Get Updated Amazon DOP-C02 Exam Questions

QUESTION 1

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, daily, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.

A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.

Which solution will meet these requirements?

A

Set up AWS Config in the account. Create a custom rule that returns a compliance failure for all Amazon EC2 resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.

B

Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.

C

Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly. Specify the runbook as the target of the rule.

D

Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume events or EBS ModifyVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly. Specify the runbook as the target of the rule.

Correct Option: B

✅ Option B (Correct) Reasoning: AWS Config with a managed rule for EC2::Volume continuously monitors compliance, identifying untagged EBS volumes. A custom AWS Systems Manager Automation runbook configured as a remediation action will automatically apply the Backup_Frequency tag with a value of weekly, ensuring all volumes are tagged as required.

❌ Why the other choices are incorrect:

Option A is incorrect: Using a custom Config rule for "all EC2 resources" is less precise than a managed rule specifically for EC2::Volume. While it could work, a managed rule is simpler and often preferred when available for specific resource types.
Options C and D are incorrect: CloudTrail/EventBridge are event-driven, reacting only to CreateVolume or ModifyVolume events. They won't continuously monitor for compliance across all existing volumes or detect if tags are removed later. AWS Config provides the necessary continuous audit and remediation for all volumes, regardless of creation/modification events.

QUESTION 2

A company has an organization in AWS Organizations. The organization has all features enabled and has AWS CloudTrail trusted access configured for the management account. An Amazon Simple Notification Service (Amazon SNS) topic is configured for notifications.

The company needs all AWS events in all AWS Regions in the organization to be recorded and retained in an audit account, The company needs near real-time notifications of any failed login attempts.

A DevOps engineer has created an organization trail in the management account to log events for all Regions,

Which solution will meet these requirements with the LEAST operational effort?

A

Configure the trail to publish logs to a new Amazon S3 bucket in the audit account. In the audit account, create an Amazon EventBridge rule that reacts to failed login events in CloudTrail. Configure the EventBridge rule to notify the SNS topic.

B

Configure the trail to publish logs to a new Amazon S3 bucket in the management account. Configure an Amazon Athena table to read from the new S3 bucket. Create an AWS Lambda function that queries the Athena table for failed login events and publishes the findings to the SNS topic. Create an Amazon EventBridge scheduled rule to invoke the Lambda function every 5 minutes.

C

Configure the trail to publish logs to a new Amazon S3 bucket in the audit account and a new Amazon CloudWatch log group in the management account. Create a CloudWatch Logs metric filter on the log group to create a custom metric for failed logins. Configure a CloudWatch alarm that uses the custom metric and notifies the SNS topic.

D

Configure the trail to publish logs to a new Amazon CloudWatch log group in the audit account. Create an Amazon Kinesis data stream in the audit account. Configure a subscription filter on the log group to send the logs to the data stream. Use Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) to filter the data stream for failed logins. Publish the results to the SNS topic.

Correct Option: A

✅ Option A (Correct) Reasoning: An organization trail publishing to an audit account S3 bucket meets the logging requirement. EventBridge natively integrates with CloudTrail for near real-time event filtering (like failed logins) and direct notification to an SNS topic, providing the least operational effort for real-time alerts.

❌ Why the other choices are incorrect:

Option B is incorrect: Polling Athena with Lambda is not real-time, introduces significant operational overhead (Athena table, Lambda function, scheduled rule), and is less efficient than EventBridge's native event-driven capabilities.
Option C is incorrect: Publishing logs to a CloudWatch log group in the management account contradicts the requirement to retain logs in the audit account. While metric filters and alarms can work, EventBridge is more direct for CloudTrail events.
Option D is incorrect: Kinesis Data Stream and Amazon Managed Service for Apache Flink add significant complexity and operational overhead for simply filtering CloudTrail events. EventBridge offers a much simpler, serverless approach for this specific notification.

QUESTION 3

A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint.

The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window.

What should a DevOps engineer do to meet these requirements?

A

Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster's reader endpoint for reads.

B

Add a reader instance to the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the application to use the Aurora cluster's custom ANY endpoint for read and write operations.

C

Turn on the Multi-AZ option on the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster’s reader endpoint for reads.

D

Turn on the Multi-AZ option on the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the application to use the Aurora cluster's custom ANY endpoint for read and write operations.

Correct Option: B

✅
Option B: Add a reader instance to the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the application to use the Aurora cluster's custom ANY endpoint for read and write operations.
Reasoning: Adding a reader instance allows for failover. A custom ANY endpoint intelligently routes both read and write traffic to any available instance. During primary instance maintenance, a reader is promoted, and the ANY endpoint ensures continuous operation with minimal application interruption.

QUESTION 4

A company used a lift and shift to migrate a workload to AWS. The company has an Auto Scaling group of Amazon EC2 instances. Each EC2 instance runs a web application, a database, and a Redis cache.

Users are experiencing large variations in the web application's response times. Requests to the web application go to a single EC2 instance that is under significant load. The company wants to separate the application components to improve availability and performance.

Which solution will meet these requirements?

A

Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Application Load Balancer and an Auto Scaling group for the Redis cache.

B

Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create a Network Load Balancer and an Auto Scaling group in a single Availability Zone for the Redis cache.

C

Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Amazon ElastiCache for Redis cluster for the cache. Create a target group that has a DNS target type that contains the ElastjCache for Redis cluster hostname.

D

Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create an Amazon ElastiCache for Redis cluster for the cache.

Correct Option: D

✅ Option D (Correct) Reasoning: This solution correctly separates the components. An ALB with an ASG provides scalable and highly available web application frontend. Aurora Multi-AZ delivers a resilient, high-performance database. ElastiCache for Redis creates a fully managed, highly available, and performant cache, addressing all stated requirements for improved availability and performance.

❌ Why the other choices are incorrect:

Option A is incorrect: Using an NLB for a web application is less suitable than an ALB, which offers Layer 7 features. Putting an ALB in front of a Redis cache is an incorrect architectural pattern; applications connect directly to the ElastiCache endpoint.
Option B is incorrect: Deploying the Redis cache in a single Availability Zone compromises availability, directly contradicting the requirement to improve availability.
Option C is incorrect: An NLB for a web application lacks the Layer 7 features beneficial for HTTP traffic. While ElastiCache for Redis is correct, the proposed integration with a target group/DNS target type for Redis is an unusual and generally unnecessary pattern, as applications typically connect directly to the ElastiCache endpoint.

QUESTION 5

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.

The company has created an AWS Key Management Service (AWS KMS) key in the source account.

Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

A

In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.

B

In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the default Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action.

C

In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.

D

In the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.

E

In the source account, share the unencrypted AMI with the target account.

F

In the source account, share the encrypted AMI with the target account.

Correct Option: A,D,F

✅ Option A (Correct) Reasoning: The initial AMI is unencrypted, but the requirement is to encrypt all shared AMIs. Copying the unencrypted AMI to an encrypted version using the specified KMS key in the source account is the necessary first step to meet the encryption mandate.

✅ Option D (Correct) Reasoning: For cross-account KMS key usage, the source key policy must permit the target account to create grants. This allows the target account to then create a grant for its Auto Scaling group service-linked role, enabling instance launch while maintaining proper access control.

✅ Option F (Correct) Reasoning: After the AMI is encrypted (as per step A), it must be explicitly shared with the target account to make it available for use by the Auto Scaling group. Sharing the encrypted AMI is crucial to satisfy the security requirement.

❌ Why the other choices are incorrect:

Option B is incorrect: The problem states the company created and will use "an AWS Key Management Service (AWS KMS) key in the source account," not the default Amazon EBS encryption key.
Option C is incorrect: Creating a KMS grant for a service-linked role in another account directly from the source account is not the standard or secure cross-account KMS sharing mechanism. It typically requires an intermediary step via the key policy.
Option E is incorrect: This violates the core requirement to "encrypt all AMIs that the company shares across accounts." The AMI must be encrypted before sharing.

QUESTION 6

A company uses AWS CodePipeline pipelines to automate releases of its application. A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines.

The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.

Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)

A

Create a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the EC2 instances to allow access to CodeDeploy.

B

Create a new version of the common AMI with the CodeDeploy agent installed. Create an AppSpec file that contains application deployment scripts and grants access to CodeDeploy.

C

Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Add a step to the CodePipeline pipeline to use EC2 Image Builder to create a new AMI. Configure CodeDeploy to deploy the newly created AMI.

D

Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.

E

Create an application in CodeDeploy. Configure an in-place deployment type. Specify the EC2 instances that are launched from the common AMI as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.

Correct Option: A,D

✅ Option A (Correct) Reasoning: The CodeDeploy agent must be installed on target EC2 instances for deployments to occur; baking it into the common AMI ensures all ASG instances have it. The EC2 instance IAM role requires permissions to interact with CodeDeploy and retrieve application revisions (e.g., from S3). These are foundational prerequisites.

✅ Option D (Correct) Reasoning: A CodeDeploy application is the top-level container. "In-place" deployment is appropriate for updating an RPM package on existing EC2 instances. Specifying the Auto Scaling Group as the target robustly manages deployments across the fleet. The CodePipeline must be updated to use the CodeDeploy action.

❌ Why the other choices are incorrect:

Option B is incorrect: While the CodeDeploy agent and AppSpec file are needed, the AppSpec file defines deployment hooks and file locations, it does not "grant access to CodeDeploy"; that's handled by IAM roles.
Option C is incorrect: This describes deploying new AMIs, often for immutable infrastructure or blue/green, not deploying an RPM package "in-place" to existing instances using CodeDeploy. CodeDeploy's "in-place" type updates the application on existing servers.
Option E is incorrect: Targeting individual EC2 instances is less robust than targeting the Auto Scaling group. CodeDeploy's integration with ASGs ensures that all instances in the group, including newly launched ones, are correctly managed within the deployment.

QUESTION 7

A company uses an Amazon Aurora PostgreSQL global database that has two secondary AWS Regions. A DevOps engineer has configured the database parameter group to guarantee an RPO of 60 seconds. Write operations on the primary cluster are occasionally blocked because of the RPO setting.

The DevOps engineer needs to reduce the frequency of blocked write operations,

Which solution will meet these requirements?

A

Add an additional secondary cluster to the global database.

B

Enable write forwarding for the global database.

C

Remove one of the secondary clusters from the global database.

D

Configure synchronous replication for the global database.

Correct Option: B

✅ Option B (Correct) Reasoning: Enabling write forwarding allows applications in secondary regions to issue write operations locally, which are then asynchronously forwarded to the primary. This can optimize the write path, reduce direct cross-region application traffic to the primary, and potentially stabilize the primary's write and replication workload. A more stable primary workload can help it better maintain replication lag within the RPO, thereby reducing the frequency of RPO-induced write blocks.

❌ Why the other choices are incorrect:

Option A is incorrect: Adding more secondary clusters increases the number of replication targets, potentially increasing the burden on the primary and making it harder to meet the RPO, thus likely increasing write blocks.
Option C is incorrect: While removing a secondary cluster might reduce the overall replication load and help meet RPO, it compromises disaster recovery capabilities. The question seeks to reduce blocks, implying a solution that doesn't reduce resilience if possible.
Option D is incorrect: Aurora Global Database uses asynchronous replication for cross-region communication. Synchronous replication is not a supported feature for Aurora Global Database and would introduce significant latency, worsening write blocking.

