patches be automated using a default and custom repository?
Show answer and explanation
Correct answer: A. Use AWS Systems Manager to create a new patch baseline including the custom repository. Run the AWS-RunPatchBaseline document using the run command to verify and install patches.
AWS Systems Manager allows creation of custom patch baselines that include both default and custom repositories, enabling centralized patch management. The AWS-RunPatchBaseline document executed via Systems Manager Run Command applies patches from the configured baseline across the fleet. This approach is the standard AWS method for automated patch deployment with custom repository support.
Why the other options are wrong
- B. AWS Direct Connect is a network connectivity service unrelated to patch management; CloudWatch scheduled events cannot orchestrate patch deployments, and CloudWatch dashboards are for visualization, not deployment.
- C. Manual yum configuration is not an automated solution and does not provide compliance tracking or centralized management of patches across a fleet.
- D. The AWSAmazonLinuxDefaultPatchBaseline document does not support custom repositories; AWS-RunPatchBaseline with a custom baseline is the correct approach.
Question 40
A company's developers use Amazon EC2 instances as remote workstations. The company is concerned that users can create or modify EC2 security groups to allow unrestricted inbound access. A DevOps engineer needs to develop a solution to detect when users create unrestricted security group rules. The solution must detect changes to security group rules in near real time, remove unrestricted rules, and send email notifications to the security team. The DevOps engineer has created an AWS Lambda function that checks for security group ID from input, removes rules that grant unrestricted access, and sends notifications through Amazon Simple Notification Service (Amazon SNS). What should the DevOps engineer do next to meet the requirements?
Show answer and explanation
Correct answer: C. Create an Amazon EventBridge event rule that has the default event bus as the source. Define the rule’s event pattern to match EC2 security group creation and modification events. Configure the rule to invoke the Lambda function.
EventBridge event rules with event patterns matching EC2 security group creation and modification events provide real-time detection of security group changes. This approach automatically triggers the Lambda function when matching events occur, enabling near real-time detection, rule removal, and SNS notifications. The default event bus captures AWS API events from EC2 service, making this the ideal solution for continuous monitoring without manual intervention.
Why the other options are wrong
- A. SNS cannot invoke Lambda based on CloudTrail subscription filters; CloudTrail is a logging service, not an event source for triggering actions.
- B. Scheduled rules run at fixed intervals (hourly) rather than detecting changes in near real-time, missing events that occur between scheduled executions.
- D. Custom event buses do not automatically subscribe to AWS service events; they require manual event publishing and do not solve the detection problem.
Question 41
A company runs applications in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster uses an Application Load Balancer to route traffic to the applications that run in the cluster. A new application that was migrated to the EKS cluster is performing poorly. All the other applications in the EKS cluster maintain appropriate operation. The new application scales out horizontally to the preconfigured maximum number of pods immediately upon deployment, before any user traffic routes to the web application. Which solution will resolve the scaling behavior of the web application in the EKS cluster?
Show answer and explanation
Correct answer: B. Implement the Vertical Pod Autoscaler in the EKS cluster.
The application scales to maximum pods immediately upon deployment before receiving traffic, indicating it's starting with insufficient resources and triggering scale-out based on initial resource requests. The Vertical Pod Autoscaler (VPA) right-sizes pod resource requests and limits based on actual usage, allowing pods to start with appropriate resource allocations. This prevents unnecessary horizontal scaling due to misconfigured resource requests and ensures pods run efficiently with correct CPU and memory specifications.
Why the other options are wrong
- A. Horizontal Pod Autoscaler scales based on metrics like CPU and memory; it doesn't address the root cause of incorrect initial resource requests.
- C. Cluster Autoscaler scales the number of nodes, not pods, and won't solve the issue of a single application over-scaling its pods.
- D. AWS Load Balancer Controller manages ingress and service load balancing, not pod resource allocation or autoscaling behavior.
Question 42
A company has an application that runs on a fleet of Amazon EC2 instances. The application requires frequent restarts. The application logs contain error messages when a restart is required. The application logs are published to a log group in Amazon CloudWatch Logs. An Amazon CloudWatch alarm notifies an application engineer through an Amazon Simple Notification Service (Amazon SNS) topic when the logs contain a large number of restart-related error messages. The application engineer manually restarts the application on the instances after the application engineer receives a notification from the SNS topic. A DevOps engineer needs to implement a solution to automate the application restart on the instances without restarting the instances. Which solution will meet these requirements in the MOST operationally efficient manner?
Show answer and explanation
Correct answer: D. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances. Configure an Amazon EventBridge rule that reacts when the CloudWatch alarm enters ALARM state. Specify the runbook as a target of the rule.
Option D directly connects the CloudWatch alarm to an EventBridge rule that triggers a Systems Manager Automation runbook to restart the application. This is the most operationally efficient solution because it creates a direct alarm-to-automation path without intermediary services. Options A and C add unnecessary layers (SNS as invoke target, or Lambda wrappers) that complicate the architecture. Option B requires Lambda to handle Systems Manager APIs, which is less direct than EventBridge integration.
Why the other options are wrong
- A. SNS topics cannot directly invoke Systems Manager Automation runbooks; this would require additional infrastructure.
- B. Lambda would require custom code to invoke Systems Manager and connect to EC2 instances, adding unnecessary complexity.
- C. Adding Lambda as a wrapper between EventBridge and Systems Manager adds an unnecessary layer of indirection.
Question 43
A company hired a penetration tester to simulate an internal security breach. The tester performed port scans on the company's Amazon EC2 instances. The company's security measures did not detect the port scans. The company needs a solution that automatically provides notification when port scans are performed on EC2 instances. The company creates and subscribes to an Amazon Simple Notification Service (Amazon SNS) topic. What should the company do next to meet the requirement?
Show answer and explanation
Correct answer: A. Ensure that Amazon GuardDuty is enabled. Create an Amazon CloudWatch alarm for detected EC2 and port scan findings. Connect the alarm to the SNS topic.
GuardDuty is AWS's native threat detection service that specifically identifies port scans and network reconnaissance activities. It automatically analyzes network traffic and behavior patterns to detect port scan findings. Creating a CloudWatch alarm for GuardDuty EC2 and port scan findings and connecting it to the SNS topic enables automatic notifications when port scans are detected, meeting the requirement for automated detection and alerting.
Why the other options are wrong
- B. Amazon Inspector focuses on vulnerabilities in applications and infrastructure, not on detecting active port scans or network reconnaissance.
- C. Inspector detects CVEs and vulnerabilities, not port scan activity; open ports are a configuration state, not a CVE finding.
- D. CloudTrail logs API calls, not network-level port scan activity; analyzing traffic volume in CloudTrail is ineffective for detecting port scans against EC2 instances.
Question 44
A company uses AWS Organizations to manage its AWS accounts. The organization root has an OU that is named Environments. The Environments OU has two child OUs that are named Development and Production, respectively. The Environments OU and the child OUs have the default FullAWSAccess policy in place. A DevOps engineer plans to remove the FullAWSAccess policy from the Development OU and replace the policy with a policy that allows all actions on Amazon EC2 resources. What will be the outcome of this policy replacement?
Show answer and explanation
Correct answer: B. All users in the Development OU will be allowed all API actions on EC2 resources. All other API actions will be denied.
Service Control Policies (SCPs) act as permission filters that define the maximum permissions available in an account. When the FullAWSAccess policy is replaced with a policy allowing all actions only on EC2 resources, the SCP restricts the available permissions to EC2 only. Users in the Development OU will be allowed all EC2 API actions, but all other API actions will be explicitly denied by the SCP filter. The organizational hierarchy ensures this policy applies to all accounts in the Development OU.
Why the other options are wrong
- A. Replacing FullAWSAccess with an EC2-only policy removes access to non-EC2 services; users cannot access all resources.
- C. The EC2 policy still grants EC2 permissions; users are not denied all actions.
- D. The policy explicitly allows all EC2 actions; other actions are denied but EC2 actions are permitted, not denied.
Question 45
A DevOps engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that: Launches a second fleet of instances with the same capacity as the original fleet. Maintains the original fleet unchanged while the second fleet is launched. Transitions traffic to the second fleet when the second fleet is fully deployed. Terminates the original fleet automatically 1 hour after transition. Which solution will satisfy these requirements?
Show answer and explanation
Correct answer: C. Use AWS CodeDeploy with a deployment group configured with a blue/green deployment configuration Select the option Terminate the original instances in the deployment group with a waiting period of 1 hour.
AWS CodeDeploy with a blue/green deployment configuration is designed specifically for this pattern. It launches a second fleet of instances (green) with the same capacity as the original fleet (blue), keeps both fleets running during deployment, transitions traffic to the green fleet once it's healthy, and then terminates the original blue fleet after a configurable waiting period. This exactly matches the stated requirements including the 1-hour delay before termination.
Why the other options are wrong
- A. CloudFormation retention policies do not control instance termination timing; Route 53 updates alone do not implement blue/green deployment patterns.
- B. While Elastic Beanstalk supports blue/green deployments, application version lifecycle policies do not control the termination timing of the original environment after traffic transition; this approach does not provide the same level of control.
- D. Elastic Beanstalk Immutable deployments launch new instances but do not provide the explicit blue/green fleet management or the configurable 1-hour termination delay for the original fleet that CodeDeploy offers.
Question 46
A company is testing a web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The company uses a blue/green deployment process with immutable instances when deploying new software. During testing, users are being automatically logged out of the application at random times. Testers also report that, when a new version of the application is deployed, all users are logged out. The development team needs a solution to ensure users remain logged in across scaling events and application deployments. What is the MOST operationally efficient way to ensure users remain logged in?
Show answer and explanation
Correct answer: D. Modify the application to store user session information in an Amazon ElastiCache cluster.
Storing session data in Amazon ElastiCache (Redis/Memcached) ensures sessions persist across Auto Scaling events and blue/green deployments. When instances are replaced, new instances can immediately retrieve session data from the cache, keeping users logged in. This is the most operationally efficient solution because it requires only application code changes and avoids load balancer session affinity issues that fail during scaling events.
Why the other options are wrong
- A. Load balancer session features do not exist as described; session affinity would fail during scaling and deployments when instances are replaced.
- B. Session sharing on a load balancer is not a standard feature and would not solve the problem of instances being replaced during scaling events.
- C. S3 is not suitable for session storage due to latency and consistency issues; ElastiCache provides the low-latency, high-performance access required for session data.
Question 47
A development team uses AWS CodeCommit for version control for applications. The development team uses AWS CodePipeline, AWS CodeBuild. and AWS CodeDeploy for CI/CD infrastructure. In CodeCommit, the development team recently merged pull requests that did not pass longrunning tests in the code base. The development team needed to perform rollbacks to branches in the codebase, resulting in lost time and wasted effort. A DevOps engineer must automate testing of pull requests in CodeCommit to ensure that reviewers more easily see the results of automated tests as part of the pull request review. What should the DevOps engineer do to meet this requirement?
Show answer and explanation
Correct answer: C. Create an Amazon EventBridge rule that reacts to pullRequestCreated and pullRequestSourceBranchUpdated events. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild badge as a comment on the pull request so that developers will see the badge in their code review.
Option C uses EventBridge to monitor both pullRequestCreated and pullRequestSourceBranchUpdated events, ensuring tests run when a pull request is initially created and whenever the source branch is updated with new commits. The Lambda function invokes CodeBuild and posts the badge as a comment, allowing reviewers to see test status directly in the pull request interface without needing to navigate elsewhere.
Why the other options are wrong
- A. Listens only to pullRequestStatusChanged, which fires after the pull request status changes rather than when it is created, missing the initial test run opportunity.
- B. Only reacts to pullRequestCreated and misses subsequent updates when developers push new commits to the pull request source branch.
- D. Listens to pullRequestStatusChanged rather than pullRequestCreated or pullRequestSourceBranchUpdated, and lacks the efficiency of badge display for quick visual feedback.
Question 48
A company uses a series of individual Amazon CloudFormation templates to deploy its multi-Region applications. These templates must be deployed in a specific order. The company is making more changes to the templates than previously expected and wants to deploy new templates more efficiently. Additionally, the data engineering team must be notified of all changes to the templates. What should the company do to accomplish these goals?
Show answer and explanation
Correct answer: D. Leverage CloudFormation nested stacks and stack sets for deployments. Use Amazon SNS to notify the data engineering team.
CloudFormation StackSets enable deploying templates across multiple accounts and regions in a specified order, directly addressing the multi-Region requirement. Nested stacks handle template dependencies and ordering. Amazon SNS notifications can be triggered through CloudFormation events or custom resources to alert the data engineering team of template changes. This combination provides efficient, scalable, and centralized deployment management with built-in notification capabilities.
Why the other options are wrong
- A. Lambda functions manually orchestrating deployments lack the native multi-Region and account management capabilities of StackSets; stack policies control resource modifications, not change notifications.
- B. S3 events cannot directly trigger CloudFormation stack operations; this approach lacks the ordering and multi-Region orchestration that StackSets provide.
- C. Drift detection identifies when resources deviate from the template, but it does not orchestrate deployments or inherently notify teams of template changes.