QUESTION 8

A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.

Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)

A

Delegate AWS Firewall Manager to a security account.

B

Delegate Amazon GuardDuty to a security account.

C

Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.

D

Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.

E

Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.

Correct Option: A,C

✅ Option A (Correct) Reasoning: Delegating AWS Firewall Manager to a security account establishes a centralized administration point. This is crucial for managing WAF policies across "hundreds of AWS accounts" within an organization, enabling consistent security enforcement without requiring access to individual member accounts.

✅ Option C (Correct) Reasoning: An AWS Firewall Manager policy can automatically deploy and attach AWS WAF web ACLs to resources like ALBs and API Gateway APIs across all accounts in an organization. This prevents "future violations" by ensuring newly created resources are compliant from inception, and can also remediate existing non-compliant resources.

❌ Why the other choices are incorrect:

Option B is incorrect: Amazon GuardDuty is a threat detection service. Delegating it to a security account is good practice but does not prevent missing WAF associations or attach WAFs to resources.
Option D is incorrect: Amazon GuardDuty's function is threat detection, not creating, managing, or attaching AWS WAF web ACLs to services like ALBs or API Gateway APIs.
Option E is incorrect: AWS Config managed rules detect non-compliance but do not automatically attach WAF web ACLs. While they can identify violations, they require additional remediation mechanisms. AWS Firewall Manager is purpose-built for this enforcement.

QUESTION 9

A company has deployed an application in a production VPC in a single AWS account. The application is popular and is experiencing heavy usage, The company’s security team wants to add additional security, such as AWS WAF. to the application deployment However. the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary.

The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of

the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional

security. The DevOps engineer creates a VPC flow log for the production VPC,

Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost-effectively?

A

Create a bog group in Amazon CloudWatch Logs. Configure the VPC flow log to capture accepted traffic and to send the data to the log group- Create an Amazon CloudWatch metric filter for IP addresses on the deny list- Create a CloudWatch alarm with the metric filter as input- Set the period to 5 minutes and the datapoints to alarm to I- Use an Amazon Simple Notification Service (Amazon SNS) topic to send alarm notices to the security team.

B

Create an Amazon S3 bucket for log files. Configure the VPC flow log to capture all traffic and to send the data to the S3 bucket. Configure Amazon Athena to return all log files in the S3 bucket for IP addresses on the deny list. Configure Amazon QuickSight to accept data from Athena and to publish the data as a dashboard that the security team can access. Create a threshold alert of 1 for successful access. Configure the alert to automatically notify the security team as frequently as possible when the alert threshold is met.

C

Create an Amazon S3 bucket for bog files. Configure the VPC flow log to capture accepted traffic and to send the data to the S3 bucket, Configure an Amazon OpenSearch Service cluster and domain for the log files, Create an AWS Lambda function to retrieve the logs from the S3 bucket, format the logs, and load the logs into the OpenSearch Service cluster Schedule the Lambda function to run every 5 minutes. Configure an alert and condition in OpenSearch Service to send alerts to the security team through an Amazon Simple Notification Service (Amazon SNS) topicwhen access from the IP addresses on the deny list is detected.

D

Create a log group in Amazon CloudWatch Logs, Create an Amazon S3 bucket to hold query results. Configure the VPC flow bog to capture all traffic and to send the data to the log group. Deploy an Amazon Athena CloudWatch connector in AWS Lambda. Connect the connector to the log group, Configure Athena to periodically query for all accepted traffic from the IP addresses on the deny list and to store the results in the S3 bucket. Configure an S3 event notification to automatically notify the security team through an Amazon Simple Notification Service (Amazon SNS) topic when new Objects are added to the S3 bucket.

Correct Option: A

✅ Option A (Correct) Reasoning: This approach uses CloudWatch Logs, Metric Filters, and Alarms, which are native, highly integrated, and cost-effective for near real-time log analysis and notification. Capturing "accepted" traffic is sufficient, and the 5-minute period/1 datapoint alarm meets the near real-time requirement efficiently.

❌ Why the other choices are incorrect:

Option B is incorrect: Using Athena and QuickSight for near real-time alerts is overly complex and less cost-effective. Athena is query-on-demand, incurring costs per query, and QuickSight adds significant BI tool overhead not needed for a simple alert.
Option C is incorrect: Deploying an OpenSearch Service cluster is expensive and operationally complex for this specific, simple alerting need. The S3-Lambda-OpenSearch pipeline is overkill compared to CloudWatch's direct capabilities.
Option D is incorrect: While using CloudWatch Logs, this option introduces an Athena CloudWatch connector via Lambda and periodic Athena queries. This adds complexity and cost for continuous monitoring, making it less cost-effective than direct CloudWatch Metric Filters and Alarms.

QUESTION 10

A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.

How can this issue be in the MOST secure manner?

A

Add the bucket name to the AllowedBuckets section of the CodeBuild project settings. Update the build spec to use the AWS CLI to download the database population script.

B

Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the build spec to use cURL to pass the token and download the database population script.

C

Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script.

D

Remove unauthenticated access from the S3 bucket with a bucket policy. Use the AWS CLI to download the database population script using an IAM access key and a secret access key.

Correct Option: C

✅ Option C (Correct) Reasoning: Removing unauthenticated access with a bucket policy directly resolves the security issue. Granting CodeBuild's service role S3 access via IAM is the secure, recommended method for AWS service-to-service communication. Using AWS CLI then automatically authenticates with this role.

❌ Why the other choices are incorrect:

Option A is incorrect: AllowedBuckets is for output artifacts, not input. It doesn't secure the download if the bucket remains unauthenticated, nor does it provide the necessary authentication/authorization.
Option B is incorrect: S3 does not support "HTTPS basic authentication" with a custom token. This approach attempts to implement a non-standard and less secure authentication mechanism outside of AWS's native IAM.
Option D is incorrect: While removing unauthenticated access is correct, using hardcoded IAM access keys and secret access keys directly in CodeBuild is an anti-pattern and a major security risk. IAM roles are the secure alternative.

QUESTION 11

A company wants to use AWS development tools to replace its current bash deployment saipts- The company currently deploys a LAMP application to a group of Amazon EC2 instances behind an Application Load Balancer (ALB). During the deployments. The company unit tests the committed application, stops and starts services. unregisters and reregisters instances with the load balancer, and updates file permissions. The company wants to maintain the samo deployment functionality through tho shift to using AWS services.

Which solution will meet these requirements?

A

Use AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services, and deregister and register instances with the ALB- Use the appspec,yml file to update file permissions without a custom script.

B

Use AWS CodePipeIine to move the application from the AWS CodeCommit repository to AWS CodeDepIoy. Use CodeDepIoy's deployment group to test the application, unregister and re.register instances with the ALB, and restart services. Use the appspec.yml file to update file permissions without a custom script

C

Use AWS CodePrpeIine to move the application source code from the AWS CodeCommit repository to AWS CodeDepIoy Use CodeDepIoy to test the application. Use CodeDepIoy's appspec-yml file to restart services and update permissions without a custom script Use AWS CodeBuiId to unregister and re-register instances with the ALB.

D

Use AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspoc.yml file to restart services. Unregister and re-register the instances in the AWS CodeOeploy deployment group with the ALB, Update the appspec.yml file to update file permissions without a custom script.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 12

An ecommerce company is receiving reports that its order history page is experiencing delays in reflecting the processing status of orders. The order processing system consists of an AWS Lambda function that uses reserved concurrency. The Lambda function processes order messages from an Amazon Simple Queue Service (Amazon SQS) queue and inserts processed orders into an Amazon DynamoDB table. The DynamoDB table has auto scaling enabled for read and write capacity.

Which actions should a DevOps engineer take to resolve this delay? (Choose two.)

A

Check the ApproximateAgeOfOldestMessage metric for the SQS queue. Increase the Lambda function concurrency limit.

B

Check the ApproximateAgeOfOldestMessage metnc for the SQS queue Configure a redrive policy on the SQS queue.

C

Check the NumberOfMessagesSent metric for the SQS queue. Increase the SQS queue visibility timeout.

D

Check the WriteThrottleEvents metric for the DynamoDB table. Increase the maximum write capacity units (WCUs) for the table's scaling policy.

E

Check the Throttles metric for the Lambda function. Increase the Lambda function timeout.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 13

A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health. The DevOps engineer must implement an automated solution that uses Amazon EvontBridge to remediate tho notifications during the company’s scheduled maintenance windows.

How should the DevOps engineer configure an Eventbridge rule to meet these requirements?

A

Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target the AWS-RestartEC21nstance Systems Manager Automation runbook to restart the EC2 instances.

B

Configure an event source of Systems Manager. Configure an event type that indicates a maintenance window. Target the AWS-RestartEC21nstance Systems Manager Automation runbook to restart the EC2 instances.

C

Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target a newly created AWS Lambda function that registers a systems Manager maintenance window task to restart the EC2 instances.

D

Configure an event source of EC2. Configure an event type that indicates instance state notification. Target a newly AWS Lambda function that registers a systems Manager maintenance window task to restart the EC2 instances.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 14

A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. New EC2 instances are launched and terminated each hour in the account. The account also includes existing EC2 instances that have been running for longer than a week.

The company's security policy requires all running EC2 instances to use an EC2 instance profile. If an EC2 instance does not have an instance profile attached, the EC2 instance must use a default instance profile that has no IAM permissions assigned.

A DevOps engineer reviews the account and discovers EC2 instances that are running without an instance profile. During the review, the DevOps engineer also observes that new EC2 instances are being launched without an instance profile.

Which solution will ensure that an instance profile is attached to all existing and future EC2 instances in the Region?

A

Configure an Amazon EventBridge rule that reacts to EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function to attach the default instance profile to the EC2 instances.

B

Configure the ec2-instance-profile-attached AWS Config managed rule with a trigger type of configuration changes. Configure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.

C

Configure an Amazon EventBridge rule that reacts to EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.

D

Configure the iam-role-managed-policy-check AWS Config managed rule with a trigger type of configuration changes. Configure an automatic remediation action that invokes an AWS Lambda function to attach the default instance profile to the EC2 instances.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 15

A DevOps engineer uses AWS CodeBuild to frequently produce software packages. The CodeBuild project builds large Docker images that the DevOps can use across multiple builds. The DevOps engineer wants to improve build performance and minimize costs.

Which solution will moot those requirements?

A

Store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. a local Docker layer cache for CodeBuiId.

B

Cache the Docker images in an Amazon S3 bucket that iS available across multiword build hosts. Expire the cache by using an SJ Litecycao policy.

C

Store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Modify the CodeBuiId project runtime configuration to aways of the most recent image version-

D

Create custom AMIS that contain the cached Docker images, In the Code8uild build, launch Amazon EC2 instances from the custom AMIS,

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 16

A development team is using AWS CodeCommit to version control application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote main branch as the trigger for the pipeline to integrate code changes. A developer has pushed code changes to the CodeCommit repository, but noticed that the pipeline had no reaction, even after 10 minutes.

Which of the following actions should be taken to troubleshoot this issue?

A

Check that an Amazon EventBridge rule has been created for the main branch to trigger the pipeline.

B

Check that the CodePipeline service role has permission to access the CodeCommit repository.

C

Check that the developer’s IAM role has permission to push to the CodeCommit repository.

D

Check to see if the pipeline failed to start because of CodeCommit errors in Amazon CloudWatch Logs.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 17

A DevOps engineer at a company is supporting an AWS environment in which all users use AWS IAM Identity Center. The company wants to immediately disable credentials of any new IAM user and wants the security team to receive a notification.

Which combination of steps should the DevOps engineer take to meet these requirements? (Select THREE, )

A

Create an Amazon Eventbridge rule that reacts to an IAM Create user API call in AWS CloudTrail.

B

Create an Amazon EventBridge rube bat reacts to an IAM GetLoginProfiIe API call in AWS CloudTrail.

C

Create an AWS Lambda function that is a target ot ttw EventBridge rule- Configure the Lambda function to disable any access keys and delete the login profiles that are associated with the IAM user.

D

Create an AWS Lambda function that is a target of the EventBridge rule- Configure the Lambda function to delete the Egin profiles that are associated with the IAM User.

E

Create an Amazon Since Notification Service (Amazon SNS) topic that is a target of the EventBridge rule. Subscribe to the security team's group email address to the topic.

F

Create an Amazon Simple Queue Service (Amazon SOS) queue tiat is a target of the Lambda function. Subscribe to the security team's group email address to the queue.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 18

A company uses AWS Organizations and AWS Control Tower to manage all the company's AWS accounts. The company uses the Enterprise Support plan.

A DevOps engineer is using Account Factory for Terraform (AFT) to provision new accounts. When new accounts are provisioned, the DevOps engineer notices that the support plan for the new accounts is set to the Basic Support plan. The DevOps engineer needs to implement a solution to provision the new accounts with the Enterprise Support plan.

Which solution will meet these requirements?

A

Use an AWS Config conformance pack to deploy the account-part-of-organizations AWS Config rule and to automatically remediate any noncompliant accounts.

B

Create an AWS Lambda function to create a ticket for AWS Support to add the account to the Enterprise Support plan. Grant the Lambda function the support:ResolveCase permission.

C

Add an additional value to the control_tower_parameters input to set the AWSEnterpriseSupport parameter as the organization's management account number.

D

Set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration. Redeploy AFT and apply the changes.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 19

A company has an application that stores data that includes personally identifiable information (PII) in an Amazon S3 bucket, all data encrypted with AWS Key Management Service (AWS KMS) customer managed keys All AWS resources are deployed from an AWS CloudFormation template. A DevOps engineer needs to set up a development environment for the application in a different AWS account.

The data in the development environment's S3 bucket needs to be updated once a week from the production environments S3 bucket the company must not move PII Trom the production environment workout anonymizing the PII first. The data in each environment must be encrypted with different KMS custom« managed keys.

Which combination of steps should the DevOps engineer take to meet these requirements? (Select TWO.)

A

Activate Amazon Macie on the S3 bucket in the production Create an AWS Step Functions state machine to initiate a discovery job and redact all PII before copying files to the S3 bucket in the development account. Give state machine tasks decrypt permissions on the KMS key in the production account Give the state machine tasks encrypt permissions on the KMS key in the development account.

B

Set up S3 replication between the production SO bucket and the development S3 bucket. Activate Amazon Macie on the development S3 bucket Create an AWS Step Functions state machine IO mitigate a discovery job and redact all PII as the fries are copied to the development S3 bucket. Give the state machine tasks encrypt and decrypt permissions on the KMS key in the development account.

C

Set up an S3 Batch Operations job to copy files from the production S3 bucket to th9 development S3 bucket. In the development account. configure an AWS Lambda function tc redact all PIL Configure S3 Object Lambda to use the Lambda function for S3 GET requests. Give the Lambda function's IAM role encrypt and decrypt permissions tho KMS key in the development account.

D

Create a development environment from the CloudFormation template in the development account- Schedule an Amazon EventBridge rule to start the AWS Step Functions state machine once a

E

Create a development environment from the Cloud Formation template in the development account Schedule a corn job on an Amazon EC2 instance to run once a week to start the S3 Batch Operations job.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 20

A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks during maintenance windows. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health. The DevOps engineer needs to implement an automated solution to remediate these notifications. The DevOps engineer creates an Amazon EventBridge rule.

How should the DevOps engineer configure the EventBridge rule to meet these requirements?

A

Configure an event source of AWS Health, a service of EC2. and an event type that indicates instance maintenance. Target a Systems Manager document to restart the EC2 instance.

B

Configure an event source of Systems Manager and an event type that indicates a maintenance window. Target a Systems Manager document to restart the EC2 instance.

C

Configure an event source of AWS Health, a service of EC2, and an event type that indicates instance maintenance. Target a newly created AWS Lambda function that registers an automation task to restart the EC2 instance during a maintenance window.

D

Configure an event source of EC2 and an event type that indicates instance maintenance. Target a newly created AWS Lambda function that registers an automation task to restart the EC2 instance during a maintenance window.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 21

A company's DevOps engineer is working in a multi-account environment. The company uses AWS Transit Gateway to route all outbound traffic through a network operations account. In the network operations account, all account traffic passes through a firewall appliance for inspection before the traffic goes to an internet gateway. The firewall appliance sends logs to Amazon CloudWatch Logs and includes event severities of CRITICAL, HIGH, MEDIUM, LOW. and INFO. The security team wants to receive an alert if any CRITICAL events occur

What should the DevOps engineer do to meet these requirements?

A

Create an Amazon CloudWatch Synthetics canary to monitor the firewall state, If the firewall reaches a CRITICAL state or logs a CRITICAL event, use a CloudWatch alarm to publish a ratification to an Amazon Simple Notification Service (Amazon SNS) topic, Subscribe the security team's email address to the topic

B

Create an Amazon CloudWatch metric tilter by issuing a search for CRITICAL events. Publish a (ÄJson metric for the towing_ Use a Ck1udWatch alarm based on tho custom metric to publish a Notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email address to tho topic

C

Enable Amazon Guard Duty in the network operations account Configure GuardDuty to monitoc flow logs Croato an Amazon EventBridge event rule that is invoked by GuardDuty events that are CRITICAL. Define an Amazon Simple Notification Service (Amazon SNS) topic as a target. Subscribe the security team's email address to the topic.

D

Use AWS Firewall Manager to apply consistent policies across all accounts. Create an Amazon EventBridge event rule that is invoked by Firewall Manager events that are CRITICAL. Define anAmazon Simple Notification Service (Amazon SNS) topic as a target. Subscribe to the security team's email address to the topic.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 22

A company has an AWS CodePipeline pipeline that is configured with an Amazon S3 bucket in the eu-west-1 Region. The pipeline deploys an AWS Lambda application to the same Region. The pipeline consists of an AWS CodeBuild project build action and an AWS CloudFormation deploy action.

The CodeBuild project uses the aws cloudformation package AWS CLI command to build an artifact that contains the Lambda function code’s .zip file and the CloudFormation template. The CloudFormation deploy action references the CloudFormation template from the output artifact of the CodeBuild project’s build action.

The company wants to also deploy the Lambda application to the us-east-1 Region by using the pipeline in eu-west-1. A DevOps engineer has already updated the CodeBuild project to use the aws cloudformation package command to produce an additional output artifact for us-east-1.

Which combination of additional steps should the DevOps engineer take to meet these requirements? (Choose two.)

A

Modify the CloudFormation template to include a parameter for the Lambda function code’s zip file location. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to pass in the us-east-1 artifact location as a parameter override.

B

Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 output artifact.

C

Create an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have read and write access.

D

Create an S3 bucket in us-east-1. Configure S3 Cross-Region Replication (CRR) from the S3 bucket in eu-west-1 to the S3 bucket in us-east-1.

E

Modify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 output artifact.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 23

A DevOps engineer uses a pipeline in AWS CodePipeline. The pipeline has a build action and a deploy action for a single-page web application that is delivered to an Amazon S3 bucket. Amazon CloudFront serves the web application- The build action creates an artifact for the web application.

The DevOps engineer has created an AWS CloudFormation template that defines the S3 bucket and configures the S3 bucket to host the application. The DevOps engineer has configured a CloudFormation deploy action before the S3 action. The CloudFormation deploy action creates the S3 bucket. The DevOps engineer needs to configure the S3 deploy action to use the S3 bucket from the CloudFormation template.

Which combination of steps will meet these requirements? (Select TWO.)

A

Add an output named BucketName to the CloudFormation template. Set the output's value to refer to the 53 bucket from the CloudFormation template. Configure the output value to export to an re90urce named StackVariables,

B

Add an output named Buckemame to the CloudFormation template. Set the outputs value to refer to the S3 bucket from the CloudFormation template- Set theCloudFormation action's namespace to StackVariables in the pipeline.

C

Configure the output artifacts of the CloudFormation action in the pipeline to be an AWS Systems Manager Parameter Store parameter named StackVariables. Name the artifact BucketName,

D

Configure the build artifact from the build action as the input to the CodePipeline S3 deploy action. Configure the deploy action to deploy to the S3 bucket by the StackVariables. BucketName variable.

E

Configure the build artifact from the build action and the AWS Systems Manager parameter as the inputs to the deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable,

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 24

A company hosts a security auditing application in an AWS account. The auditing application uses an IAM role to access other AWS accounts. All the accounts are in the same organization in AWS Organizations.

A recent security audit revealed that users in the audited AWS accounts could modify or delete the auditing application's IAM role. The company needs to prevent any modification to the auditing application's IAM role by any entity other than a trusted administrator IAM role.

Which solution will meet these requirements?

A

Create an SCP that includes a Deny statement for changes to the auditing application's IAM role. Include a condition that allows the trusted administrator IAM role to make changes. Attach the SCP to the root of the organization.

B

Create an SCP that includes an Allow statement for changes to the auditing application's IAM role by the trusted administrator IAM role. Include a Deny statement for changes by all other IAM principals. Attach the SCP to the IAM service in each AWS account where the auditing application has an IAM role.

C

Create an IAM permissions boundary that includes a Deny statement for changes to the auditing application's IAM role. Include a condition that allows the trusted administrator IAM role to make changes. Attach the permissions boundary to the audited AWS accounts.

D

Create an IAM permissions boundary that includes a Deny statement for changes to the auditing application’s IAM role. Include a condition that allows the trusted administrator IAM role to make changes. Attach the permissions boundary to the auditing application's IAM role in the AWS accounts.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 25

A company's DevOps team uses Node Package Manager (NPM) open source libraries to build applications. The DevOps team runs its application build process in an AWS CodeBuild project that downloads the NPM libraries from public NPM repositor.

The company wants 00 host the NPM libraries in private NPM repositories, The company also needs to be able to run checks on new versions of the libraries before the DevOps team uses the libraries.

Which solution will meet these requirements with the LEAST operational effort?