Question 49
A company’s DevOps engineer is working in a multi-account environment. The company uses AWS Transit Gateway to route all outbound traffic through a network operations account. In the network operations account, all account traffic passes through a firewall appliance for inspection before the traffic goes to an internet gateway. The firewall appliance sends logs to Amazon CloudWatch Logs and includes event severities of CRITICAL, HIGH, MEDIUM, LOW, and INFO. The security team wants to receive an alert if any CRITICAL events occur. What should the DevOps engineer do to meet these requirements?
Show answer and explanation
Correct answer: B. Create an Amazon CloudWatch metric filter by using a search for CRITICAL events. Publish a custom metric for the finding. Use a CloudWatch alarm based on the custom metric to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team’s email address to the topic.
A CloudWatch metric filter searches the firewall logs for CRITICAL severity events and creates a custom metric. A CloudWatch alarm based on this metric triggers SNS notifications to the security team's email. This is the standard, straightforward approach for alerting on log pattern matches without introducing unnecessary services.
Why the other options are wrong
- A. CloudWatch Synthetics canaries monitor endpoint availability, not log content; they are not appropriate for parsing log severities.
- C. GuardDuty monitors AWS API and network activity, not custom application firewall logs sent to CloudWatch Logs.
- D. Firewall Manager manages WAF and Shield policies across accounts, not custom firewall appliance logs.
Question 50
A DevOps engineer needs to apply a core set of security controls to an existing set of AWS accounts. The accounts are in an organization in AWS Organizations. Individual teams will administer individual accounts by using the AdministratorAccess AWS managed policy. For all accounts. AWS CloudTrail and AWS Config must be turned on in all available AWS Regions. Individual account administrators must not be able to edit or delete any of the baseline resources. However, individual account administrators must be able to edit or delete their own CloudTrail trails and AWS Config rules. Which solution will meet these requirements in the MOST operationally efficient way?
Show answer and explanation
Correct answer: D. Create an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization's management account by using Cloud Formation StackSets Create an SCP that prevents updates or deletions to CloudTrail resources or AWS Config resources unless the principal is an administrator of the organization's management account.
Option D meets all requirements by using CloudFormation StackSets to deploy baseline CloudTrail and Config resources consistently across accounts, while an SCP prevents modification or deletion of these baseline resources by non-organization administrators. This allows individual account administrators with AdministratorAccess to manage their own CloudTrail trails and Config rules (which they create separately) while protecting the baseline resources. Options A and C lack the flexibility for administrators to edit their own resources, and option B (Control Tower) is operationally heavier than necessary for this specific requirement.
Why the other options are wrong
- A. Stack policies only prevent updates/deletes on CloudFormation-managed resources, not on resources created outside the stack, so account admins cannot freely manage their own CloudTrail trails and Config rules.
- B. Control Tower is more operationally complex than needed and doesn't provide the granular control to allow modification of account-specific resources while protecting baseline resources.
- C. This approach uses CloudFormation only for Config recorders and relies on organization trails, but doesn't provide sufficient protection for baseline resources while allowing account-level customization.
Question 51
A DevOps engineer is building a multistage pipeline with AWS CodePipeline to build, verify, stage, test, and deploy an application. A manual approval stage is required between the test stage and the deploy stage. The development team uses a custom chat tool with webhook support that requires near-real-time notifications. How should the DevOps engineer configure status updates for pipeline activity and approval requests to post to the chat tool?
Show answer and explanation
Correct answer: C. Create an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Change. Publish the events to an Amazon Simple Notification Service (Amazon SNS) topic. Create an AWS Lambda function that sends event details to the chat webhook URL. Subscribe the function to the SNS topic.
EventBridge is the modern event routing service for CodePipeline state changes, replacing CloudWatch Events as the primary mechanism. An EventBridge rule filters CodePipeline Pipeline Execution State Change events, publishes them to an SNS topic, and a Lambda function subscribed to that topic sends the event details to the chat webhook URL. This architecture provides near-real-time notifications with proper event routing and transformation.
Why the other options are wrong
- A. CloudWatch Logs subscription is designed for log analysis, not event routing; this approach is inefficient for pipeline events.
- B. CloudTrail provides audit logs but isn't optimized for real-time event processing; EventBridge is the proper service for pipeline state changes.
- D. Modifying pipeline code to send webhooks directly couples business logic with notification logic and requires code changes for each pipeline.
Question 52
An AWS CodePipeline pipeline has implemented a code release process. The pipeline is integrated with AWS CodeDeploy to deploy versions of an application to multiple Amazon EC2 instances for each CodePipeline stage. During a recent deployment, the pipeline failed due to a CodeDeploy issue. The DevOps team wants to improve monitoring and notifications during deployment to decrease resolution times. What should the DevOps engineer do to create notifications when issues are discovered?
Show answer and explanation
Correct answer: B. Implement Amazon EventBridge for CodePipeline and CodeDeploy, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.
EventBridge is the event-driven service that natively integrates with CodePipeline and CodeDeploy to capture deployment state changes and failures. Configure EventBridge rules to match deployment failure events, target a Lambda function to evaluate the issue details, and publish notifications to SNS for stakeholder alerting. This provides real-time event-driven notifications with structured event data. CloudWatch Logs are for application logs not pipeline events, CloudTrail records API calls not pipeline state changes, and Inspector evaluates EC2 security not deployment issues.
Why the other options are wrong
- A. Config rules evaluate resource compliance, not pipeline state changes; CloudWatch Logs are for application logging.
- C. CloudTrail captures API calls for audit purposes, not pipeline execution events or deployment status.
- D. Inspector is a vulnerability assessment tool, not a deployment issue evaluator.
Question 53
A company has an application that includes AWS Lambda functions. The Lambda functions run Python code that is stored in an AWS CodeCommit repository. The company has recently experienced failures in the production environment because of an error in the Python code. An engineer has written unit tests for the Lambda functions to help avoid releasing any future defects into the production environment. The company's DevOps team needs to implement a solution to integrate the unit tests into an existing AWS CodePipeline pipeline. The solution must produce reports about the unit tests for the company to view. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create a new AWS CodeBuild project. In the CodePipeline pipeline, configure a test stage that uses the new CodeBuild project. Create a CodeBuild report group. Create a buildspec.yml file in the CodeCommit repository. In the buildspec.yml file, define the actions to run the unit tests with an output of JUNITXML in the build phase section. Configure the test reports to be uploaded to the new CodeBuild report group.
CodeBuild with report groups is the standard AWS solution for running tests in a pipeline and generating viewable test reports. Creating a CodeBuild project in the test stage, defining unit test execution in buildspec.yml with JUNITXML output format, and configuring CodeBuild report groups allows the company to view detailed test reports within the AWS console and integrate test results directly into the pipeline workflow.
Why the other options are wrong
- A. CodeGuru Reviewer performs code quality analysis, not unit testing, and does not produce test reports in the required format.
- C. CodeArtifact is a package repository service, not a test reporting solution; appspec.yml is for CodeDeploy, not general test execution.
- D. Uploading reports to S3 as HTML does not integrate with CodePipeline's test reporting capabilities and does not provide the structured test result tracking that CodeBuild report groups offer.
Question 54
A DevOps engineer wants to find a solution to migrate an application from on premises to AWS. The application is running on Linux and needs to run on specific versions of Apache Tomcat, HAProxy, and Varnish Cache to function properly. The application's operating system-level parameters require tuning. The solution must include a way to automate the deployment of new application versions. The infrastructure should be scalable and faulty servers should be replaced automatically. Which solution should the DevOps engineer use?
Show answer and explanation
Correct answer: D. Upload the application code to an AWS CodeCommit repository with an appspec.yml file to configure and install the necessary software. Create an AWS CodeDeploy deployment group associated with an Amazon EC2 Auto Scaling group. Create an AWS CodePipeline pipeline that uses CodeCommit as a source and CodeDeploy as a deployment provider.
Option D uses CodeDeploy with an appspec.yml file to configure specific software requirements (Apache Tomcat, HAProxy, Varnish Cache) and tune OS-level parameters, integrates with EC2 Auto Scaling groups for automatic instance replacement, and automates deployments through CodePipeline. This provides the necessary control over custom software configurations while maintaining scalability and fault tolerance.
Why the other options are wrong
- A. Fargate is serverless and does not allow OS-level parameter tuning required for the application; it also lacks the flexibility needed for specific versions of multiple components.
- B. Elastic Beanstalk web server tier deploys to instances but doesn't provide adequate control for OS-level parameter tuning and has limited flexibility for complex software dependencies.
- C. Worker tier is inappropriate for a web application requiring continuous traffic serving; this configuration type is designed for background job processing, not production web serving.
Question 55
A company is using AWS Organizations to centrally manage its AWS accounts. The company has turned on AWS Config in each member account by using AWS CloudFormation StackSets. The company has configured trusted access in Organizations for AWS Config and has configured a member account as a delegated administrator account for AWS Config. A DevOps engineer needs to implement a new security policy. The policy must require all current and future AWS member accounts to use a common baseline of AWS Config rules that contain remediation actions that are managed from a central account. Non-administrator users who can access member accounts must not be able to modify this common baseline of AWS Config rules that are deployed into each member account. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Create an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the delegated administrator account by using AWS Config.
A conformance pack deployed from a delegated administrator account is the correct AWS Config feature for managing baseline rules across member accounts in an organization. Deploying from the delegated administrator account provides centralized control with proper isolation, preventing non-administrator users from modifying the baseline rules. Conformance packs are specifically designed for this organizational compliance use case.
Why the other options are wrong
- A. CloudFormation StackSets from the management account is overly broad and does not leverage AWS Config's purpose-built conformance pack feature.
- B. CloudFormation StackSets is not the appropriate mechanism for AWS Config rule deployment; conformance packs are the standard solution.
- C. Deploying through AWS Config itself requires manual processes and does not provide the remediation and centralized management capabilities that conformance packs offer.
Question 56
A company is running an application on Amazon EC2 instances in an Auto Scaling group. Recently, an issue occurred that prevented EC2 instances from launching successfully, and it took several hours for the support team to discover the issue. The support team wants to be notified by email whenever an EC2 instance does not start successfully. Which action will accomplish this?
Show answer and explanation
Correct answer: B. Configure the Auto Scaling group to send a notification to an Amazon SNS topic whenever a failed instance launch occurs.
Auto Scaling groups have built-in lifecycle notifications that can send messages to an SNS topic when instance launches fail. This is the most direct and purpose-built solution for notifying the team of failed instance launches. Configuring the Auto Scaling group to publish to an SNS topic enables automatic email notifications without additional components.
Why the other options are wrong
- A. Health checks monitor running instance health, not launch failures.
- C. CloudWatch alarms on API calls would require custom logic and would not directly capture all launch failure scenarios.
- D. Status check alarms are for running instances; they do not specifically detect launch failures before instances are fully running.
Question 57
A company has microservices running in AWS Lambda that read data from Amazon DynamoDB. The Lambda code is manually deployed by developers after successful testing. The company now needs the tests and deployments be automated and run in the cloud. Additionally, traffic to the new versions of each microservice should be incrementally shifted over time after deployment. What solution meets all the requirements, ensuring the MOST developer velocity?
Show answer and explanation
Correct answer: C. Create an AWS CodePipeline configuration and set up the source code step to trigger when code is pushed. Set up the build step to use AWS CodeBuild to run the tests. Set up an AWS CodeDeploy configuration to deploy, then select the CodeDeployDefault.LambdaLinear10PercentEvery3Minutes option.
Option C uses CodePipeline with CodeBuild for automated testing and CodeDeploy with the CodeDeployDefault.LambdaLinear10PercentEvery3Minutes configuration, which is the native AWS feature designed specifically for incremental traffic shifting on Lambda deployments. This approach maximizes developer velocity by automating the entire pipeline from source to deployment with built-in canary capabilities without requiring custom configurations.
Why the other options are wrong
- A. Post-commit hooks are manual workarounds; CodeDeploy's Canary configuration for Lambda requires specific predefined options, not custom percentages.
- B. This approach unnecessarily adds CloudFormation complexity and doesn't leverage CodeDeploy's native Lambda traffic shifting strategies.
- D. Using Lambda functions to manually manage deployment intervals is inefficient, error-prone, and provides less visibility and control than using purpose-built deployment services.
Question 58
A DevOps engineer is architecting a continuous development strategy for a company’s software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets. Which architecture will meet these requirements with the LEAST amount of configuration?
Show answer and explanation
Correct answer: C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair.
A single CodePipeline with one CodeDeploy application but multiple deployment groups achieves parallel deployments with minimal configuration. CodeDeploy deployment groups are the construct designed for targeting different sets of EC2 instances, so creating one deployment group per ALB-Auto Scaling group pair allows the pipeline to deploy in parallel to all groups simultaneously. This approach reuses a single application definition while targeting multiple environments efficiently.
Why the other options are wrong
- A. Multiple CodeDeploy applications add unnecessary configuration overhead; one application with multiple deployment groups is the intended design pattern.
- B. A single deployment group cannot target multiple ALBs and Auto Scaling groups independently; each group needs its own deployment group for proper targeting.
- D. Multiple pipelines create significant unnecessary configuration and operational complexity; a single pipeline with multiple deployment groups is the standard approach.
Question 59
A company plans to use Amazon CloudWatch to monitor its Amazon EC2 instances. The company needs to stop EC2 instances when the average of the NetworkPacketsIn metric is less than 5 for at least 3 hours in a 12-hour time window. The company must evaluate the metric every hour. The EC2 instances must continue to run if there is missing data for the NetworkPacketsIn metric during the evaluation period. A DevOps engineer creates a CloudWatch alarm for the NetworkPacketsIn metric. The DevOps engineer configures a threshold value of 5 and an evaluation period of 1 hour. Which set of additional actions should the DevOps engineer take to meet these requirements?
Show answer and explanation
Correct answer: B. Configure the Datapoints to Alarm value to be 3 out of 12. Configure the alarm to treat missing data as not breaching the threshold. Add an EC2 action to stop the instance when the alarm enters the ALARM state.
The requirement specifies that instances must continue running if there is missing data, which means missing data should not breach the threshold. The "Datapoints to Alarm" must be configured as 3 out of 12 because the metric is evaluated every hour over a 12-hour window (12 evaluation periods), and exactly 3 hours must have values less than 5. The EC2 action (not Systems Manager) directly stops instances from CloudWatch alarms without additional dependencies.
Why the other options are wrong
- A. Treating missing data as breaching contradicts the requirement that instances must continue if data is missing during the evaluation period.
- C. Configuring 9 out of 12 datapoints requires 9 hours below the threshold instead of the required 3 hours, and treating missing data as breaching violates the missing data requirement.
- D. Configuring 9 out of 12 requires the wrong number of breaching datapoints, and Systems Manager is less direct than EC2 actions for stopping instances.
Question 60
A company uses Amazon S3 to store proprietary information. The development team creates buckets for new projects on a daily basis. The security team wants to ensure that all existing and future buckets have encryption, logging, and versioning enabled. Additionally, no buckets should ever be publicly read or write accessible. What should a DevOps engineer do to meet these requirements?
Show answer and explanation
Correct answer: B. Enable AWS Config rules and configure automatic remediation using AWS Systems Manager documents.
AWS Config rules can automatically detect S3 bucket configuration drift and enforce compliance policies across all buckets (existing and new). AWS Systems Manager documents provide the remediation actions needed to automatically apply encryption, logging, versioning, and block public access settings. This combination continuously monitors and remediates S3 bucket configurations to meet security requirements without manual intervention.
Why the other options are wrong
- A. CloudTrail is for auditing and logging API calls, not for enforcing bucket configurations or remediating non-compliant buckets.
- C. Trusted Advisor provides recommendations but does not have automated remediation capabilities; EventBridge alone cannot enforce S3 bucket configurations.
- D. Systems Manager is a management service, but it requires Config rules to detect the compliance issues that need remediation.
Question 61
A company uses AWS Storage Gateway in file gateway mode in front of an Amazon S3 bucket that is used by multiple resources. In the morning when business begins, users do not see the objects processed by a third party the previous evening. When a DevOps engineer looks directly at the S3 bucket, the data is there, but it is missing in Storage Gateway. Which solution ensures that all the updated third-party files are available in the morning?
Show answer and explanation
Correct answer: A. Configure a nightly Amazon EventBridge event to invoke an AWS Lambda function to run the RefreshCache command for Storage Gateway.
File gateway maintains a local cache of S3 objects. When third parties write directly to S3 bypassing the gateway, the cache becomes stale. The RefreshCache command forces the gateway to sync with the S3 bucket contents. Scheduling this nightly via EventBridge and Lambda ensures users see updated files in the morning without manual intervention.
Why the other options are wrong
- B. Using AWS Transfer for SFTP changes the upload mechanism but doesn't solve the cache synchronization problem if third parties continue using direct S3 uploads.
- C. Volume gateway mode stores entire volumes locally and doesn't solve the caching issue with remote S3 writes; it's also not suitable for this use case.
- D. S3 replication doesn't work backward to update Storage Gateway cache; replication copies from source to target buckets, not to gateway instances.
Question 62
A company wants to use AWS development tools to replace its current bash deployment scripts. The company currently deploys a LAMP application to a group of Amazon EC2 instances behind an Application Load Balancer (ALB). During the deployments, the company unit tests the committed application, stops and starts services, unregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to maintain the same deployment functionality through the shift to using AWS services. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Use AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services. Unregister and re-register the instances in the AWS CodeDeploy deployment group with the ALB. Update the appspec.yml file to update file permissions without a custom script.
CodePipeline orchestrates the entire workflow by triggering CodeBuild for testing. CodeDeploy's appspec.yml file handles service restarts and file permission updates directly without custom scripts. The deployment group configuration manages instance registration/deregistration with the ALB through lifecycle event hooks built into CodeDeploy. This solution maintains all the original functionality while replacing bash scripts with native AWS deployment services.
Why the other options are wrong
- A. This relies on bash scripts for ALB registration, which doesn't fully replace the original bash deployment paradigm.
- B. CodeDeploy deployment groups don't natively handle testing; CodePipeline doesn't move code to CodeDeploy directly.
- C. Using CodeBuild for ALB registration/deregistration is inefficient; CodeDeploy doesn't run tests by default without CodeBuild integration.
Question 63
A DevOps engineer is building a continuous deployment pipeline for a serverless application that uses AWS Lambda functions. The company wants to reduce the customer impact of an unsuccessful deployment. The company also wants to monitor for issues. Which deploy stage configuration will meet these requirements?
Show answer and explanation
Correct answer: A. Use an AWS Serverless Application Model (AWS SAM) template to define the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the Canary10Percent15Minutes Deployment Preference Type. Use Amazon CloudWatch alarms to monitor the health of the functions.
AWS SAM with CodeDeploy using Canary10Percent15Minutes deployment preference minimizes customer impact by gradually shifting traffic (10% initially, monitored for 15 minutes) before completing deployment. CloudWatch alarms monitor function health and automatically trigger rollbacks if issues arise. This approach provides the safest gradual rollout with built-in health checks. Manual CodePipeline approvals add delay without automation. CloudFormation's RoutingConfig applies to Lambda aliases but lacks CodeDeploy's canary deployment strategy. CodeBuild testing followed by manual alias updates lacks automatic rollback capabilities based on alarm thresholds.
Why the other options are wrong
- B. Manual approval actions introduce delays and prevent automated rollback based on health metrics.
- C. RoutingConfig provides basic traffic shifting but lacks CodeDeploy's canary deployment strategy and automatic alarm-based rollbacks.
- D. This approach requires manual version management and lacks the automated, gradual canary deployment strategy built into CodeDeploy.
Question 64
A company has chosen AWS to host a new application. The company needs to implement a multi-account strategy. A DevOps engineer creates a new AWS account and an organization in AWS Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower. The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory. When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account. All the OUs are enrolled in AWS Control Tower. Which solution will meet these requirements in the MOST automated way?
Show answer and explanation
Correct answer: D. Deploy the Customizations for AWS Control Tower (CfCT) solution. Use an AWS CodeCommit repository as the source. In the repository, create a custom package that includes the CloudFormation templates and the SCP JSON documents.
Customizations for AWS Control Tower (CfCT) is purpose-built for this exact use case: it automatically detects new accounts created through Account Factory and applies CloudFormation templates and SCPs from a CodeCommit repository. This is the most automated solution requiring no manual EventBridge rules, Service Catalog configuration, or stack set management. The repository-driven approach allows version control and organized template management.
Why the other options are wrong
- A. Service Catalog requires manual portfolio and product setup; combining with CLI SCP deployment is not automated and lacks integration.
- B. Manual CloudFormation stack set creation and enabling automatic deployment across accounts is more labor-intensive than CfCT.
- C. Manually creating EventBridge rules and configuring Service Catalog doesn't fully automate the SCP application and lacks the purpose-built Control Tower integration.
Question 65
A company has enabled all features for its organization in AWS Organizations. The organization contains 10 AWS accounts. The company has turned on AWS CloudTrail in all the accounts. The company expects the number of AWS accounts in the organization to increase to 500 during the next year. The company plans to use multiple OUs for these accounts. The company has enabled AWS Config in each existing AWS account in the organization. A DevOps engineer must implement a solution that enables AWS Config automatically for all future AWS accounts that are created in the organization. Which solution will meet this requirement?
Show answer and explanation
Correct answer: B. In the organization's management account, create an AWS CloudFormation stack set to enable AWS Config. Configure the stack set to deploy automatically when an account is created through Organizations.
AWS CloudFormation StackSets can automatically deploy stacks to all accounts in an organization, including newly created accounts. By creating a StackSet with AWS Config enablement templates, the system automatically provisions Config resources across the organization without manual intervention. StackSets are specifically designed to handle multi-account deployments at scale and can target organizational units, making this ideal for scaling from 10 to 500 accounts.
Why the other options are wrong
- A. While EventBridge can detect CreateAccount events, invoking Lambda to enable trusted access only enables organizational features; it does not provision AWS Config in the new account itself.
- D. EventBridge rules combined with Systems Manager Automation adds unnecessary complexity compared to StackSets, which are purpose-built for multi-account resource deployment.
- C. SCPs control permissions but do not automatically enable AWS Config; they restrict actions rather than provisioning resources across accounts.
Question 66
A company manages 500 AWS accounts that are in an organization in AWS Organizations. The company discovers many unattached Amazon Elastic Block Store (Amazon EBS) volumes in all the accounts. The company wants to automatically tag the unattached EBS volumes for investigation. A DevOps engineer needs to deploy an AWS Lambda function to all the AWS accounts. The Lambda function must run every 30 minutes to tag all the EBS volumes that have been unattached for a period of 7 days or more. Which solution will meet these requirements in the MOST operationally efficient manner?
Show answer and explanation
Correct answer: C. Configure a delegated administrator account for the organization. Create an AWS CloudFormation template that contains the Lambda function and an Amazon EventBridge scheduled rule to invoke the Lambda function every 30 minutes. Use CloudFormation StackSets to deploy the CloudFormation template from the delegated administrator account to all the member accounts in the organization
CloudFormation StackSets is the most operationally efficient solution for deploying infrastructure to multiple accounts at scale. By configuring a delegated administrator account and creating a CloudFormation template that includes both the Lambda function and an EventBridge scheduled rule to invoke it every 30 minutes, the solution can be deployed to all 500 member accounts in a single operation. StackSets handles the cross-account permissions and deployment orchestration automatically.
Why the other options are wrong
- A. Creating an EventBridge event bus in the delegated administrator account to invoke Lambda functions in member accounts requires complex cross-account event routing and is less operationally efficient than StackSets.
- B. Using custom scripts to assume roles and deploy CloudFormation manually does not scale well for 500 accounts and requires ongoing script maintenance and error handling.
- D. CodeDeploy is not designed for Lambda function deployment and requires unnecessary IAM policy attachments; StackSets is the native AWS solution for this use case.
Question 67
A DevOps engineer has automated a web service deployment by using AWS CodePipeline with the following steps: 1. An AWS CodeBuild project compiles the deployment artifact and runs unit tests. 2. An AWS CodeDeploy deployment group deploys the web service to Amazon EC2 instances in the staging environment. 3. A CodeDeploy deployment group deploys the web service to EC2 instances in the production environment. The quality assurance (QA) team requests permission to inspect the build artifact before the deployment to the production environment occurs. The QA team wants to run an internal penetration testing tool to conduct manual tests. The tool will be invoked by a REST API call. Which combination of actions should the DevOps engineer take to fulfill this request? (Choose two.)
Show answer and explanation
Correct answer: A, E. Insert a manual approval action between the test actions and deployment actions of the pipeline; Update the pipeline to invoke an AWS Lambda function that calls the REST API for the penetration testing tool.
Option A inserts a manual approval action between staging and production deployments, allowing the QA team to review and approve before production deployment. Option E updates the pipeline to invoke a Lambda function that calls the penetration testing tool's REST API, automating the execution of manual tests. Together, these options enable the QA team to perform internal penetration testing as part of the approval process.
Why the other options are wrong
- B. Buildspec.yml files cannot require manual approval; they run within the CodeBuild execution environment and cannot halt execution for external approvals.
- C. CodeDeploy deployment groups do not have manual approval functionality; approval gates belong in the CodePipeline itself.
- D. CodePipeline cannot directly invoke REST APIs; it must use Lambda or another service to call external APIs.
Question 68
An ecommerce company uses a large number of Amazon Elastic Block Store (Amazon EBS) backed Amazon EC2 instances. To decrease manual work across all the instances, a DevOps engineer is tasked with automating restart actions when EC2 instance retirement events are scheduled. How can this be accomplished?
Show answer and explanation
Correct answer: D. Set up an AWS Health Amazon EventBridge rule to run AWS Systems Manager Automation runbooks that stop and start the EC2 instance when a retirement scheduled event occurs.
AWS Health events trigger automatically when EC2 instance retirement is scheduled. Option D uses EventBridge to capture these Health events and invoke Systems Manager Automation runbooks that stop and start the affected instances. This approach proactively responds to retirement events by migrating the instance to new hardware, which is the appropriate remediation for scheduled retirement notices and aligns with automated DevOps practices.
Why the other options are wrong
- A. Weekly scheduled checks are reactive and miss the critical window to act on retirement events; hibernation is also not the correct remediation for retirement events.
- B. EC2 Auto Recovery only detects system status check failures, not scheduled retirement events, and cannot be restricted to maintenance windows through Config rules.
- C. Blanket rebooting all instances during maintenance is inefficient and doesn't respond specifically to retirement events; it also generates unnecessary downtime.