A

Create an AWS CodeArtjfact repository with an upstream repository named npm-store. Configure the application build process to use the CodeArtjfact repository as the default source for NPM. Create an AWS CodePipeline pipeline to perform the required checks on package versions in the CodeArtifact repository Set the package status tounlisted if a failure occurs.

B

Enable Amazon S3 caching in the CodeBuild project configuration. Add a step in the buildspec.yaml config file to perform the required checks on the package versions in the cache,

C

Create an AWS CodeCommit repository for each library. Clone the required NPM libraries to the appropriate CodeCommit repository. Modify the CodeBuild appspec.yaml config file to use the private CodeCommit repositories. Add a step to perform the required checks on the package versions,

D

Create an AWS CodeCommit repository for each library. Clone the required NPM libraries to the appropriate CodeCommit repository. Modify the CodeBuild buildspec.yaml config file so that NPM uses the private CodeCommit repositories. Add an AWS CodePipeline pipeline that performs the required checks on the package versions for eachnew commit to the repositories, Configure the pipeline to revert to the most recent commit in the event of a failure.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 26

A company has an on-premises application that is written in Go. A DevOps engineer must move the application to AWS. The company's development team wants to enable blue/green deployments and perform A/B testing.

Which solution will meet these requirements?

A

Deploy the application on an Amazon EC2 instance, and create an AMI of the instance. Use the AMI to create an automatic scaling launch configuration that is used in an Auto Scaling group. Use Elastic Load Balancing to distribute traffic. When changes are made to the application, a new AMI will be created, which will initiate an EC2 instance refresh.

B

Use Amazon Lightsail to deploy the application. Store the application in a zipped format in an Amazon S3 bucket. Use this zipped version to deploy new versions of the application to Lightsail. Use Lightsail deployment options to manage the deployment.

C

Use AWS CodeArtifact to store the application code. Use AWS CodeDeploy to deploy the application to a fleet of Amazon EC2 instances. Use Elastic Load Balancing to distribute the traffic to the EC2 instances. When making changes to the application, upload a new version to CodeArtifact and create a new CodeDeploy deployment.

D

Use AWS Elastic Beanstalk to host the application. Store a zipped version of the application in Amazon S3. Use that location to deploy new versions of the application. Use Elastic Beanstalk to manage the deployment options.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 27

A company is using AWS Organizations and wants to implement a governance strategy with fee following requirements:

• AWS resource access is restricted to the same two Regions for all accounts.

• AWS services are limited to a specific group of authorized services for all accounts.

• Authentication is provided by Active Directory.

• Access permissions are organized by job function and are identical in each account.

Which solution will meet these requirements?

A

Establish an organizational unit (01.1) with group policies in the management account to restrict Regions and authorized services. Use AWS CloudFormation Stacßets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account,

B

Establish a permission boundary in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity providing authentication in each account,

C

Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS Resource Access Manager (AWS RAM) to share management account robes with permissions for each job function, including AWS IAM Identity Center for authentication in each account.

D

Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS CbudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 28

A developer is maintaining a fleet of 50 Amazon EC2 Linux servers. The servers are part of an Amazon EC2 Auto Scaling group, and also use Elastic Load Balancing for load balancing.

Occasionally, some application servers are being terminated after failing ELB HTTP health checks. The developer would like to perform a root cause analysis on the issue, but before being able to access application logs, the server is terminated.

How can log collection be automated?

A

Use Auto Scaling lifecycle hooks to put instances in a Pending:Wait state. Create an Amazon CloudWatch alarm for EC2 Instance Terminate Successful and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

B

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Config rule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

C

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon CloudWatch subscription filter for EC2 Instance Terminate Successful and trigger a CloudWatch agent that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

D

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon EventBridge rule for EC2 Instance-terminate Lifecycle Action and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 29

A company runs a web application on Amazon Elastic Kubernetes Service (Amazon EKS). The company uses Amazon CloudFront to distribute the application. The company recently enabled AWS WAF. The company set up Amazon CloudWatch Logs to send logs to an aws-waf40gs log group.

The company wants a DevOps engineer to receive alerts if there are sudden changes in blocked traffic, The company does not want to receive alerts for other changes in AWS WAF log behavior. The company will tune AWS WAF rules over time.

The DevOps engineer is currently subscribed to an Amazon Simple Notification Service (Amazon SNS) topic in the environment.

Which solution will meet these requirements?

A

Create a CloudWatch Logs metrics filter for blocked requests on the AWS WAF log group to create a custom metric. Create a CloudWatch alarm by using CloudWatch anomaly detection and the published custom metric, Configure the alarm to notify the SNS topic to alett the DevOps engineer.

B

Create a CloudWatch anomaly detector for the log group. Create a CloudWatch alarm by using metrics that the CloudWatch anomaly detector publishes. Use the high setting for the LogAnomalyPriority metric. Configure the alarm to go into alarm state if a static threshold of one anomaly is detected, Configure the alarm to notify theSNS topic to alert the DevOps engineer.

C

Create a CloudWatch metrics filter for counted requests on the AWS WAF log group to create a custom metric. Create a CloudWatch alarm that activates when the sum of blocked requests in the custom metric during a period of 1 hour is greater a static estimate for the acceptable number of blocked requests in 1 hour. Configurethe alarm to notify the SNS topic to alert the DevOps engineer.

D

Create a CloudWatch anomaly detector for the log group. Create a CloudWatch alarm by using metrics that the CloudWatch anomaly detector publishes, Use the medium setting for the LogAnomalyPriority metric. Configure the alarm to go into alarm state if a sum of anomalies over 1 hour is greater than an expected value. Configure thealarm to notify the SNS topic to alert the DevOps engineer.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 30

A company has an organization in AWS Organizations. The organization includes workload accounts that contain enterprise applications. The company centrally manages users from an operations account. No users can be created in the workload accounts. The company recently added an operations team and must provide the operations team members with administrator access to each workload account.

Which combination of actions will provide this access? (Choose three.)

A

Create a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the role. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.

B

Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account.

C

Create an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as an authenticated role.

D

In the operations account, create an IAM user for each operations team member.

E

In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all operations team members to the group.

F

Create an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user for each operations team member.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 31

A DevOps engineer needs to troubleshoot a pipeline that uses a GitHub code repository. The pipeline contains a source stage, a build stage, and a deploy stage. The pipeline also has an AWS Code Star connection to the GitHub code repository.

The build stage uses an AWS CodeBuild build project, The build project needs to perform a git done of the repository as part of the build process, The DevOps engineer validates that the source stage is working property. However, the build stage fails each time the pipeline runs.

What is the reason that the build stage fails In the pipeline?

A

The build stage within the pipeline needs to use the AWS CodeStar connection action.

B

The AWS CodeStar connection to GitHub contains incorrect credentials,

C

The AWS CodePipeline service role does not have permission to use the AWS CodeStar connection.

D

The AWS CodeBuild service role dog not have permission to use the AWS CodeStar connection.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 32

A company is implementing an Amazon Elastic Container Service (Amazon ECS) cluster to run its workload. The company architecture will run multiple ECS services on the cluster. The architecture includes an Application Load Balancer on the front end and uses multiple target groups to route traffic.

A DevOps engineer must collect application and access logs. The DevOps engineer then needs to send the logs to an Amazon S3 bucket for near-real-time analysis.

Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)

A

Download the Amazon CloudWatch Logs container instance from AWS. Configure this instance as a task. Update the application service definitions to include the logging task.

B

Install the Amazon CloudWatch Logs agent on the ECS instances. Change the logging driver in the ECS task definition to awslogs.

C

Use Amazon EventBridge to schedule an AWS Lambda function that will run every 60 seconds and will run the Amazon CloudWatch Logs create-export-task command. Then point the output to the logging S3 bucket.

D

Activate access logging on the ALB. Then point the ALB directly to the logging S3 bucket.

E

Activate access logging on the target groups that the ECS services use. Then send the logs directly to the logging S3 bucket.

F

Create an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket. Then create an Amazon CloudWatch Logs subscription filter for Kinesis Data Firehose.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 33

A company plans to use Amazon CloudWatch to monitor its Amazon EC2 instances. The company needs to stop EC2 instances when the average of the NetworkPacketsIn metric is less than 5 for at least 3 hours in a 12-hour time window. The company must evaluate the metrbc every hour. The EC2 instances must continue to run if there is missing data for the NetworkPacketsIn metric during the evaluation period.

A DevOps engineer creates a CloudWatch alarm for the NetworkPacketsIn metric. The DevOps engineer configures a threshold value of 5 and an evaluation period of 1 hour.

Which set of additional actions should the DevOps engineer take to meet these requirements?

A

Configure the Datapoints to Alarm value to be 3 out of 12. Configure the alarm to treat missing data as breaching the threshold. Add an AWS Systems Manager action to stop the instance when the alarm enters the ALARM state.

B

Configure the Datapoints to Alarm value to be 3 out of 12. Configure the alarm to treat missing data as not breaching the threshold. Add an EC2 action to stop the instance when the alarm enters the ALARM state.

C

Configure the Datapoints to Alarm value to be 9 out of 12. Configure the alarm to treat missing data as breaching the threshold. Add an EC2 action to stop the instance when the alarm enters the ALARM state.

D

Configure the Datapoints to Alarm value to be 9 out of 12. Configure the alarm to treat missing data as not breaching the threshold. Add an AWS Systems Manager action to stop the instance when the alarm enters the ALARM state.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 34

A company that uses electronic health records is running a fleet of Amazon EC2 instances with an Amazon Linux operating system. As part of patient privacy requirements, the company must ensure continuous compliance for patches for operating system and applications running on the EC2 instances.

How can the deployments of the operating system and application patches be automated using a default and custom repository?

A

Use AWS Systems Manager to create a new patch baseline including the custom repository. Run the AWS-RunPatchBaseline document using the run command to verify and install patches.

B

Use AWS Direct Connect to integrate the corporate repository and deploy the patches using Amazon CloudWatch scheduled events, then use the CloudWatch dashboard to create reports.

C

Use yum-config-manager to add the custom repository under /etc/yum.repos.d and run yum-config-manager-enable to activate the repository.

D

Use AWS Systems Manager to create a new patch baseline including the corporate repository. Run the AWS-AmazonLinuxDefaultPatchBaseline document using the run command to verify and install patches.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 35

A company is developing code and wants to use semantic versioning. The company's DevOps team needs to create a pipeline for compiling the code. The team also needs to manage versions of the compiled code. If the code uses any open source libraries, the libraries must also be cached in the build process.

Which solution will meet these requirements?

A

Create an AWS CodeArtifact repository and associate the upstream repositories. Create an AWS CodeBuibd project that builds the semantic version of the code artifacts. Configure the project to authenticate and connect to the CodeArtifact repository and publish the artifact to the repository.

B

Use AWS CodeDeploy to upload the generated semantic version of the artifact to an Amazon Elastic File System (Amazon EFS) file system.

C

Use an AWS CodeBuild project to build the code and to publish the generated semantic version of the artifact to AWS Artifact. Configure build caching in fr,e CodeBuild project.