Question 69
A company recently created a new AWS Control Tower landing zone in a new organization in AWS Organizations. The landing zone must be able to demonstrate compliance with the Center for Internet Security (CIS) Benchmarks for AWS Foundations. The company’s security team wants to use AWS Security Hub to view compliance across all accounts. Only the security team can be allowed to view aggregated Security Hub findings. In addition, specific users must be able to view findings from their own accounts within the organization. All accounts must be enrolled in Security Hub after the accounts are created. Which combination of steps will meet these requirements in the MOST automated way? (Choose three.)
Show answer and explanation
Correct answer: A, C, E. Turn on trusted access for Security Hub in the organization’s management account. Create a new security account by using AWS Control Tower. Configure the new security account as the delegated administrator account for Security Hub. In the new security account, provide Security Hub with the CIS Benchmarks for AWS Foundations standards; Create an AWS IAM Identity Center (AWS Single Sign-On) permission set that includes the required permissions. Use the CreateAccountAssignment API operation to associate the security team users with the permission set and with the delegated security account; In Security Hub, turn on automatic enablement.
Option A enables Security Hub with a delegated administrator account to centralize compliance viewing with proper access control. Option C restricts viewing permissions to only the security team via IAM Identity Center permission sets. Option E enables automatic enrollment of all new accounts in the organization. Together, these three options automate Security Hub deployment across the organization, enforce CIS Benchmarks, and implement the required access controls with minimal manual intervention.
Why the other options are wrong
- B. Enabling CIS Benchmarks from the management account does not establish a delegated administrator account or automated enrollment.
- D. SCPs cannot effectively control Security Hub access granularly; IAM-based access control via Identity Center is the proper approach.
- F. Using EventBridge and Lambda for manual member enrollment is unnecessary when automatic enablement is available.
Question 70
A company is deploying a new application that uses Amazon EC2 instances. The company needs a solution to query application logs and AWS account API activity. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Use the Amazon CloudWatch agent to send logs from the EC2 instances to Amazon CloudWatch Logs. Configure AWS CloudTrail to deliver the API logs to CloudWatch Logs. Use CloudWatch Logs Insights to query both sets of logs.
CloudWatch Logs Insights is specifically designed to query and analyze logs from multiple sources in a unified interface. By configuring CloudWatch Agent to send EC2 application logs to CloudWatch Logs and CloudTrail to deliver API activity to CloudWatch Logs, both log types are in the same service where CloudWatch Logs Insights can perform cohesive searches and analysis across application and API activity simultaneously.
Why the other options are wrong
- A. Sending CloudTrail logs to S3 while keeping application logs in CloudWatch creates two separate data stores, requiring different query tools and preventing unified analysis.
- C. Kinesis and Redshift introduce unnecessary complexity and cost for log querying; CloudWatch Logs Insights is purpose-built for this use case.
- D. Sending application logs to S3 requires additional processing and splits log sources across services, making unified querying more complex than using CloudWatch Logs Insights.
Question 71
A company has multiple accounts in an organization in AWS Organizations. The company's SecOps team needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if any account in the organization turns off the Block Public Access feature on an Amazon S3 bucket. A DevOps engineer must implement this change without affecting the operation of any AWS accounts. The implementation must ensure that individual member accounts in the organization cannot turn off the notification. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Turn on AWS Config across the organization. In the delegated administrator account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that uses the s3-bucket-level-public-access-prohibited AWS Config managed rule in each account and uses an AWS Systems Manager document to publish an event to the SNS topic to notify the SecOps team.
AWS Config deployed across the organization with a delegated administrator account provides centralized compliance monitoring that cannot be disabled by individual member accounts. A conformance pack using the s3-bucket-level-public-access-prohibited managed rule detects when Block Public Access is disabled. AWS Systems Manager documents publish events to an SNS topic in the delegated administrator account, ensuring member accounts cannot interfere with notifications.
Why the other options are wrong
- A. GuardDuty detects threats and vulnerabilities, not configuration changes like disabling Block Public Access; it is not designed for compliance configuration monitoring.
- B. CloudFormation StackSets deployed to every account creates distributed SNS topics that member accounts could theoretically interfere with, and EventBridge cannot easily capture the specific PutBucketPublicAccessBlock API action across all accounts from a single location.
- D. Amazon Inspector is designed for vulnerability assessments on compute resources, not for detecting specific AWS API actions or S3 configuration changes.
Question 72
A company deploys a web application on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The company stores the application code in an AWS CodeCommit repository. When code is merged to the main branch, an AWS Lambda function invokes an AWS CodeBuild project. The CodeBuild project packages the code, stores the packaged code in AWS CodeArtifact, and invokes AWS Systems Manager Run Command to deploy the packaged code to the EC2 instances. Previous deployments have resulted in defects, EC2 instances that are not running the latest version of the packaged code, and inconsistencies between instances. Which combination of actions should a DevOps engineer take to implement a more reliable deployment solution? (Choose two.)
Show answer and explanation
Correct answer: B, C. Create a pipeline in AWS CodePipeline that uses the CodeCommit repository as a source provider. Create separate pipeline stages that run a CodeBuild project to build and then test the application. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action; Create an AWS CodeDeploy application and a deployment group to deploy the packaged code to the EC2 instances. Configure the ALB for the deployment group.
The current manual Lambda and Systems Manager approach causes inconsistencies and defects. Option B implements a proper CodePipeline with sequential build and test stages, ensuring quality gates are passed before deployment, while option C adds CodeDeploy to manage consistent, reliable deployments to EC2 instances with health checks and rollback capabilities. Together, these options replace the ad-hoc approach with AWS's managed deployment service, which tracks instance state, handles coordinated updates, and prevents some instances from falling behind. Option A uses parallel build and test stages which could reduce testing rigor. Option D adds unnecessary Lambda complexity. Option E bypasses CodeDeploy's deployment management and health tracking features.
Why the other options are wrong
- A. Parallel execution of build and test stages risks passing untested code to deployment, reducing reliability.
- D. Using Lambda functions to invoke CodeDeploy adds unnecessary abstraction and doesn't solve the core deployment consistency issues.
- E. Using S3 for artifacts and Systems Manager instead of CodeDeploy recreates the original problem without proper deployment orchestration and health tracking.
Question 73
A DevOps engineer is using AWS CodeDeploy across a fleet of Amazon EC2 instances in an EC2 Auto Scaling group. The associated CodeDeploy deployment group, which is integrated with EC2 Auto Scaling, is configured to perform in-place deployments with CodeDeployDefault.OneAtATime. During an ongoing new deployment, the engineer discovers that, although the overall deployment finished successfully, two out of five instances have the previous application revision deployed. The other three instances have the newest application revision. What is likely causing this issue?
Show answer and explanation
Correct answer: D. EC2 Auto Scaling launched two new instances while the new deployment had not yet finished, causing the previous version to be deployed on the affected instances.
When CodeDeploy performs in-place deployments with OneAtATime configuration on an Auto Scaling group, any new instances launched by the Auto Scaling group during the deployment will be created from the current launch template or configuration, which contains the old application revision. This causes newly launched instances to have the previous version while the deployment is still progressing on existing instances.
Why the other options are wrong
- A. If instances failed to fetch the deployment, CodeDeploy would report deployment failures, not a mix of old and new versions across the fleet.
- B. Lifecycle hook failures would cause rollbacks on affected instances, but CodeDeploy with OneAtATime would pause and report the failure rather than leaving a mix of versions.
- C. If the CodeDeploy agent was missing, those instances would not have received the deployment at all and would not appear in the deployment report.
Question 74
A DevOps engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using S3 cross-Region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account. Which combination of actions should be performed to enable this replication? (Choose three.)
Show answer and explanation
Correct answer: A, D, E. Create a replication IAM role in the source account; Add statements to the target bucket policy allowing the replication IAM role to replicate objects; Create a replication rule in the source bucket to enable the replication.
Cross-region cross-account replication requires: a replication IAM role in the source account that has permissions to read from the source bucket and replicate objects, statements in the source bucket policy granting that role permission to perform replication actions, and a replication rule configured on the source bucket defining what and where to replicate. The target account doesn't need a dedicated replication role since the source account's role performs all replication actions.
Why the other options are wrong
- B. The target account doesn't need its own replication IAM role; the source account's role handles all replication operations.
- C. Source bucket policy statements are not required for replication; the role's trust relationship and permissions suffice.
- F. Replication rules are created only on the source bucket, not the target bucket.
Question 75
A DevOps engineer notices that all Amazon EC2 instances running behind an Application Load Balancer in an Auto Scaling group are failing to respond to user requests. The EC2 instances are also failing target group HTTP health checks. Upon inspection, the engineer notices the application process was not running in any EC2 instances. There are a significant number of out of memory messages in the system logs. The engineer needs to improve the resilience of the application to cope with a potential application memory leak. Monitoring and notifications should be enabled to alert when there is an issue. Which combination of actions will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, E. Change the Auto Scaling configuration to replace the instances when they fail the load balancer's health checks; Use the Amazon CloudWatch agent to collect the memory utilization of the EC2 instances in the Auto Scaling group. Create an alarm when the memory utilization is high and associate an Amazon SNS topic to receive a notification.
To address the memory leak causing application failures, the solution requires two components: automatic remediation and monitoring. Option A enables Auto Scaling to automatically replace unhealthy instances when they fail health checks, removing the manual intervention step and ensuring failed instances are replaced promptly. Option E uses CloudWatch agent to collect memory metrics from EC2 instances, enabling visibility into memory consumption across the Auto Scaling group and triggering SNS notifications when thresholds are exceeded. Together, these options provide both automatic recovery from failures and proactive alerting when memory issues develop.
Why the other options are wrong
- B. Reducing health check intervals does not address the root cause of the memory leak; it only detects failures faster but doesn't remediate them.
- C. Switching from HTTP to TCP health checks doesn't solve the memory leak problem and wouldn't detect the application is down once the process terminates.
- D. EC2 instances do not natively report memory utilization metrics to CloudWatch; only custom metrics via CloudWatch agent or third-party tools can provide this data.
Question 76
A company uses an organization in AWS Organizations to manage its AWS accounts. The company recently acquired another company that has standalone AWS accounts. The acquiring company's DevOps team needs to consolidate the administration of the AWS accounts for both companies and retain full administrative control of the accounts. The DevOps team also needs to collect and group findings across all the accounts to implement and maintain a security posture. Which combination of steps should the DevOps team take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, C. Invite the acquired company's AWS accounts to join the organization. Create the OrganizationAccountAccessRole IAM role in the invited accounts. Grant permission to the management account to assume the role; Use AWS Security Hub to collect and group findings across all accounts. Use Security Hub to automatically detect new accounts as the accounts are added to the organization.
Option B enables administrative control by inviting accounts into the organization and creating the OrganizationAccountAccessRole, allowing the management account to assume permissions in member accounts without SCPs breaking existing access. Option C uses AWS Security Hub, which is specifically designed to collect, aggregate, and analyze findings across multiple accounts in an organization and automatically detects newly added accounts. Together, these provide consolidated administration and security findings visibility. Option A would create overly permissive SCPs attached to the management account. Option D uses Firewall Manager, which is for network firewall policy management, not findings aggregation. Option E uses Inspector, which is for vulnerability assessment, not the primary findings aggregation tool.
Why the other options are wrong
- A. Attaching an SCP with full admin privileges to the management account is ineffective and doesn't grant the needed cross-account access pattern.
- D. AWS Firewall Manager manages network firewall policies, not general security findings; it's not designed for this use case.
- E. Amazon Inspector is a vulnerability scanning tool, not a central findings aggregation service for this purpose.
Question 77
A company runs an application on Amazon EC2 instances. The company uses a series of AWS CloudFormation stacks to define the application resources. A developer performs updates by building and testing the application on a laptop and then uploading the build output and CloudFormation stack templates to Amazon S3. The developer's peers review the changes before the developer performs the CloudFormation stack update and installs a new version of the application onto the EC2 instances. The deployment process is prone to errors and is time-consuming when the developer updates each EC2 instance with the new application. The company wants to automate as much of the application deployment process as possible while retaining a final manual approval step before the modification of the application or resources. The company already has moved the source code for the application and the CloudFormation templates to AWS CodeCommit. The company also has created an AWS CodeBuild project to build and test the application. Which combination of steps will meet the company’s requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. Create an application group and a deployment group in AWS CodeDeploy. Install the CodeDeploy agent on the EC2 instances; Use AWS CodePipeline to invoke the CodeBuild job, create CloudFormation change sets for each of the application stacks, and pause for a manual approval step. After approval, run the CloudFormation change sets and start the AWS CodeDeploy deployment.
To meet the requirements of automating deployment while retaining manual approval and supporting CloudFormation updates, options A and D work together. Option A establishes the CodeDeploy infrastructure by creating an application group and deployment group on the EC2 instances with the CodeDeploy agent installed. Option D uses CodePipeline to orchestrate the full workflow: invoke CodeBuild, create CloudFormation change sets for safe updates, pause for manual approval, then execute the change sets and deploy via CodeDeploy. Change sets provide a safer mechanism for CloudFormation updates by showing what will change before applying it, which aligns with the peer review requirement.