D

Create a new AWS CodeArtifact repository. Create an AWS Lambda function that pulls open source packages from the internet and publishes the packages to the repository. Configure AWS CodeDeploy to build semantic versions of the code and publish the versions to the repository.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 36

A DevOps engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using S3 cross-Region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account.

Which combination of actions should be performed to enable this replication? (Choose three.)

A

Create a replication IAM role in the source account.

B

Create a replication IAM role in the target account.

C

Add statements to the source bucket policy allowing the replication IAM role to replicate objects.

D

Add statements to the target bucket policy allowing the replication IAM role to replicate objects.

E

Create a replication rule in the source bucket to enable the replication.

F

Create a replication rule in the target bucket to enable the replication.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 37

A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health.

The DevOps engineer must implement an automated solution that uses Amazon EventBridge to remediate the notifications during the company's scheduled maintenance windows.

How should the DevOps engineer configure an EventBridge rule to meet these requirements?

A

Configure an event source of AWS Health, Configure event b,pes that indicate scheduled termination and retirement. Target the AWS-Resta1tEC21nstance Systems Manager Automation runbook to restart the EC2 instances.

B

Configure an event source of Systems Manager. Configure an event type that indicates a maintenance window. Target the AWS-RestartEQInstance Systems Manager Automation runbook to restart the EC2 instances.

C

Configure an event source of AWS Health. Configure event b, pes that indicate scheduled instance termination and retirement. Target a newly created AWS Lambda function that registers a systems Manager window' task to restart the EC2 instances.

D

Configure an event source of EQ. Configure an event type that indicates instance state notification. Target a newly created AWS Lambda function that registers a systems Manager maintenance window task to restart the EC2 instances,

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 38

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.

The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.

Which solution is the MOST cost-effective way to reduce the application startup time?

A

Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when the application is ready to serve requests.

B

Increase the maximum instance count of the Auto Scaling group. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when the application is ready to serve requests.

C

Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when the application is ready to serve requests.

D

Increase the maximum instance count of the Auto Scaling group. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook and to place the new instance in the Standby state when the application is ready to serve requests.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 39

A company uses an HPC platform to run analysis jobs for data. The company uses AWS CodeBuild to create container images and store the images on Amazon Elastic Container Registry (Amazon ECR). The images are then deployed on Amazon Elastic Kubernetes Service (Amazon EKS).

To maintain compliance, the company needs to ensure that the images are signed before the images are deployed on Amazon EKS. The signing keys must be rotated periodically and must be managed automatically. The company needs to track who generates the signatures.

Which solution will meet these requirements with the LEAST operational effort?

A

Use CodeBuild to retrieve the image that was previously pushed to Amazon ECR. Use AWS Signer to sign the image. Use AWS CloudTrail to track who generates the signatures.

B

Use AWS Lambda to retrieve the image that was previously pushed to Amazon ECR. Use a Lambda ünction to sign the image. Use Amazon CloudWatch to track who generates the signatures.

C

Use AWS Lambda to retrieve the image that was previously pushed to Amazon ECR. Use AWS Signer to sign the image, Use Amazon CloudWatch to track who generates the signatures.

D

Use CodeBuild to build the image. Sign the image by using AWS Signer before pushing the image to Amazon ECR. Use AWS CloudTrail to track who generates the signatures.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 40

A development team uses AWS CodeCommit for version control for applications. The development team uses AWS CodePipeline, AWS CodeBuild. and AWS CodeDeploy for CI/CD infrastructure. In CodeCommit, the development team recently merged pull requests that did not pass long-running tests in the code base. The development team needed to perform rollbacks to branches in the codebase, resulting in lost time and wasted effort.

A DevOps engineer must automate testing of pull requests in CodeCommit to ensure that reviewers more easily see the results of automated tests as part of the pull request review.

What should the DevOps engineer do to meet this requirement?

A

Create an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild badge as a comment on the pull request so that developers will see the badge in their code review.

B

Create an Amazon EventBridge rule that reacts to the pullRequestCreated event. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild test results as a comment on the pull request when the test results are complete.

C

Create an Amazon EventBridge rule that reacts to pullRequestCreated and pullRequestSourceBranchUpdated events. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild badge as a comment on the pull request so that developers will see the badge in their code review.

D

Create an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild test results as a comment on the pull request when the test results are complete.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 41

A development team wants to use AWS CloudFormation stacks to deploy an application. However, the developer LAM role does not have the required permissions to provision the resources that are specified in the AWS CloudFormation template. A DevOps engineer needs to implement a solution that allows the developers to deploy the stacks. The solution must follow the principle of least privilege.

Which solution will meet these requirements?

A

Create an IAM policy that allows the developers to provision the required resources. Attach the policy to the developer IAM role,

B

Create an IAM policy that allows full access to AWS CloudFormation. Attach the policy to the developer IAM role.

C

Create an AWS CloudFormation setvice role that has the required permissions. Grant the developer IAM role a action. Use the new service role during stack deployments.

D

Create an AWS CloudFormation service role that has the required permissions. Grant the developer IAM role the iam:PassRole permission. Use the new service role during stack deployments.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 42

A company has its AWS accounts in an organization in AWS Organizations. AWS Config is manually configured in each AWS account. The company needs to implement a solution to centrally configure AWS Config for all accounts in the organization. The solution also must record resource changes to a central account.

Which combination of actions should a DevOps engineer perform to meet these requirements? (Choose two.)

A

Configure a delegated administrator account for AWS Config. Enable trusted access for AWS Config in the organization.

B

Configure a delegated administrator account for AWS Config. Create a service-linked role for AWS Config in the organization’s management account.

C

Create an AWS CloudFormation template to create an AWS Config aggregator. Configure a CloudFormation stack set to deploy the template to all accounts in the organization.

D

Create an AWS Config organization aggregator in the organization's management account. Configure data collection from all AWS accounts in the organization and from all AWS Regions.

E

Create an AWS Config organization aggregator in the delegated administrator account. Configure data collection from all AWS accounts in the organization and from all AWS Regions.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 43

A company uses an organization in AWS Organizations to manage many AWS accounts. The company has enabled all features for the organization. The company uses AWS CloudFormation StackSets to deploy configurations to the accounts. The company uses AWS Config to monitor an Amazon S3 bucket.

The company needs to ensure that all object uploads to the S3 bucket use AWS Key Management Service (AWS KMS) encryption,

Which solution will meet these requirements?

A

Create an AWS Config conformance pack that includes the s3-bucket-server-side-encryption-enabled rule. Deploy the conformance pack to the accounts, Configure the rule to target an Amazon Simple Notification Sevice (Amazon SNS) topic.

B

Create an SCP that includes a deny statement for the s3:createBucket action and a condition statement where s3:x-amz-server-side-encryption is not aws:kms. Attach the SCP to the root of the organization.

C

Create an AWS CloudFormation stack set to enable an AWS CloudTrail trail to capture S3 data events for the organization. In the stack set, create an Amazon EventBridge rule to match S3 PutObject events that do not use AWS KMS encryption. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic.

D

Create an SCP that includes a deny statement for the s3:putObject action and a condition where s3:x-amz-server-side-encryption is not aws:kms. Attach the SCP to the root of the organization.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 44

A company is performing vulnerability scanning for all Amazon EC2 instances across many accounts. The accounts are in an organization in AWS Organizations. Each account's VPCs are attached to a shared transit gateway. The VPCs send traffic to the internet through a central egress VPC. The company has enabled Amazon Inspector in a delegated administrator account and has enabled scanning for all member accounts.

A DevOps engineer discovers that some EC2 instances are listed in the "not scanning" tab in Amazon Inspector.

Which combination of actions should the DevOps engineer take to resolve this issue? (Choose three.)

A

Verify that AWS Systems Manager Agent is installed and is running on the EC2 instances that Amazon Inspector is not scanning.

B

Associate the target EC2 instances with security groups that allow outbound communication on port 443 to the AWS Systems Manager service endpoint.

C

Grant inspector:StartAssessmentRun permissions to the IAM role that the DevOps engineer is using.

D

Configure EC2 Instance Connect for the EC2 instances that Amazon Inspector is not scanning.

E

Associate the target EC2 instances with instance profiles that grant permissions to communicate with AWS Systems Manager.

F

Create a managed-instance activation. Use the Activation Code and the Activation ID to register the EC2 instances.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 45

A company used a lift and shift strategy to migrate a workload to AWS. The company has an Auto Scaling group of Amazon EC2 instances. Each EC2 instance runs a web application, a database, and a Redis cache.

Users are experiencing large variations in the web application's response times, Requests to the web application go to a single EC2 instance that is cmder significant load, The company wants to separate the application components to improve availability and performance.

Which solution will meet these requirements?

A

Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Application Load Balancer and an Auto Scaling group for the Redis cache.

B

Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Mufti-AZ deployment. Create a Network Load Balancer and an Auto Scaling group in a single Availability Zone for the Redis cache.

C

Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database, Create an Amazon ElastiCache (Redis OSS) cluster for the cache. Create a target group that has a DNS target type that contains the ElastiCache (Redis OSS) cluster hostname.

D

Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Mufti-AZ deployment. Create an Amazon ElastiCache (Redis OSS) cluster for the cache.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 46

A space exploration company receives telemetry data from multiple satellites. Small packets of data are received through Amazon API Gateway and are placed directly into an Amazon Simple Queue Service (Amazon SQS) standard queue. A custom application is subscribed to the queue and transforms the data into a standard format.

Because of inconsistencies in the data that the satellites produce, the application is occasionally unable to transform the data. In these cases, the messages remain in the SQS queue. A DevOps engineer must develop a solution that retains the failed messages and makes them available to scientists for review and future processing.

Which solution will meet these requirements?

A

Configure AWS Lambda to poll the SQS queue and invoke a Lambda function to check whether the queue messages are valid. If validation fails, send a copy of the data that is not valid to an Amazon S3 bucket so that the scientists can review and correct the data. When the data is , amend the message in the SQS queue by using a replay Lambda function with the data.

B

Convert the SQS standard queue to an SQS FIFO queue. Configure AWS Lambda to poll the SQS queue every 10 minutes by using an Amazon EventBridge schedule. Invoke the Lambda function to identify any messages with a SentTimestamp value that is older than 5 minutes, push the data to the same location as the application's output location, and remove the messages from the queue.

C

Create an SQS dead-letter queue. Modify the existing queue by including a redrive policy that sets the Maximum Receives setting to 1 and sets the dead-letter queue ARN to the ARN of the newly created queue. Instruct the scientists to use the dead-letter queue to review the data that is not valid. Reprocess this data at a later time.

D

Configure API Gateway to send messages to different SQS virtual queues that are named for each of the satellites. Update the application to use a new virtual queue for any data that it cannot transform, and send the message to the new virtual queue. Instruct the scientists to use the virtual queue to review the data that is not valid. Reprocess this data at a later time.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 47

A DevOps engineer deployed multiple AWS accounts by using AWS Control Tower to support different business, technical, and administrative I-nits in a company. A security team needs the DevOps engineer to automate AWS Control Tower guardrails for the company. The guardrails must be applied to all accounts In an OU of the company's organization in AWS Organizations.