Why the other options are wrong
- B. CodeDeploy uses application and deployment groups, not environments; registering instances to a CodeDeploy environment is not the correct terminology or approach.
- C. Running CloudFormation updates directly without change sets bypasses the safer review mechanism; change sets should be created first to show what changes will occur.
- E. This option skips the CloudFormation change set step entirely, going directly to CodeDeploy deployment without updating infrastructure through CloudFormation, which fails to address the stack update requirement.
Question 78
A company builds a container image in an AWS CodeBuild project by running Docker commands. After the container image is built, the CodeBuild project uploads the container image to an Amazon S3 bucket. The CodeBuild project has an IAM service role that has permissions to access the S3 bucket. A DevOps engineer needs to replace the S3 bucket with an Amazon Elastic Container Registry (Amazon ECR) repository to store the container images. The DevOps engineer creates an ECR private image repository in the same AWS Region of the CodeBuild project. The DevOps engineer adjusts the IAM service role with the permissions that are necessary to work with the new ECR repository. The DevOps engineer also places new repository information into the docker build command and the docker push command that are used in the buildspec.yml file. When the CodeBuild project runs a build job, the job fails when the job tries to access the ECR repository. Which solution will resolve the issue of failed access to the ECR repository?
Show answer and explanation
Correct answer: A. Update the buildspec.yml file to log in to the ECR repository by using the aws ecr get-login-password AWS CLI command to obtain an authentication token. Update the docker login command to use the authentication token to access the ECR repository.
When using Amazon ECR with CodeBuild, Docker must authenticate to the ECR registry before pushing images. The solution requires calling aws ecr get-login-password to retrieve a temporary authentication token, then passing that token to the docker login command. This is the standard AWS-recommended method for ECR authentication in CI/CD pipelines. While the IAM role provides permissions to access ECR APIs, Docker itself needs explicit authentication credentials to interact with the registry.
Why the other options are wrong
- B. SECRETS_MANAGER environment variables store credential values, not IAM role ARNs, and cannot be used to authenticate Docker to ECR.
- C. Making the ECR repository public defeats the security purpose of using a private repository, and a repository policy alone cannot solve the Docker authentication problem.
- D. CodeBuild uses the IAM role's credentials directly for AWS API calls; manually assuming the role in buildspec.yml adds unnecessary complexity and an ECR repository policy does not provide Docker authentication.
Question 79
An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months. Its product currently runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. All data is stored in an Amazon Aurora database instance. When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region. How should the company meet these requirements with the LEAST amount of application changes?
Show answer and explanation
Correct answer: C. Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer information and purchases.
Aurora with read replicas provides a shared product catalog accessible across regions while local Aurora instances in each region handle region-specific customer data and purchases for compliance. This leverages the company's existing Aurora implementation, requiring minimal application changes since the application already works with Aurora. Read replicas provide read-only access to the catalog with acceptable latency for catalog queries, while regional instances maintain data sovereignty.
Why the other options are wrong
- A. Redshift is designed for analytics, not transactional product catalog queries; mixing data stores requires significant application refactoring.
- B. DynamoDB global tables for the product catalog add operational complexity; the company already uses Aurora and moving catalog to DynamoDB requires substantial application changes.
- D. Using DynamoDB global tables for customer information introduces a second data platform; Aurora is already proven and maintaining it for both purposes is simpler.
Question 80
A company's application is currently deployed to a single AWS Region. Recently, the company opened a new office on a different continent. The users in the new office are experiencing high latency. The company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and uses Amazon DynamoDB as the database layer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. A DevOps engineer is tasked with minimizing application response times and improving availability for users in both Regions. Which combination of actions should be taken to address the latency issues? (Choose three.)
Show answer and explanation
Correct answer: C, D, F. Create new ALB and Auto Scaling group resources in the new Region and configure the new ALB to direct traffic to the new Auto Scaling group; Create Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB; Convert the DynamoDB table to a global table.
To minimize latency for users in two geographic regions, three actions are required. Option C creates compute infrastructure in the new region with an ALB and Auto Scaling group directing traffic locally. Option D uses Route 53 latency-based routing to intelligently direct users to the nearest regional endpoint based on their geography. Option F converts DynamoDB to a global table, enabling low-latency local reads and writes in both regions with automatic cross-region replication. Together, these provide regional compute, intelligent routing, and replicated data.
Why the other options are wrong
- A. Creating a new DynamoDB table with cross-region replication is incomplete; a global table is the proper solution for multi-region read/write access.
- B. ALB and Auto Scaling groups are regional resources, not global; they cannot be created as global resources.
- E. Failover routing policies prioritize regions in order but do not optimize for latency; latency-based routing (option D) directly minimizes response times by routing to the geographically nearest region.
Question 81
A company is divided into teams. Each team has an AWS account, and all the accounts are in an organization in AWS Organizations. Each team must retain full administrative rights to its AWS account. Each team also must be allowed to access only AWS services that the company approves for use. AWS services must gain approval through a request and approval process. How should a DevOps engineer configure the accounts to meet these requirements?
Show answer and explanation
Correct answer: D. Create an SCP that allows access to only approved AWS services. Attach the SCP to the root OU of the organization. Remove the FullAWSAccess SCP from the root OU of the organization.
An SCP attached to the root OU that allows only approved services denies all other services organization-wide while preserving local administrative rights within those constraints. Removing the default FullAWSAccess SCP ensures the restrictive policy takes effect. This approach implements the approval requirement while maintaining team autonomy within the approved service set without unnecessary management overhead.
Why the other options are wrong
- A. CloudFormation and Config rules are reactive enforcement mechanisms; SCPs provide proactive preventive control.
- B. Control Tower and IAM Identity Center add complexity; they do not simplify service approval enforcement compared to SCPs.
- C. Placing accounts in an OU and adding a deny policy only restricts a subset; the approach in option D is cleaner and more maintainable organization-wide.
Question 82
A company is examining its disaster recovery capability and wants the ability to switch over its daily operations to a secondary AWS Region. The company uses AWS CodeCommit as a source control tool in the primary Region. A DevOps engineer must provide the capability for the company to develop code in the secondary Region. If the company needs to use the secondary Region, developers can add an additional remote URL to their local Git configuration. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create a CodeCommit repository in the secondary Region. Create an AWS CodeBuild project to perform a Git mirror operation of the primary Region's CodeCommit repository to the secondary Region's CodeCommit repository. Create an AWS Lambda function that invokes the CodeBuild project. Create an Amazon EventBridge rule that reacts to merge events in the primary Region's CodeCommit repository. Configure the EventBridge rule to invoke the Lambda function.
The solution creates a mirror of the primary region's CodeCommit repository to a secondary region's CodeCommit repository. An EventBridge rule detects merge events in the primary repository and triggers a Lambda function, which invokes a CodeBuild project to perform a Git mirror operation. This keeps the secondary repository synchronized with the primary, allowing developers to add it as an additional remote URL for disaster recovery. Developers can then push to either repository as needed during normal operations or failover scenarios.
Why the other options are wrong
- B. S3 is not a Git repository and cannot be added as a remote URL for Git operations; Fargate adds unnecessary complexity.
- C. CodeArtifact is a package repository, not a source control system, and cannot be used as a Git remote or to store versioned code.
- D. Cloud9 is an IDE, not a synchronization mechanism, and manually configuring remote repositories does not automate the required mirroring.
Question 83
A DevOps engineer has implemented a CI/CD pipeline to deploy an AWS CloudFormation template that provisions a web application. The web application consists of an Application Load Balancer (ALB), a target group, a launch template that uses an Amazon Linux 2 AMI, an Auto Scaling group of Amazon EC2 instances, a security group, and an Amazon RDS for MySQL database. The launch template includes user data that specifies a script to install and start the application. The initial deployment of the application was successful. The DevOps engineer made changes to update the version of the application with the user data. The CI/CD pipeline has deployed a new version of the template. However, the health checks on the ALB are now failing. The health checks have marked all targets as unhealthy. During investigation, the DevOps engineer notices that the CloudFormation stack has a status of UPDATE_COMPLETE. However, when the DevOps engineer connects to one of the EC2 instances and checks /var/log/messages, the DevOps engineer notices that the Apache web server failed to start successfully because of a configuration error. How can the DevOps engineer ensure that the CloudFormation deployment will fail if the user data fails to successfully finish running?
Show answer and explanation
Correct answer: A. Use the cfn-signal helper script to signal success or failure to CloudFormation. Use the WaitOnResourceSignals update policy within the CloudFormation template. Set an appropriate timeout for the update policy.
The cfn-signal helper script allows user data scripts to explicitly signal success or failure to CloudFormation by sending a signal to a pre-signed URL. By pairing this with the WaitOnResourceSignals update policy, CloudFormation will wait for the signal before marking the stack as UPDATE_COMPLETE. If user data fails (as evidenced by Apache not starting), cfn-signal sends a failure signal, causing the stack update to fail and preventing UPDATE_COMPLETE status.
Why the other options are wrong
- B. CloudWatch alarms on UnhealthyHostCount provide visibility but do not prevent CloudFormation from marking the stack as complete; the stack update completes independent of target health.
- C. Auto Scaling lifecycle hooks pause instances during scaling but do not signal CloudFormation stack completion; lifecycle hooks require manual completion or timeout, not automatic feedback.
- D. CloudWatch Logs with Lambda subscription filters add operational complexity and introduce asynchronous delays; the SignalResource API approach is indirect compared to the native cfn-signal mechanism.
Question 84
A company uses a single AWS account to test applications on Amazon EC2 instances. The company has turned on AWS Config in the AWS account and has activated the restricted-ssh AWS Config managed rule. The company needs an automated monitoring solution that will provide a customized notification in real time if any security group in the account is not compliant with the restricted-ssh rule. The customized notification must contain the name and ID of the noncompliant security group. A DevOps engineer creates an Amazon Simple Notification Service (Amazon SNS) topic in the account and subscribes the appropriate personnel to the topic. What should the DevOps engineer do next to meet these requirements?
Show answer and explanation
Correct answer: A. Create an Amazon EventBridge rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Configure an input transformer for the EventBridge rule. Configure the EventBridge rule to publish a notification to the SNS topic.
EventBridge can detect AWS Config evaluation results in real time and trigger actions based on compliance status. By creating an EventBridge rule that matches NON_COMPLIANT events for the restricted-ssh rule and configuring an input transformer, the DevOps engineer can extract the security group name and ID from the AWS Config event and publish a customized notification to the SNS topic. This provides real-time, automated monitoring with the required custom notification format.
Why the other options are wrong
- B. AWS Config does not have a native capability to send evaluation results directly to SNS, and SNS filter policies operate on message attributes, not message content, making this approach ineffective.
- C. Systems Manager Run Command is not designed for customizing notifications; it is for executing commands on EC2 instances. EventBridge with input transformers is the proper mechanism for message transformation.
- D. Matching all NON_COMPLIANT events without filtering for the restricted-ssh rule specifically would generate excessive noise and notifications unrelated to security group SSH compliance.
Question 85
A company wants to set up a continuous delivery pipeline. The company stores application code in a private GitHub repository. The company needs to deploy the application components to Amazon Elastic Container Service (Amazon ECS). Amazon EC2, and AWS Lambda. The pipeline must support manual approval actions. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Use AWS CodePipeline with AWS CodeDeploy as the deploy provider.
CodePipeline supports GitHub as a source and manual approval actions natively. AWS CodeDeploy is a single deploy provider that can deploy to EC2 instances, Lambda functions and ECS services, so it covers all three targets. Using CodeDeploy as the deploy action meets every requirement in one pipeline.
Why the other options are wrong
- A. CodePipeline has no native EC2 deploy provider, so ECS, EC2 and Lambda cannot all be listed as deploy providers in this way.
- C. Elastic Beanstalk deploys web applications to its own managed environments and cannot deploy Lambda functions or arbitrary ECS services.
- D. CodeDeploy on its own is not a pipeline and does not provide manual approval actions.
Question 86
A company has containerized all of its in-house quality control applications. The company is running Jenkins on Amazon EC2 instances, which require patching and upgrading. The compliance officer has requested a DevOps engineer begin encrypting build artifacts since they contain company intellectual property. What should the DevOps engineer do to accomplish this in the MOST maintainable manner?
Show answer and explanation
Correct answer: D. Use AWS CodeBuild with artifact encryption to replace the Jenkins instance running on EC2 instances.
AWS CodeBuild is a fully managed build service that replaces the need to maintain Jenkins on EC2 instances, eliminates patching and upgrade overhead, and provides native artifact encryption capabilities. This approach is more maintainable than managing EC2 infrastructure, containerizing Jenkins, or using additional services like Secrets Manager for artifact encryption. CodeBuild's built-in encryption satisfies the compliance requirement for encrypting build artifacts.
Why the other options are wrong
- A. Automating patching on EC2 reduces manual work but does not replace the maintenance burden; encrypting EBS volumes protects data at rest but adds management complexity.
- B. Deploying Jenkins to ECS still requires managing Jenkins infrastructure and relies on S3 default encryption, which is less integrated than CodeBuild's native artifact encryption.
- C. AWS Secrets Manager is designed for storing credentials and secrets, not encrypting build artifacts; CodePipeline artifact encryption is not managed through Secrets Manager.
Question 87
A development team is using AWS CodeCommit to version control application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote main branch as the trigger for the pipeline to integrate code changes. A developer has pushed code changes to the CodeCommit repository, but noticed that the pipeline had no reaction, even after 10 minutes. Which of the following actions should be taken to troubleshoot this issue?
Show answer and explanation
Correct answer: A. Check that an Amazon EventBridge rule has been created for the main branch to trigger the pipeline.
CodePipeline requires an Amazon EventBridge rule to detect CodeCommit repository changes and trigger pipeline execution. Without this EventBridge rule specifically configured for the main branch, the pipeline will not automatically start when code is pushed. The CodePipeline service role and developer IAM permissions are prerequisites for successful pipeline execution, but neither controls whether the pipeline is initially triggered. CloudWatch Logs would show errors after a trigger attempt, not explain why no trigger occurred.
Why the other options are wrong
- B. Service role permissions are necessary for pipeline execution, not for the initial trigger detection.
- C. Developer IAM permissions control push access to the repository, not pipeline trigger configuration.
- D. CloudWatch Logs would only show errors if the pipeline had attempted to run; lack of trigger means no execution attempt occurs.
Question 88
A company is building a web and mobile application that uses a serverless architecture powered by AWS Lambda and Amazon API Gateway. The company wants to fully automate the backend Lambda deployment based on code that is pushed to the appropriate environment branch in an AWS CodeCommit repository. The deployment must have the following: • Separate environment pipelines for testing and production • Automatic deployment that occurs for test environments only Which steps should be taken to meet these requirements?
Show answer and explanation
Correct answer: C. Create two AWS CodePipeline configurations for test and production environments. Configure the production pipeline to have a manual approval step. Create one CodeCommit repository with a branch for each environment. Set up each CodePipeline to retrieve the source code from the appropriate branch in the repository. Set up the deployment step to deploy the Lambda functions with AWS CloudFormation.
Option C correctly implements separate CodePipeline configurations for test and production environments with a manual approval step for production, uses a single CodeCommit repository with environment branches for efficient management, and deploys Lambda functions using CloudFormation. This approach enables automatic deployment for test environments while requiring approval for production, avoiding repository duplication.
Why the other options are wrong
- A. Separate repositories per environment create unnecessary management overhead and don't provide a way to restrict automatic deployments to test environments only.
- B. While it has the correct pipeline structure and approval gates, maintaining separate repositories is less efficient than using branches within a single repository.
- D. CodeBuild alone cannot function as a deployment orchestrator; this misses the core pipeline automation requirement and the S3 bucket approach lacks the version control benefits of CodeCommit.
Question 89
A company is using an organization in AWS Organizations to manage multiple AWS accounts. The company’s development team wants to use AWS Lambda functions to meet resiliency requirements and is rewriting all applications to work with Lambda functions that are deployed in a VPC. The development team is using Amazon Elastic File System (Amazon EFS) as shared storage in Account A in the organization. The company wants to continue to use Amazon EFS with Lambda. Company policy requires all serverless projects to be deployed in Account B. A DevOps engineer needs to reconfigure an existing EFS file system to allow Lambda functions to access the data through an existing EFS access point. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: A, D, E. Update the EFS file system policy to provide Account B with access to mount and write to the EFS file system in Account A; Update the Lambda execution roles with permission to access the VPC and the EFS file system; Create a VPC peering connection to connect Account A to Account B.
To enable Lambda functions in Account B to access an EFS file system in Account A, three steps are required: Update the EFS file system policy (option A) to grant Account B access permissions; Update the Lambda execution role in Account B (option D) with permissions to access both the VPC and EFS; Create a VPC peering connection (option E) to establish network connectivity between the accounts so Lambda in Account B can reach the EFS in Account A. SCPs are organizational policies not needed here, DMS is for database synchronization not applicable to file access, and assuming a cross-account role is not the standard pattern for EFS access.
Why the other options are wrong
- B. SCPs set organizational guardrails but are not required for EFS cross-account access configuration.
- C. Creating a duplicate EFS in Account B with DMS defeats the purpose of using shared storage.
- F. Lambda execution roles with assumed cross-account roles is not the standard approach; the execution role needs direct EFS permissions.
Question 90
A highly regulated company has a policy that DevOps engineers should not log in to their Amazon EC2 instances except in emergencies. If a DevOps engineer does log in, the security team must be notified within 15 minutes of the occurrence. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user logins. If a login is found, send a notification to the security team using Amazon SNS.
Install the CloudWatch agent on EC2 instances to collect OS-level authentication logs and push them to CloudWatch Logs. Create a metric filter that searches for login events in the logs. When matches are found, trigger an SNS notification to the security team. This meets the requirement of detecting and notifying within 15 minutes because CloudWatch Logs processes log events in near real-time. Inspector is for security assessments not log monitoring, CloudTrail only captures AWS API calls not EC2 OS logins, and S3-based solutions add latency that may exceed the 15-minute window.
Why the other options are wrong
- A. Inspector is for vulnerability assessment; EventBridge doesn't directly monitor EC2 OS-level logins.
- C. CloudTrail captures AWS API actions, not EC2 operating system login events.
- D. Pushing logs to S3 then querying with Athena introduces significant latency, potentially exceeding the 15-minute notification requirement.
Question 91
A DevOps engineer is working on a data archival project that requires the migration of on-premises data to an Amazon S3 bucket. The DevOps engineer develops a script that incrementally archives on-premises data that is older than 1 month to Amazon S3. Data that is transferred to Amazon S3 is deleted from the on-premises location. The script uses the S3 PutObject operation. During a code review, the DevOps engineer notices that the script does not verify whether the data was successfully copied to Amazon S3. The DevOps engineer must update the script to ensure that data is not corrupted during transmission. The script must use MD5 checksums to verify data integrity before the on-premises data is deleted. Which solutions for the script will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Include the MD5 checksum within the Content-MD5 parameter. Check the operation call’s return status to find out if an error was returned; Check the returned response for the ETag. Compare the returned ETag against the MD5 checksum.
For MD5 checksum verification, Content-MD5 parameter validation is a standard S3 approach: include the MD5 in the Content-MD5 header, and S3 will reject the upload if the transmitted data doesn't match, returning an error status. The ETag response field contains the MD5 hash of the uploaded object, allowing comparison with the local MD5 checksum to verify successful transfer. Both methods provide integrity verification before deleting source data.
Why the other options are wrong
- A. VersionId is used for object versioning, not MD5 checksum verification.
- C. The tagging parameter is for object tags, not checksum storage, and doesn't verify integrity during upload.
- E. While metadata can store the checksum and HeadObject retrieves it, this only confirms storage, not transmission integrity during upload.
Question 92
An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS IAM Identity Center (AWS Single Sign-On) to external identity provider (IdP) and has configured SAML 2.0. The DevOps team wants a robust permission model that applies the principle of least privilege. The model must allow the team to build and manage only the team's own resources. Which combination of steps will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: B, C, F. Create permission sets. Attach an inline policy that includes the required permissions and uses the aws:PrincipalTag condition key to scope the permissions; Create a group in the IdP. Place users in the group. Assign the group to accounts and the permission sets in IAM Identity Center; Enable attributes for access control in IAM Identity Center. Map attributes from the IdP as key-value pairs.
Permission sets in IAM Identity Center (option B) provide the proper abstraction layer for managing access. The aws:PrincipalTag condition key (option B) enables attribute-based access control to scope permissions to resources matching specific tags. Groups in the external IdP (option C) allow assigning users to permission sets in IAM Identity Center, bridging the SAML 2.0 authentication. Attributes for access control must be enabled in IAM Identity Center (option F) and mapped from the IdP as key-value pairs to support tag-based access control. This combination creates a scalable, least-privilege model where users inheriting tags from the IdP get scoped permissions.
Why the other options are wrong
- A. IAM policies alone do not integrate with IAM Identity Center's permission set model in the required way.
- D. Groups cannot be assigned directly to OUs in IAM Identity Center; they must be assigned to permission sets and accounts.
- E. Simply applying tags to users without enabling attributes for access control and mapping from the IdP does not establish the proper integration.
Question 93
A DevOps engineer is deploying a new version of a company’s application in an AWS CodeDeploy deployment group associated with its Amazon EC2 instances. After some time, the deployment fails. The engineer realizes that all the events associated with the specific deployment ID are in a Skipped status, and code was not deployed in the instances associated with the deployment group. What are valid reasons for this failure? (Choose two.)
Show answer and explanation
Correct answer: A, D. The networking configuration does not allow the EC2 instances to reach the internet via a NAT gateway or internet gateway, and the CodeDeploy endpoint cannot be reached; An instance profile with proper permissions was not attached to the target EC2 instances.
Skipped events occur when CodeDeploy agent cannot communicate with the CodeDeploy service. Network configuration preventing internet access (option A) blocks agent-to-service communication, causing all events to be skipped. An instance profile lacking proper permissions (option D) prevents the EC2 instance from authenticating to the CodeDeploy endpoint, also resulting in skipped events. Both conditions prevent the agent from even attempting lifecycle events, resulting in the Skipped status observed.
Why the other options are wrong
- B. IAM user permissions affect who can trigger deployments but not instance-level communication; the deployment was already triggered.
- C. Instance registration occurs automatically when the CodeDeploy agent runs and contacts the endpoint; if this failed, the root cause is network or permissions, not registration.
- E. Missing appspec.yml causes deployment failure after events begin, not Skipped status; the agent must contact the service to retrieve the revision first.
Question 94
A company has developed an AWS Lambda function that handles orders received through an API. The company is using AWS CodeDeploy to deploy the Lambda function as the final stage of a CI/CD pipeline. A DevOps engineer has noticed there are intermittent failures of the ordering API for a few seconds after deployment. After some investigation, the DevOps engineer believes the failures are due to database changes not having fully propagated before the Lambda function is invoked. How should the DevOps engineer overcome this?
Show answer and explanation
Correct answer: A. Add a BeforeAllowTraffic hook to the AppSpec file that tests and waits for any necessary database changes before traffic can flow to the new version of the Lambda function.
The BeforeAllowTraffic hook in the AppSpec file runs before traffic is routed to the new Lambda version, making it the appropriate place to validate that database changes have propagated. This hook can test database connectivity and schema changes, ensuring the new Lambda function will operate correctly before it receives production traffic, eliminating the race condition causing intermittent failures.
Why the other options are wrong
- B. AfterAllowTraffic runs after traffic is already flowing, so it cannot prevent failures; issues would already be occurring.
- C. BeforeInstall runs before Lambda function deployment, too early to check if database changes have propagated.
- D. ValidateService is not a standard CodeDeploy hook for Lambda; CodeDeploy uses BeforeAllowTraffic and AfterAllowTraffic for Lambda validation.
Question 95
A company has 20 service teams. Each service team is responsible for its own microservice. Each service team uses a separate AWS account for its microservice and a VPC with the 192.168.0.0/22 CIDR block. The company manages the AWS accounts with AWS Organizations. Each service team hosts its microservice on multiple Amazon EC2 instances behind an Application Load Balancer. The microservices communicate with each other across the public internet. The company’s security team has issued a new guideline that all communication between microservices must use HTTPS over private network connections and cannot traverse the public internet. A DevOps engineer must implement a solution that fulfills these obligations and minimizes the number of changes for each service team. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create a Network Load Balancer (NLB) in each of the microservice VPCs. Use AWS PrivateLink to create VPC endpoints in each AWS account for the NLBs. Create subscriptions to each VPC endpoint in each of the other AWS accounts. Use the VPC endpoint DNS names for communication between microservices.
AWS PrivateLink enables private connectivity between microservices across AWS accounts without traversing the public internet. Each service team creates an NLB in their VPC, exposes it via PrivateLink, and subscribes to other teams' VPC endpoints. This requires minimal changes per team (just create an NLB and update DNS references), scales efficiently to 20 accounts, enforces HTTPS over private connections, and avoids the complexity of peering meshes or transit gateways while maintaining security isolation.
Why the other options are wrong
- A. Shared private subnets through Resource Access Manager would require all services to run in a centralized account's VPC, creating a single point of failure and tightly coupling independent service teams.
- C. Full mesh VPC peering between 20 accounts creates (20×19)/2 = 190 peering connections, is operationally complex to maintain, and doesn't provide service isolation.
- D. Transit gateway requires more operational overhead to manage and doesn't provide the same level of service isolation as PrivateLink, making it less appropriate for independent service teams.
Question 96
A company manages an application that stores logs in Amazon CloudWatch Logs. The company wants to archive the logs to an Amazon S3 bucket. Logs are rarely accessed after 90 days and must be retained for 10 years. Which combination of steps should a DevOps engineer take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Configure a CloudWatch Logs subscription filter to use Amazon Kinesis Data Firehose to stream all logs to an S3 bucket; Configure the S3 bucket lifecycle policy to transition logs to S3 Glacier after 90 days and to expire logs after 3.650 days.
Kinesis Data Firehose is the standard service for streaming CloudWatch Logs to S3, providing reliable delivery with minimal configuration through subscription filters. S3 lifecycle policies then manage the retention timeline: transitioning to Glacier after 90 days preserves logs cost-effectively for the remaining years, and expiring after 3,650 days (10 years) satisfies the retention requirement. This combination provides both immediate archival and long-term cost-optimized storage.
Why the other options are wrong
- A. AWS Glue is an ETL service, not designed for real-time log streaming via subscription filters.