The security team needs a solution that has version control and can be reviewed and rolled back if necessary. The security team will maintain the management of the solution in its 01.1. The security team wants to limit the type of guardrails Yat are allowed and allow only new guardrails that are approved by the security team.

Which solution will meet these requirements with the MOST operational efficiency?

A

Create individual AWS CloudFormation templates that align to a guardrail. Store the templates in an AWS CodeCommit repository. Create an logical resource in the template for each OU in the organization. Configure an AWS CodeBuild project that an amazon EventBridge rube will invoke for the security team's AWS CodeCommit changes.

B

Create individual AWS CloudFormation templates that align to a guardrail. Store the templates in an AWS CodeCommit repository, Create an AWS::ControlTower::EnableControl logical resource in the template for each account in the organization. Configure an AWS CodePipeljne pipeline in the security team's account, Advise the security team to invoke the pipeline and provide these parameters when starting the pipeline.

C

Create individual AWS CloudFormation templates that align to a guardrail. Store the templates in an AWS CodeCommit repository. Create an AWS::ControlTower::EnableControl logical resource in the template for each OU in the organization. Configure an AWS CodePipeline pipeline in the security team's account that an Amazon EventBridge rule will invoke for the security team's CodeCommit changes.

D

Configure an AWS CodePipeline pipeline in the security team's account that an Amazon EventBridge rule will invoke for PutObject events to an Amazon S3 bucket, create individual AWS CloudFormation templates that align to a guardrail. Store the templates in the S3 bucket. Create an logical resource inthe template for each OU in the organization.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 48

A company's production environment uses an AWS CodeDeploy blue/green deployment to deploy an application. The deployment includes Amazon EC2 Auto Scaling groups that launch instances that run Amazon Linux 2.

A working appspec.yml file exists in the code repository and contains the following text:

A DevOps engineer needs to ensure that a script downloads and installs a license file onto the instances before the replacement instances start to handle request traffic. The DevOps engineer adds a hooks section to the appspec.yml file.

Which hook should the DevOps engineer use to run the script that downloads and installs the license file?

A

AfterBlockTraffic

B

BeforeBlockTraffc

C

Beforelnstall

D

DownloadBundle

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 49

A company uses AWS CodeBuild projects to perform a process. At the end of the process, the CodeBuild projects log a summarized report to an Amazon CloudWatch log group.

The company’s DevOps team needs to create a solution that will give team members access to view the summaries from the CodeBuild projects.

Which solution will meet these requirements in the MOST operationally efficient way?

A

Create a CloudWatch dashboard. Create a log type widget that displays the summaries from the CloudWatch log group.

B

Create a CloudWatch Log Insights query that captures the summaries from the CloudWatch log group. Create a CloudWatch query folder and save the query in the folder.

C

Create a custom metric filter based on the summary. Create a CloudWatch dashboard, create a metric explorer type widget that displays the custom metric filthen

D

Create an AWS Lambda function that reviews the CloudWatch bog group. Create a CloudWatch dashboard. Create a custom type widget that displays the result of the Lambda function.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 50

A company has an application that includes AWS Lambda functions. The Lambda functions run Python code that is stored in an AWS CodeCommit repository. The company has recently experienced failures in the production environment because of an error in the Python code. An engineer has written unit tests for the Lambda functions to help avoid releasing any future defects into the production environment.

The company's DevOps team needs to implement a solution to integrate the unit tests into an existing AWS CodePipeline pipeline. The solution must produce reports about the unit tests for the company to view.

Which solution will meet these requirements?

A

Associate the CodeCommit repository with Amazon CodeGuru Reviewer. Create a new AWS CodeBuild project. In the CodePipeline pipeline, configure a test stage that uses the new CodeBuild project. Create a buildspec yml file in the CodeCommit repository. In the buildspec.yml file, define the actions to run a Codeguru review.

B

Create a new AWS CodeBuild project in the pipeline, configure a test that uses the new project Create a CodeBuild report group. Create a buildspec yml file in the CodeCommit repository. In the buildspec yml file, define the actions to run the unit tests with an output of JUNITXML in the build phase section. Configure the test reports to be uploaded to the new report group.

C

Create a new AWS CodeArtifact repository Create a new AWS CodeBuild project. In the pipeline, configure a test stage that uses the new CodeBuild project. Create an appspec.yml file in the original CodeCommit repository. In the appspec yml file, define the actions to run the unit tests with an output of CUCUMBERJSON In the build phase section. Configure the tests reports to be sent to the new CodeArtlfact repository.

D

Create a new AWS CodeBuild project. In the CodePipeline pipeline, configure a test that uses the new project. Create a new Amazon S3 bucket Create a buildspec yml file in the CodeCommit repository. In the buildspec yml file, define the actions to run the unit tests with an output of HTML in the phases section. In the reports section, upload the test reports to the S3 bucket.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 51

A company runs an application in an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer (ALB). The EQ instances run Docker containers that make requests to a MySQL database that runs on separate EC2 instances.

A DevOps engineer needs to update the application to use a serverless architecture.

Which solution will meet this requirement with the FEWEST changes?

A

Replace the containers that run on EC2 instances and the ALB with AWS Lambda functions. Replace the MySQL database with an Amazon Aurora Serverless v2 database that is compatible with MySQL

B

Replace the containers that run on EC2 instances with AWS Fargate. Replace MySQL database with an Amazon Aurora Serverless v2 database that is compatible with MySQL.

C

Replace the containers that run on EC2 instances and the ALB with AWS Lambda functions. Replace the MySQL database with Amazon DynamoDB tables.

D

Replace the containers that run on EC2 instances with AWS Fargate. Replace MySQL database with Amazon DynamoDB tables.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 52

A DevOps engineer is designing an application that integrates with a legacy REST API. The application has an AWS Lambda function that reads records from an Amazon Kinesis data stream. The function sends the records to the legacy REST API.

Approximately 10% of the records that the Lambda function sends the Kinesis data stream have data errors and must be processed manually. The function event source configuration has an Amazon Simple Queue Service (Amazon SQS) dead-letter queue as an on-failure destination. The DevOps engineer has configured the Lambda function to process records in batches and has Implemented retries in case of failure.

During testing, the DevOps engineer notices that the dead-letter queue contains many records that have no data errors and that already have been processed by the legacy REST API. The DevOps engineer needs to configure the Lambda function's event source options to reduce the number of errorless records that are sent to the dead-letter queue.

Which solution will meet these requirements?

A

Increase the retry attempts.

B

Configure the setting to split the batch when an error.

C

Increase the concurrent batches per shard.

D

Decrease the maximum age of record.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 53

A company stores its Python-based application code in AWS CodeCommit. The company uses AWS CodePipeline to deploy the application. The CodeCommit repository and the CodePipeline pipeline are deployed to the same AWS account.

The company's security team requires all code to be scanned for vulnerabilities before the code is deployed to production. If any vulnerabilities are found, the deployment must stop.

Which solution will meet these requirements?

A

Create a new CodeBuild project. Configure the project to run a security scan on the code by using Amazon CodeGuru Security. Configure the CodeBuild project to raise an error if CodeGuru Security finds vulnerabilities. Create a new IAM role that has sufficient permissions to run CodeGuru Security scans. Assign the role to the CodeBuild project. In the CodePipeline pipeline, add a new stage before the deployment stage. Select AWS CodeBuiId as the action provider for the new stage. Use the source artifact from the CodeCommit repository. Configure the action to use the CodeBuild project.

B

Create a new CodeBuild project. Configure the project to run a security scan on the code by using Amazon Inspector. Configure the CodeBuild project to raise an error if Amazon Inspector finds vulnerabilities. Create a new IAM role that has sufficient permissions to run Amazon Inspector scans. Assign the role to the CodeBuild project. In the CodePipeline pipeline, add a new stage before the deployment stage. Select AWS CodeBuild as the action provider for the new stage. Use the source artifact from the CodeCommit repository. Configure the action to use the CodeBuiId project.

C

Update the IAM role that is attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the CodePipeline pipeline, add a new stage before the deployment stage.Select DevOps Guru as the action provider for the new stage. Use the source artifact from the CodeCommit repository.

D

Update the IAM role that is attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the CodePipeline pipeline, add a new stage before the deployment stage. Select CodeGuru Security as the action provider for the new stage. Use the source artifact from the CodeCommit repository.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 54

A company has deployed an application in a production VPC in a Single AWS account. The application s popular and IS experiencing heavy usage The company's security team wants to add additional security, such as AWS WAF, to the application deployment However, the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary.

The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can that the application needs additional security. The DevOps engineer creates a VPC flow log for the production VPC.

Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost-effectively?

A

Create a Iog group in Amazon CloudWatch Logs. Configure the VPC flow to capture accepted traffic and to send the data to the group. Create an Amazon CloudWatch metric filter for IP addresses on the deny 1st. Create a CloudWatch alarm with the metric filter as input. Set the period to 5 minutes and the datapoints toalarm to 1. Use an Amazon Simple Notification Service (Amazon SNS) topic to send alarm notices to the security team.

B

Create an Amazon S3 bucket for files. Configure the VPC flow to capture all traffic and to send the data to the S3 bucket Configure Amazon Athena to return all log files in the S3 bucket for IP addresses on the deny list. Configure Amazon QuickSight to accept data from Athena and to publish the data as a dashboard the security team can access Create a threshold alert of 1 for successful access. Configure the alert to automatically notify the security team as frequently as possible when the alert threshold is met.

C

Create an Amazon S3 bucket for files. Configure the VPC flow to capture accepted traffic and to send the data to the S3 bucket Configure an Amazon OpenSearch Service cluster and domain for the log files. Create an AWS Lambda function to retrieve the logs from the S3 bucket, format the logs, and load the logs into the OpenSearch Service cluster Schedule the Lambda function to run every 5 minutes. Configure an alert and condition in OpenSearch Service to send alerts to the security team through an Amazon Simple Notification Service (Amazon SNS) topic when access from the IP addresses on the deny list is detected.

D

Create a log group in Amazon CloudWatch Logs. Create an Amazon S3 bucket to hold query results. Configure the VPC flow Iog to capture all traffic and to send the data to the log group. Deploy an Amazon Athena CloudWatch connector in AWS Lambda Connect the connector to the log group. Athena to periodically query for all accepted traffic from the IP addresses on the deny list and to store the results in the S3 bucket. Configure an S3 event notification to automatically notify the security team through an Amazon Simple Notification Service (Amazon SNS) topic when new objects are added to the S3 bucket.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 55

A DevOps team supports an application that runs in an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). Currently, the DevOps team uses AWS CodeDeploy to

deploy the application by using a blue/green all-at-once strategy. Recently, the DevOps team had to roll back a deployment when a new version of the application dramatically increased response times for

requests.

The DevOps team needs use to a deployment strategy that will allow the team to monitor a new version of the application before the team shifts all traffic to the new version. If a new version of the

application increases response times, the deployment should be rolled back as quickly as possible.

Which combination of steps will meet these requirements? (Select Two.)

A

Modify the CodeDepIoy deployment to use the CodeDeployDefault.ECSCanaryIOPercent5Minutes configuration.