- C. Subscription filters cannot directly stream to S3; they require an intermediate service like Kinesis Data Firehose.
- E. Reduced Redundancy is deprecated and does not reduce costs like Glacier; it also does not provide the archival benefits needed for rarely-accessed logs.
Question 97
A company manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL DB instance to store the data. The company has configured Amazon Route 53 with an alias record that points to the ALB. A new company guideline requires a geographically isolated disaster recovery (DR) site with an RTO of 4 hours and an RPO of 15 minutes. Which DR strategy will meet these requirements with the LEAST change to the application stack?
Show answer and explanation
Correct answer: D. Launch a replica environment of everything except Amazon RDS in a different AWS Region. Create an RDS read replica in the new Region, and configure the new environment to point to the local RDS DB instance. Add the new stack to the Route 53 record set by using a health check to configure a failover routing policy. In the event of an outage, promote the read replica to primary.
This option meets the RTO of 4 hours and RPO of 15 minutes by deploying a replica environment in a different Region and creating an RDS read replica. The read replica enables near-real-time data synchronization (meeting the 15-minute RPO), while the failover routing policy with health checks enables quick failover (meeting the 4-hour RTO). In an outage, promoting the read replica to primary restores write capability, and the minimum application stack changes are required since everything mirrors the primary architecture.
Why the other options are wrong
- A. Using a different Availability Zone does not constitute geographically isolated disaster recovery; a single Region failure could impact both the primary and backup.
- B. Latency routing policy is for load balancing across healthy endpoints, not for DR failover; it does not provide automatic failover when the primary region fails.
- C. Copying and restoring RDS snapshots during an outage introduces significant delays and cannot meet the 15-minute RPO; this approach has poor RTO characteristics.
Question 98
A business has an application that consists of five independent AWS Lambda functions. The DevOps engineer has built a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild that builds, tests, packages, and deploys each Lambda function in sequence. The pipeline uses an Amazon EventBridge rule to ensure the pipeline starts as quickly as possible after a change is made to the application source code. After working with the pipeline for a few months, the DevOps engineer has noticed the pipeline takes too long to complete. What should the DevOps engineer implement to BEST improve the speed of the pipeline?
Show answer and explanation
Correct answer: C. Modify the CodePipeline configuration to run actions for each Lambda function in parallel by specifying the same runOrder.
CodePipeline allows multiple actions to execute in parallel by assigning them the same runOrder value. Since the five Lambda functions are independent, their build, test, package, and deployment actions can run concurrently rather than sequentially. This eliminates the serialized execution bottleneck and significantly reduces overall pipeline completion time without requiring infrastructure changes or custom build environments.
Why the other options are wrong
- A. Increasing network throughput on CodeBuild instances addresses bandwidth constraints that are not the primary issue with sequential pipeline execution.
- B. Custom CodeBuild environments with multiprocessing are unnecessarily complex and do not address the fundamental issue of sequential action execution in CodePipeline.
- D. Running CodeBuild within a VPC with dedicated instances adds network latency and does not solve the sequential execution problem inherent in the current pipeline configuration.
Question 99
A company has a new AWS account that teams will use to deploy various applications. The teams will create many Amazon S3 buckets for application-specific purposes and to store AWS CloudTrail logs. The company has enabled Amazon Macie for the account. A DevOps engineer needs to optimize the Macie costs for the account without compromising the account's functionality. Which solutions will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. Exclude S3 buckets that contain CloudTrail logs from automated discovery; Configure discovery jobs to include S3 objects based on the last modified criterion.
Amazon Macie charges based on the number of objects scanned. Excluding CloudTrail log buckets from automated discovery in option A reduces unnecessary scanning since CloudTrail logs are structural data, not sensitive application data requiring classification. Option D allows discovery jobs to filter by last modified date, enabling incremental scans of only recently changed objects rather than re-scanning unchanged data, significantly reducing costs. Option B would exclude potentially sensitive data sources. Option C scheduling daily jobs increases scan frequency and costs. Option E limits to production only but doesn't reduce the volume scanned per job.
Why the other options are wrong
- B. Excluding public-read buckets may miss sensitive data that's been inadvertently exposed and contradicts security best practices.
- C. Scheduling daily discovery jobs increases frequency and cost when less frequent scanning would likely suffice.
- E. Filtering by production tags still requires scanning the same number of objects; it only limits which buckets are included but doesn't reduce the scanning burden.
Question 100
A company is using AWS Organizations to create separate AWS accounts for each of its departments. The company needs to automate the following tasks: • Update the Linux AMIs with new patches periodically and generate a golden image • Install a new version of Chef agents in the golden image, if available • Provide the newly generated AMIs to the department's accounts Which solution meets these requirements with the LEAST management overhead?
Show answer and explanation
Correct answer: B. Use Amazon EC2 Image Builder to create an image pipeline that consists of the base Linux AMI and components to install the Chef agent. Use AWS Resource Access Manager to share EC2 Image Builder images with the department's accounts.
EC2 Image Builder is purpose-built for automated image creation with built-in support for applying patches and installing agents through components. Resource Access Manager natively shares EC2 Image Builder images across AWS accounts in Organizations, eliminating manual permission management and providing the least operational overhead compared to custom scripts or manual processes.
Why the other options are wrong
- A. Manual scripting requires ongoing maintenance and doesn't provide built-in version control or easy cross-account sharing mechanisms.
- C. Systems Manager Automation runbooks are not designed for image building; this approach requires manual URL provision and Organizations doesn't automate AMI replacement across accounts.
- D. While EC2 Image Builder is correct, storing only the AMI ID in Parameter Store doesn't automatically distribute the image to department accounts or manage permissions across AWS Organizations.
Question 101
A DevOps engineer is researching the least expensive way to implement an image batch processing cluster on AWS. The application cannot run in Docker containers and must run on Amazon EC2. The batch job stores checkpoint data on an NFS volume and can tolerate interruptions. Configuring the cluster software from a generic EC2 Linux image takes 30 minutes. What is the MOST cost-effective solution?
Show answer and explanation
Correct answer: D. Use Amazon EFS for checkpoint data. Use EC2 Fleet to launch EC2 Spot Instances. Create a custom AMI for the cluster and use the latest AMI when creating instances.
Using EC2 Spot Instances with a custom AMI provides the lowest cost while meeting all requirements. Spot Instances cost up to 90% less than On-Demand, and a pre-configured AMI eliminates the 30-minute setup time on each instance launch, improving efficiency and reducing time-based costs. Amazon EFS handles the NFS checkpoint data requirement, and Spot Instances tolerate the interruptions the batch job can handle.
Why the other options are wrong
- A. On-Demand instances are significantly more expensive than Spot Instances and still incur the 30-minute configuration overhead.
- B. GlusterFS is more complex to manage than EFS, manual configuration repeats the 30-minute setup cost, and manual shutdown is operationally inefficient.
- C. Using user data for configuration on startup requires the full 30 minutes of setup for every instance launch, increasing costs compared to a pre-built AMI.
Question 102
A company uses AWS CodeCommit for source code control. Developers apply their changes to various feature branches and create pull requests to move those changes to the main branch when the changes are ready for production. The developers should not be able to push changes directly to the main branch. The company applied the AWSCodeCommitPowerUser managed policy to the developers’ IAM role, and now these developers can push changes to the main branch directly on every repository in the AWS account. What should the company do to restrict the developers’ ability to push changes to the main branch directly?
Show answer and explanation
Correct answer: A. Create an additional policy to include a Deny rule for the GitPush and PutFile actions. Include a restriction for the specific repositories in the policy statement with a condition that references the main branch.
An explicit Deny rule takes precedence over any Allow rule in IAM, making it the most effective way to restrict developer access. By creating an additional policy with a Deny rule for GitPush and PutFile actions that targets the main branch on specific repositories, the company overrides the permissive PowerUser policy. This approach is the cleanest because it preserves the developers' existing permissions while adding a targeted restriction.
Why the other options are wrong
- B. Removing the PowerUser policy and replacing it with ReadOnly would severely restrict developer capabilities beyond what is needed; developers still need to push to feature branches.
- C. Modifying the existing managed policy is not possible; AWS managed policies cannot be edited directly.
- D. An Allow rule for feature branches does not prevent pushes to the main branch; an Allow rule cannot restrict access that is already granted by PowerUser.
Question 103
A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as noncompliant. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is always present. Which solution will accomplish this?
Show answer and explanation
Correct answer: B. Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization.
Option B deploys an AWS Config organizational rule across all accounts in AWS Organizations, ensuring the EBS encryption compliance check is continuously present and automatically updated organization-wide. Creating and applying an SCP to protect AWS Config prevents teams from circumventing the compliance checks. This solution is self-healing and persistent, it automatically flags unencrypted volumes whenever they appear, meeting the requirement for compliance checks to always be present.
Why the other options are wrong
- A. CloudFormation templates deployed via S3 and account creation scripts are not self-healing; they lack continuous compliance monitoring and do not detect non-compliant changes after initial deployment.
- C. SCPs prevent resource creation but do not mark existing resources as noncompliant or provide ongoing compliance reporting; Athena analysis is reactive rather than proactive.
- D. A pipeline-based Lambda solution requires continuous pipeline execution and does not provide real-time compliance detection; it scales poorly across many accounts and is not persistent like a Config rule.
Question 104
A media company has several thousand Amazon EC2 instances in an AWS account. The company is using Slack and a shared email inbox for team communications and important updates. A DevOps engineer needs to send all AWS-scheduled EC2 maintenance notifications to the Slack channel and the shared inbox. The solution must include the instances’ Name and Owner tags. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Use Amazon EventBridge to monitor for AWS Health events. Configure the maintenance events to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe an AWS Lambda function to the SNS topic to send notifications to the Slack channel and the shared inbox.
Amazon EventBridge monitors AWS Health events and scheduled EC2 maintenance notifications natively. Configure EventBridge rules to capture maintenance events and target an SNS topic, then subscribe both a Slack endpoint and the shared inbox email to that topic. SNS can deliver messages to both channels simultaneously. Lambda can be added to the SNS subscription to enrich messages with EC2 Name and Owner tags from the instance metadata. This approach directly integrates with AWS Health maintenance events without unnecessary layers.
Why the other options are wrong
- A. Trusted Advisor and Config rules are not the appropriate services for monitoring EC2 health maintenance events.
- C. CloudWatch metrics do not directly capture scheduled maintenance notifications; EventBridge is the native service for AWS Health events.
- D. CloudTrail records API calls, not EC2 maintenance events, and CloudTrail lookup events are not the appropriate mechanism for this notification requirement.
Question 105
A company is performing vulnerability scanning for all Amazon EC2 instances across many accounts. The accounts are in an organization in AWS Organizations. Each account's VPCs are attached to a shared transit gateway. The VPCs send traffic to the internet through a central egress VPC. The company has enabled Amazon Inspector in a delegated administrator account and has enabled scanning for all member accounts. A DevOps engineer discovers that some EC2 instances are listed in the "not scanning" tab in Amazon Inspector. Which combination of actions should the DevOps engineer take to resolve this issue? (Choose three.)
Show answer and explanation
Correct answer: A, B, E. Verify that AWS Systems Manager Agent is installed and is running on the EC2 instances that Amazon Inspector is not scanning; Associate the target EC2 instances with security groups that allow outbound communication on port 443 to the AWS Systems Manager service endpoint; Associate the target EC2 instances with instance profiles that grant permissions to communicate with AWS Systems Manager.
Amazon Inspector requires Systems Manager Agent (SSM Agent) to be installed and running on EC2 instances for scanning. The agent must communicate with AWS Systems Manager service endpoints on port 443, which requires both appropriate security group rules and IAM permissions. Option A ensures the agent is installed and running; Option B allows outbound communication to Systems Manager endpoints through security groups; Option E grants the necessary IAM permissions via instance profiles. These three actions together establish the prerequisites for Inspector scanning.
Why the other options are wrong
- C. The inspector:StartAssessmentRun permission is only needed by the person or service initiating scans, not on the target instances themselves.
- D. EC2 Instance Connect is used for interactive terminal access and is not required for Inspector scanning functionality.
- F. Managed-instance activation is only needed for on-premises instances or instances without IAM instance profiles; cloud-native EC2 instances with proper IAM roles do not require activation.
Question 106
A company uses AWS Secrets Manager to store a set of sensitive API keys that an AWS Lambda function uses. When the Lambda function is invoked the Lambda function retrieves the API keys and makes an API call to an external service. The Secrets Manager secret is encrypted with the default AWS Key Management Service (AWS KMS) key. A DevOps engineer needs to update the infrastructure to ensure that only the Lambda function’s execution role can access the values in Secrets Manager. The solution must apply the principle of least privilege. Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Create a KMS customer managed key that trusts Secrets Manager and allows the Lambda function's execution role to decrypt. Update Secrets Manager to use the new customer managed key; Ensure that the Lambda function’s execution role has the KMS permissions scoped on the resource level. Configure the permissions so that the KMS key can encrypt the Secrets Manager secret
To enforce least privilege, a customer-managed KMS key must be created that allows only the Lambda execution role to decrypt (option B). The default KMS key used by Secrets Manager cannot be modified to restrict permissions to specific roles, so a new customer-managed key must replace it. Option D ensures the Lambda execution role has KMS decrypt permissions scoped specifically to the secret's encryption key at the resource level, preventing the role from decrypting other secrets. Together, these steps provide encryption, restricted decryption access to only the Lambda function, and adherence to least privilege principles.