B

Modify the CodeDeploy deployment to use the CodeDeployDefault.ECSLinear10PercentEvery3Minutes configuration.

C

Create an Amazon CloudWatch alarm to monitor the UnHeaIthyHostCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when a deployment fails.

D

Create an Amazon CloudWatch alarm to monitor the TargetResponseTime metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDepIoy deployment group. Modify the deployment group to roll back when alarm thresholds are met.

E

Create an Amazon CloudWatch alarm to monitor the TargetConnectionErrorCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when alarm thresholds are met.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 56

A company uses AWS CloudFormation stacks to deploy updates to its ap include AWS Auto Scaling groups, Amazon EC2 instances, Application Load Balancers (ALBs). and other resources that are necessary to launch and maintain independent stacks. Changes to application resources outside of CloudFormation stack updates are not allowed.

The company recently attempted to update the application stack by using the AWS CLI. The stack failed to update and produced the following error message: "ERROR: both the deployment and the CloudFormation stack rollback failed. The deployment failed because the following resource(s) failed to update: [AutoScalingGroup1].”

The stack remains in a status of UPDATE ROLLBACK FAILED.

Which solution will resolve this issue?

A

Update the subnet mappings that are configured for the ALBs. Run the aws cloudformation update-stack-set AWS CLI command.

B

Update the IAM role by providing the necessary permissions to the stack. Run the aws cloudformation CLI command.

C

Submit a request for a quota increase for the number of EC2 instances for the account Run the aws cloudformation cancel-update-stack AWS CLI command.

D

Delete the Auto Scaling group resource. Run the aws cloudformation rollback-stack AWS CLI command.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 57

A company uses an AWS CodeArtifact repository to store Python packages that the company developed intemally. A DevOps engineer needs to use AWS CodeDeploy to deploy an application to an Amazon EC2 instance. The application uses a Python package that is stored in the CodeArtifact repository. A Beforelnstall lifecycle event hook will install the package.

The DevOps engineer needs to grant the EC2 instance access to the CodeArtifact repository.

Which solution will meet this requirement?

A

Create a service-linked role for CodeArtifact. Associate the role with the EC2 instance. Use the aws codeartifact get-authorization-token CLI command on the instance.

B

Configure a resource-based policy for the CodeArtifact repository that allows the ReadFromRepository action for the EQ instance principal.

C

Configure ACLs on the CodeArtifact repository to allow the EC2 instance to access the Python package.

D

Create an instance profile that contains an IAM role that has access to CodeArtifact. Associate the instance profile with the EC2 instance. Use the aws codeartifact login CLI command on theinstance.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 58

A company uses AWS Organizations to manage its AWS accounts. The organization has root has an OU that is named environments. The environments OU has two child OUS that are named Development and Production, respectively.

The Environments OU and the child OUs have the default FullAWSAccess policy in place. A DevOps engineer plans to remove the FullAWSAccess policy from the Development OU and replace the policy with a policy that allows all actions on Amazon EC2 resources.

What will be the outcome of this policy replacement?

A

All users in the Development OU will be allowed all API actions on all resources.

B

All users in the Development OU will be allowed all API actions on EC2 resources. All other API actions will be denied.

C

All users in the Development OU will be denied all API actions on all resources.

D

All users in the Development OU will be denied all API actions on EC2 resources. All other API actions will be allowed.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 59

company's web application uses an Application Load Balancer (ALB) to direct traffic to Amazon EQ instances across three Availability Zones.

The company has deployed a newer version of the application to one Availability Zone for testing. If a problem is detected with the application, the company wants to direct traffic away from the affected Zone until the deployment has been rolled back. The application must remain available and maintain static stability during the rollback.

Which solution will meet these requirements with the MOST operational efficiency?

A

Disable cross-zone load balancing on the ALB's target group. Initiate a zonal shift on the ALB to direct trafic away from the affected Availability Zone.

B

Disable cross-zone load balancing on the ALB's target group. Manually remove instances in the target group that belong to the affected Availability Zone.

C

Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Initiate a zonal shift on the ALB to direct traffic away from the affected Availability' Zone.

D

Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Remove the subnet that is associated with the affected Availability Zone.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 60

A company manually provisions IAM access for its employees. The company wants to replace the manual process with an automated process. The company has an existing Active Directory system configured with an external SAML 2.0 identity provider (ldP).

The company wants employees to use their existing corporate credentials to access AWS. The groups from the existing Active Directory system must be available for permission management in AWS Identity and Access Management (IAM). A DevOps engineer has completed the initial configuration of AWS IAM Identity Center (AWS Single Sign-On) in the company's AWS account.

What should the DevOps engineer do next to meet the requirements?

A

Configure an external ldP as an identity source. Configure automatic provisioning of users and groups by using the SCIM protocol.

B

Configure AWS Directory Service as an identity source. Configure automatic provisioning of users and groups by using the SAML protocol.

C

Configure an AD Connector as an identity source. Configure automatic provisioning of users and groups by using the SCIM protocol.

D

Configure an external ldP as an identity source. Configure automatic provisioning of users and groups by using the SAML protocol.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 61

A company is using Amazon Elastic Kubernetes Service (Amazon EKS) to run its applications. The EKS cluster is successfully running multiple pods. The company stores the pod images in Amazon Elastic Container Registry (Amazon ECR).

The company needs to configure Pod Identity access for the EKS cluster. The company has already updated the node IAM role by using the permissions for Pod Identity access.

Which solution will meet these requirements?

A

Create an IAM OpenID Connect (OIDC) provider for the EKS cluster.

B

Ensure that the nodes can reach the EKS Auth API. Add and configure the EKS Pod Identity Agent add-on for the EKS cluster.

C

Create an EKS access entry that uses the API_AND-CONFIG_MAP cluster authentication mode.

D

Configure the AWS Security Token Service (AWS STS) endpoint for the Kubemetes service account that the pods in the EKS cluster use.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 62

A company has chosen AWS to host a new application. The company needs to implement a multi-account strategy. A DevOps engineer creates a new AWS account and an organization in AWS Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower.

The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory. When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account. All the OUS are enrolled in AWS Control Tower.

Which solution will meet these requirements in the MOST automated way?

A

Use AWS Service Catalog with AWS Control Tower. Create portfolios and products in AWS Service Catalog. Grant granular permissions to provision these resources. Deploy SCPs by using the AWS CLI and JSON documents.

B

Deploy CloudFormation stack sets by using the required templates. Enable automatic deployment. Deploy stack instances to the required accounts. Deploy a CloudFormation stack set to the organization's management account to deploy SCPs.

C

Create an Amazon EventBridge rule to detect the CreateManagedAccount event. Configure AWS Service Catalog as the target to deploy resources to any new accounts. Deploy SCPs by using the AWS CLI and JSON documents.

D

Deploy the Customizations for AWS Control Tower (CfCT) solution. Use an AWS CodeCommit repository as the source. In the repository, create a custom package that includes the CloudFormation templates and the SCP JSON documents.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 63

A company is building a serverless application that uses AWS Lambda functions to process data. A BeginResponse Lambda function initializes data in response to specific application events. The company needs to ensure that a large number of Lambda functions are invoked after the BeginResponse Lambda function runs. Each Lambda function must be invoked in parallel and depends on only the outputs of the BeginResponse Lambda function. Each Lambda function has retry' logic for invocation and must be able to fine-tune concurrency without losing data.

Which solution will meet these requirements with the MOST operational efficiency?

A

Create an Amazon Simple Notification Service (Amazon SNS) topic. Modify the BeginResponse Lambda function to publish to the SNS topic before the BeginResponse Lambda function finishes running. Subscribe all Lambda functions that need to invoke after the BeginResponse Lambda function runs to the SNS topic. Subscribe any new Lambda functions to the SNS topic.

B

Create an Amazon Simple Queue Service (Amazon SQS) queue for each Lambda function that needs to run after the BeginResponse Lambda function runs. Subscribe each Lambda function to its own SQS queue. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe each SQS queue to the SNS topic. Modify the BeginResponse function to publish to the SNS topic when it finishes running.

C

Create an Amazon Simple Queue Service (Amazon SQS) queue for each Lambda function that needs to run after the BeginResponse Lambda function runs. Subscribe the Lambda function to the SQS queue. Create an Amazon Simple Notification Service (Amazon SNS) topic for each SQS queue. Subscribe the SQS queues to the SNS topics. Modify the BeginResponse function to publish to the SNS topics when the function finishes running.

D

Create an AWS Step Functions Standard Workflow. Configure states in the workflow to invoke the Lambda functions sequentially. Create an Amazon Simple Notification Service (Amazon SNS) topic. Modify the BeginResponse Lambda function to publish to the SNS topic before the Lambda function finishes running. Create a new Lambda function that is subscribed to the SNS topic and that invokes the Step Functions workflow.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 64

A company is using AWS Organizations to centrally manage its AWS account by using AWS CloudFormation StackSets. The company has configured trusted access in Organizations for AWS Config and has configured a member account as a delegated administrator account for AWS Config.

A DevOps engineer needs to implement a new security policy. The policy must require all current and future AWS member accounts to use a common baseline of AWS Contig rules that contain remediation actions that are managed from a central account. Non-administrator users who can access member accounts must not be able to modify this common baseline of AWS Config rules that are deployed into each member account.

Which solution will meet these requirements?

A

Create a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the Organizations management account by using CloudFormation StackSets.

B

Create an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the Organizations management account by using CloudFormation StackSets

C

Create a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the delegated administrator account by using AWS Config.

D

Create an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the delegated administrator account by using AWS Config.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 65

A company runs several applications in the same AWS account. The applications send logs to Amazon CloudWatch.

A data analytics team needs to collect performance metrics and custom metrics from the applications. The analytics team needs to transform the metrics data before storing the data in an Amazon S3 bucket.

The analytics team must automatically collect any new metrics that are added to the CloudWatch namespace.

Which solution will meet these requirements with the LEAST operational overhead?

A

Configure a CloudWatch metric stream to include metrics from the application and the CloudWatch namespace. Configure the metric stream to deliver the metrics to an Amazon Data Firehosedelivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

B

Configure a CloudWatch metrics stream to include all the metrics and to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWSLambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

C

Configure metric filters for the CloudWatch logs to create custom metrics. Configure a CloudWatch metric stream to deliver the application metrics to the S3 bucket.

D

Configure subscription filters on the application log groups to target an Amazon Data Firehose delivery stream. Configure the firehose delivery stream to invoke an AWS Lambda function totransform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 66

A company wants to use a grid system for a proprietary enterprise in-memory data store on top of AWS. This system can run in multiple server nodes in any Linux-based distribution. The system must be able to reconfigure the entire cluster every time a node is added or removed. When adding or removing nodes, an / etc./cluster/nodes.config file must be updated, listing the IP addresses of the current node members of that cluster. The company wants to automate the task of adding new nodes to a cluster.

What can a DevOps Engineer do to meet these requirements?

A

Use AWS OpsWorks Stacks to layer the server nodes of that cluster. Create a Chef recipe that populates the content of the /etc/cluster/nodes.config file and restarts the service by using the current members of the layer. Assign that recipe to the Configure lifecycle event.