Why the other options are wrong
- A. The default Secrets Manager KMS key cannot be modified; AWS manages this key and does not allow custom permission policies.
- C. Granting permissions to the account root principal violates the principle of least privilege and allows any principal in the account to decrypt.
- E. Removing all KMS permissions from the Lambda role would prevent it from decrypting the secret, breaking functionality.
Question 107
A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full access to the company's AWS accounts to deploy applications. The DevOps team needs to allow only a specific management IAM role to manage the IAM roles and policies of any AWS accounts in only the production OU. Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, E. Ensure that the FullAWSAccess SCP is applied at the organization root; Create an SCP that denies IAM related actions with a condition to exclude the management IAM role. Attach the SCP to the production OU.
Option B ensures the FullAWSAccess SCP is applied at the organization root, establishing baseline permissions that allow access to proceed. Option E creates a deny SCP specifically for IAM actions with an exception for the management IAM role, attached to the production OU. This combination denies all users from managing IAM roles except the designated management role, and this restriction applies only to the production OU (not development), satisfying the requirement that only the specific role can manage IAM in production environments.
Why the other options are wrong
- A. Attaching a deny SCP at the organization root would block the management role globally across all OUs, not just production, preventing it from functioning in development.
- C. Creating an allow SCP at the development OU doesn't prevent IAM actions there and doesn't establish protections for production.
- D. Attaching the deny SCP to the workload OU (parent of both development and production) would restrict IAM management in development as well, violating the requirement to only restrict production.
Question 108
A company manually provisions IAM access for its employees. The company wants to replace the manual process with an automated process. The company has an existing Active Directory system configured with an external SAML 2.0 identity provider (IdP). The company wants employees to use their existing corporate credentials to access AWS. The groups from the existing Active Directory system must be available for permission management in AWS Identity and Access Management (IAM). A DevOps engineer has completed the initial configuration of AWS IAM Identity Center (AWS Single Sign-On) in the company’s AWS account. What should the DevOps engineer do next to meet the requirements?
Show answer and explanation
Correct answer: A. Configure an external IdP as an identity source. Configure automatic provisioning of users and groups by using the SCIM protocol.
AWS IAM Identity Center integrates with external SAML 2.0 identity providers by configuring them as an identity source. To sync users and groups from an existing Active Directory with SAML 2.0, the DevOps engineer must enable automatic provisioning using the SCIM protocol, which is the standard for cross-platform user and group synchronization. This approach allows employees to use their corporate credentials and makes Active Directory groups available for permission management in IAM.
Why the other options are wrong
- B. AWS Directory Service is for managing AWS-based directories, not for integrating with external Active Directory systems, and SAML is not the protocol for provisioning.
- C. AD Connector is used for hybrid scenarios but does not support SCIM provisioning in Identity Center; it does not automatically sync groups for IAM permission management.
- D. While external IdP configuration is correct, SAML is not used for automatic provisioning; SCIM is the required protocol for user and group synchronization.
Question 109
A company uses AWS and has a VPC that contains critical compute infrastructure with predictable traffic patterns. The company has configured VPC flow logs that are published to a log group in Amazon CloudWatch Logs. The company's DevOps team needs to configure a monitoring solution for the VPC flow logs to identify anomalies in network traffic to the VPC over time. If the monitoring solution detects an anomaly, the company needs the ability to initiate a response to the anomaly. How should the DevOps team configure the monitoring solution to meet these requirements?
Show answer and explanation
Correct answer: B. Create an Amazon Kinesis Data Firehose delivery stream that delivers events to an Amazon S3 bucket. Subscribe the log group to the delivery stream. Configure Amazon Lookout for Metrics to monitor the data in the S3 bucket for anomalies. Create an AWS Lambda function to run in response to Lookout for Metrics anomaly findings. Configure the Lambda function to publish to the default Amazon EventBridge event bus.
Amazon Lookout for Metrics is specifically designed to detect anomalies in time-series data with predictable patterns, making it ideal for identifying abnormal network traffic. By using Kinesis Data Firehose to deliver VPC flow logs to S3, then configuring Lookout for Metrics to analyze the data for anomalies, and creating a Lambda function triggered by Lookout for Metrics findings to publish events to EventBridge, the company gains both anomaly detection and automated response capabilities.
Why the other options are wrong
- A. Kinesis Data Analytics requires custom SQL or Flink queries to detect anomalies and does not provide built-in machine learning-based anomaly detection like Lookout for Metrics.
- C. A Lambda function subscribed directly to CloudWatch Logs must implement its own anomaly detection logic, which is less efficient than using a purpose-built service like Lookout for Metrics.
- D. While Kinesis and Lambda can work together, this approach requires custom anomaly detection implementation rather than leveraging Lookout for Metrics' machine learning capabilities designed for this use case.
Question 110
A DevOps engineer needs to configure a blue/green deployment for an existing three-tier application. The application runs on Amazon EC2 instances and uses an Amazon RDS database. The EC2 instances run behind an Application Load Balancer (ALB) and are in an Auto Scaling group. The DevOps engineer has created a launch template and an Auto Scaling group for the blue environment. The DevOps engineer also has created a launch template and an Auto Scaling group for the green environment. Each Auto Scaling group deploys to a matching blue or green target group. The target group also specifies which software, blue or green, gets loaded on the EC2 instances. The ALB can be configured to send traffic to the blue environment’s target group or the green environment’s target group. An Amazon Route 53 record for www.example.com points to the ALB. The deployment must move traffic all at once between the software on the blue environment’s EC2 instances to the newly deployed software on the green environment’s EC2 instances. What should the DevOps engineer do to meet these requirements?
Show answer and explanation
Correct answer: A. Start a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment’s EC2 instances. When the rolling restart is complete, use an AWS CLI command to update the ALB to send traffic to the green environment’s target group.
The correct sequence ensures the green environment is fully deployed and healthy before traffic switches to it. Starting the rolling restart deploys new software to green instances while the blue environment continues serving traffic. Once the restart completes successfully, the ALB is switched to route traffic to the green target group in a single atomic operation. This meets the requirement of moving all traffic at once from blue to green.
Why the other options are wrong
- B. Switching traffic before the green environment is fully deployed causes traffic to be routed to instances still undergoing configuration, risking service disruption.
- C. Modifying the blue launch template mixes the deployment approach and loses the ability to quickly rollback to the previous blue software version.
- D. Updating Route 53 DNS records adds unnecessary complexity and does not align with the existing ALB-based architecture described in the scenario.
Question 111
A company is storing 100 GB of log data in .csv format in an Amazon S3 bucket. SQL developers want to query this data and generate graphs to visualize it. The SQL developers also need an efficient, automated way to store metadata from the .csv file. Which combination of steps will meet these requirements with the LEAST amount of effort? (Choose three.)
Show answer and explanation
Correct answer: B, C, E. Filter the data through Amazon QuickSight to visualize the data; Query the data with Amazon Athena; Use the AWS Glue Data Catalog as the persistent metadata store.
Amazon Athena enables SQL queries directly against CSV data stored in S3 without data movement or infrastructure setup. QuickSight provides visualization and graph generation of query results. AWS Glue Data Catalog automatically discovers and stores metadata from CSV files, enabling efficient metadata management without manual effort. This combination requires minimal setup and leverages serverless services designed for these specific tasks.
Why the other options are wrong
- A. X-Ray is designed for tracing microservice requests and application performance, not for querying and visualizing CSV log data.
- D. Redshift requires data loading and more operational overhead than Athena for ad-hoc querying of log data.
- F. DynamoDB is not a metadata store; Glue Data Catalog is purpose-built for capturing and managing technical metadata from data sources.
Question 112
A development team uses AWS CodeCommit, AWS CodePipeline, and AWS CodeBuild to develop and deploy an application. Changes to the code are submitted by pull requests. The development team reviews and merges the pull requests, and then the pipeline builds and tests the application. Over time, the number of pull requests has increased. The pipeline is frequently blocked because of failing tests. To prevent this blockage, the development team wants to run the unit and integration tests on each pull request before it is merged. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit Create a CodeBuild project to run the unit and integration tests. Configure the CodeBuild project as a target of the EventBridge rule that includes a custom event payload with the CodeCommit repository and branch information from the event.
Option B creates an EventBridge rule that triggers on pull request creation events from CodeCommit, invoking a CodeBuild project to run tests before merge. This prevents failing tests from blocking the pipeline by catching issues at the PR stage. Option A uses approval rules which require manual review, not automated testing. Option C unnecessarily modifies the pipeline. Option D uses notification rules which lack the integration depth needed for this automation.
Why the other options are wrong
- A. Approval rule templates require manual approval, not automated test execution before merge.
- C. This approach modifies the existing pipeline unnecessarily rather than running tests at the PR stage.
- D. Notification rules do not provide sufficient integration for automating test execution on pull requests.
Question 113
A company has a data ingestion application that runs across multiple AWS accounts. The accounts are in an organization in AWS Organizations. The company needs to monitor the application and consolidate access to the application. Currently, the company is running the application on Amazon EC2 instances from several Auto Scaling groups. The EC2 instances have no access to the internet because the data is sensitive. Engineers have deployed the necessary VPC endpoints. The EC2 instances run a custom AMI that is built specifically for the application. To maintain and troubleshoot the application, system administrators need the ability to log in to the EC2 instances. This access must be automated and controlled centrally. The company’s security team must receive a notification whenever the instances are accessed. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use EC2 Image Builder to rebuild the custom AMI. Include the most recent version of AWS Systems Manager Agent in the image. Configure the Auto Scaling group to attach the AmazonSSMManagedInstanceCore role to all the EC2 instances. Use Systems Manager Session Manager to log in to the instances. Enable logging of session details to Amazon S3. Create an S3 event notification for new file uploads to send a message to the security team through an Amazon Simple Notification Service (Amazon SNS) topic.
EC2 Image Builder rebuilds the custom AMI with the latest Systems Manager Agent, ensuring all instances have the agent pre-installed. Attaching the AmazonSSMManagedInstanceCore IAM role enables Systems Manager permissions without internet access through VPC endpoints. Systems Manager Session Manager provides centralized, audited access without bastion hosts or internet requirements. Session logging to S3 combined with SNS notifications satisfies the security team's audit and notification requirements.
Why the other options are wrong
- A. EC2 Instance Connect requires internet connectivity and does not provide centralized access control; cfn-init is a bootstrap tool unrelated to VPC routing needs.
- B. NAT gateway and bastion hosts add infrastructure complexity and create an external attack surface; the solution requires internet access contrary to the sensitive data requirement.
- D. AWS Config cannot attach SCPs (which are organization policies) and does not install software; this approach misuses AWS Config's purpose and incorrectly describes capability boundaries.
Question 114
A company recently migrated its legacy application from on-premises to AWS. The application is hosted on Amazon EC2 instances behind an Application Load Balancer, which is behind Amazon API Gateway. The company wants to ensure users experience minimal disruptions during any deployment of a new version of the application. The company also wants to ensure it can quickly roll back updates if there is an issue. Which solution will meet these requirements with MINIMAL changes to the application?
Show answer and explanation
Correct answer: A. Introduce changes as a separate environment parallel to the existing one. Configure API Gateway to use a canary release deployment to send a small subset of user traffic to the new environment.
Creating a separate parallel environment with API Gateway canary deployment allows a gradual rollout of changes to a subset of users, enabling verification before full deployment. This approach minimizes disruption and allows quick rollback if issues arise. Canary deployments are API Gateway's native feature for gradual traffic shifting, requiring minimal application changes and providing clear metrics for rollback decisions.
Why the other options are wrong
- B. Updating DNS alias records switches all traffic at once, which does not provide the gradual testing capability and increases rollback complexity.
- C. Routing new traffic to a target group via API Gateway without proper deployment strategy lacks the canary capability for gradual rollout and testing.
- D. Routing all traffic to the new target group immediately defeats the purpose of minimal disruption and does not allow for gradual validation before full cutover.
Question 115
An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wants the instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control. Which solution will accomplish this?
Show answer and explanation
Correct answer: D. In the CloudFormation template, add CloudFormation init metadata. Place the configuration file content in the metadata. Configure the cfn-init script to run when the instance is launched, and configure the cfn-hup script to poll for updates to the configuration.
CloudFormation init metadata stores configuration file content directly in the template alongside infrastructure definitions, satisfying the requirement to maintain both in source control. The cfn-init script retrieves and applies the configuration during instance launch, and cfn-hup continuously polls CloudFormation for metadata changes. When the template is updated in source control and the stack is updated, cfn-hup detects the new metadata and applies changes to all running instances with minimal delay.
Why the other options are wrong
- A. AWS Config rules are for compliance checking, not configuration file distribution; they cannot deploy files to instances.
- B. Launch template parameters cannot store full configuration file content effectively; launch templates are for immutable instance configuration, not for dynamic file management.
- C. Resource Data Sync is for Systems Manager inventory and patch management, not for polling CloudFormation template changes for configuration distribution.
That was 115 of 480.
The full AWS DOP-C02 pack has all 480 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 172 free as one PDF by email. Get the Half Pack →