B

Put the file nodes.config in version control. Create an AWS CodeDeploy deployment configuration and deployment group based on an Amazon EC2 tag value for the cluster nodes. When adding a new node to the cluster, update the file with all tagged instances, and make a commit in version control. Deploy the new file and restart the services.

C

Create an Amazon S3 bucket and upload a version of the etc/cluster/nodes.config file. Create a crontab script that will poll for that S3 file and download it frequently. Use a process manager, such as Monit or systemd, to restart the cluster services when it detects that the new file was modified. When adding a node to the cluster, edit the file's most recent members. Upload the new file to the S3 bucket.

D

Create a user data script that lists all members of the current security group of the cluster and automatically updates the /etc/cluster/nodes.config file whenever a new instance is added to the cluster.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 67

A DevOps engineer needs to design a cloud-based solution to standardize deployment artifacts for AWS Cloud deployments and on-premises deployments. There is currently no routing traffic between the on-premises data center and the AWS environment.

The solution must be able to consume downstream packages from public repositories and must be highly available. Data must be encrypted in transit and at rest. The solution must store the deployment artifacts in object storage and deploy the deployment artifacts into Amazon Elastic Container Service (Amazon ECS). The deployment artifacts must be encrypted in transit if the deployment artifacts travel across the public internet.

The DevOps engineer needs to deploy this solution in less than two weeks.

Which solution will meet these requirements?

A

Use a third-party software VPN appliance to connect the on-premises data center and AWS. Use AWS CodeArtifact to store the deployment artifacts.

B

Use an AWS Direct Connect connection and a VPN connection to connect the on-premises data center to AWS. Deploy third-part/ artifact management software on Amazon EC2 instances.

C

Use two AWS VPN connections to connect the on-premises data center to AWS. Use AWS CodeArtifact to store the deployment artifacts.

D

Use parallel AWS Direct Connect connections to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 68

An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months. Its product currently runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. All data is stored in an Amazon Aurora database instance.

When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region.

How should the company meet these requirements with the LEAST amount of application changes?

A

Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer information and purchases.

B

Use Amazon DynamoDB global tables for the product catalog and regional tables for the customer information and purchases

C

Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer information and purchases.

D

Use Aurora for the product catalog and Amazon DynamoDB global tables for the customer information and purchases.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 69

A company has an application that receives file uploads from users. The application processes the uploads in multiple threads. An Amazon Elastic Container Service (Amazon ECS) service runs multiple instances of the application task. The task publishes an Application File Upload custom metric each time a file is uploaded to be processed.

Each file can take a while to process. The company wants to ensure that the tasks scale based on the number of files for each available task. Recently many uploads in a short amount of time took a long time to process because individual tasks became overloaded with too many files.

Which solution will fix the problem with the LEAST operational effort?

A

Modify the application to publish a custom Amazon CloudWatch metric named Uploads PerTask. Configure the application to calculate the Uploads Per Task metric by using the existing ApplicationFile Uploads metric and information from Amazon ECS about running tasks. Create a CloudWatch alarm that triggers if the Uploads PerTask metric exceeds a target value. Create a step scaling policy that references the alarm. Configure the step scaling policy to scale in and out based on alarm conditions.

B

Create a step scaling policy with the appropriate ScaleUpPolicy and ScaleDownPolicy scaling policies. Create an Amazon CloudWatch alarm that triggers if the ApplicationFileUpload metric exceeds a target value. Configure the alarm action to reference the ScaleUpPolicy scaling policy. Create a second CloudWatch alarm that triggers if the ApplicationFileUpload metric falls below a target value. Configure the alarm action to reference the ScaleDownPolicy scaling policy.

C

Create a target tracking policy by using the CustomizedMetric Specification data type that references a target value for a metric. Configure the CustomizedMetricSpecification data type to use metric math that combines the ApplicationFileUpload metric (with sum statistic) and the ECS running task count (with average statistic) to calculate an UploadsPerTask metric that represents the number of files for each task.

D

Modify the application to publish a custom Amazon CloudWatch metric named Uploads PerTask. Configure the application to calculate the Uploads Per Task metric by using the existing ApplicationFileUploads metric and information from Amazon ECS about running tasks. Create a predictive scaling policy that uses a custom metric that references an ALBRequestCountPerTarget load metric, an Uploads PerTask scaling metric, and an appropriate target utilization

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 70

A DevOps Engineer is working on a project that is hosted on Amazon Linux and has failed a security review. The DevOps Manager has been asked to review the company buildspec.yaml file for an AWS CodeBuild project and provide recommendations. The buildspec.yaml file is configured as follows:

What changes should be recommended to comply with AWS security best practices? (Choose three.)

A

Add a post-build command to remove the temporary files from the container before termination to ensure they cannot be seen by other CodeBuild users.

B

Update the CodeBuild project role with the necessary permissions and then remove the AWS credentials from the environment variable.

C

Store the DB_PASSWORD as a SecureString value in AWS Systems Manager Parameter Store and then remove the DB_PASSWORD from the environment variables.

D

Move the environment variables to the ‘db-deploy-bucket’ Amazon S3 bucket, add a prebuild stage to download, then export the variables.

E

Use AWS Systems Manager run command versus scp and ssh commands directly to the instance.

F

Scramble the environment variables using XOR followed by Base64, add a section to install, and then run XOR and Base64 to the build phase.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 71

A company is migrating an application to Amazon Elastic Container Service (Amazon ECS). The company wants to consolidate log data in Amazon CloudWatch in the us-west-2 Region. No CloudWatch log groups currently exist for Amazon ECS

The company receives the following error code when an ECS task attempts to launch. "service my-service-name was unable to place a task because no container instance met all of its requirements." The ECS task definition includes the following container log configuration:

The ECS cluster uses an Amazon EC2 Auto Scaling group to provide capacity for tasks. EC2 instances launch an Amazon ECS-optimized AMI.

Which solution will fix the problem?

A

Modify the ECS infrastructure IAM role to add the logs: Create Log Stream and logs: Put Log Events permissions.

B

Modify the ECS log configuration to use blocking mode. OB

C

Modify the ECS container instance IAM role to add the logs: CreateLogStream and logs: PutLogEvents permissions.

D

Modify the ECS log configuration by setting the aws logs-create-group option to false

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 72

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:

Which type of events will match this event pattern?

A

Failed deploy and build actions across all the pipelines.

B

All rejected or failed approval actions across all the pipelines.

C

All the events across all pipelines.

D

Approval actions across all the pipelines.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 73

A company deploys its application by using AWS Code Pipeline. The pipeline deploys to a staging environment and then to a production environment if the staging deployment succeeds.

A recent production deployment was manually rolled back because a large amount of customer traffic caused unexpected system behavior. The company needs to configure the pipeline to prevent this issue in future deployments

Which solution will meet these requirements with the LEAST operational overhead?

A

Add the EC2 instance to an Auto Scaling group. Set the minimum, maximum, and desired capacity to 1.

B

Add the EC2 instance to an Auto Scaling group. Configure a lifecycle hook to detach the EBS volume if the EC2 instance shuts down or terminates.

C

Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric. Add an EC2 action to recover the instance when the alarm state is in ALARM.A

D

Create an Amazon CloudWatch alarm for the Network Out metric. Add an EC2 action to recover the instance when the alarm state is in INSUFFICIENT_DATA

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 74

A business has an application that consists of five independent AWS Lambda functions. The DevOps Engineer has built a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild that builds, tests, packages, and deploys each Lambda function in sequence. The pipeline uses an Amazon CloudWatch Events rule to ensure the pipeline execution starts as quickly as possible after a change is made to the application source code.

After working with the pipeline for a few months, the DevOps Engineer has noticed the pipeline takes too long to complete.

What should the DevOps Engineer implement to BEST improve the speed of the pipeline?

A

Modify the CodeBuild projects within the pipeline to use a compute type with more available network throughput.

B

Create a custom CodeBuild execution environment that includes a symmetric multiprocessing configuration to run the builds in parallel.

C

Modify the CodePipeline configuration to execute actions for each Lambda function in parallel by specifying the same runOrder.

D

Modify each CodeBuild project to run within a VPC and use dedicated instances to increase throughput.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 75

A company's applications run on Amazon EC2 instances and use AWS Lambda functions in multiple AWS accounts. All EC2 instances have the Amazon CloudWatch agent installed. All accounts belong to the same organization in AWS Organizations. The company has created a dedicated central log account.

All logs that the applications produce must be sent to a central location. The logs must be encrypted with keys that the company manages.

Which solution meets these requirements with the LEAST operational overhead?

A

In the central log account, enable logs as the data source in CloudWatch. Add the organization ID to the source account list. Create a CloudFormation StackSet by using the template provided by CloudWatch to enable central monitoring in all the organization's accounts.

B

Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in the central log account. Set the S3 bucket as the destination of the Firehose stream. Create a log subscription in the central log account. Set the Firehose stream as a target of the subscription. Store the subscription log ARN in AWS Systems Manager Parameter Store for each project to use to send logs to the S3 bucket.

C

Create an Amazon S3 bucket in each account. Create an Amazon OpenSearch Service cluster in the central log account. Create an Amazon Simple Queue Service (Amazon SQS) queue in the central log account. Create an S3 trigger that sends events to the SQS queue each time a new file is uploaded to the S3 bucket. Create a Lambda function that processes each file and sends each file to the OpenSearch Service cluster.

D

Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in each account. Set the S3 bucket as the destination of the Firehose streams. Create a log subscription in each account with the Firehose streams as a target

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 76

An Amazon EC2 instance with no internet access is running in a Virtual Private Cloud (VPC) and needs to download an object from a restricted Amazon S3 bucket. When the DevOps Engineer tries to gain access to the object, an AccessDenied error is received.

What are the possible causes for this error? (Choose three.)

A

The S3 bucket default encryption is enabled.

B

There is an error in the S3 bucket policy.

C

There is an error in the VPC endpoint policy.

D

The object has been moved to Amazon Glacier.

E

There is an error in the IAM role configuration.

F

S3 versioning is enabled

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 77

A DevOps engineer needs to configure an AWS CodePipeline pipeline that publishes container images to an Amazon Elastic Container Registry (Amazon ECR) repository. The pipeline must wait for the previous run to finish and must run when new Git tags are pushed to a Git repository that is connected to AWS CodeConnections. An existing deployment pipeline needs to run in response to the publication of new container images.

Which solution will meet these requirements?

A

Configure a CodePipeline V2 type pipeline that uses QUEUED mode. Add a trigger filter to the pipeline definition that includes all tags. Configure an Amazon EventBridge rule that matches container image pushes to start the existing deployment pipeline.

B

Configure a CodePipeline V2 type pipeline that uses SUPERSEDED mode. Add a trigger filter to the pipeline definition that includes all branches. Configure an Amazon EventBridge rule that matches container image pushes to start the existing deployment pipeline.

C

Configure a CodePipeline V1 type pipeline that uses SUPERSEDED mode. Add a trigger filter to the pipeline definition that includes all tags. Add a stage at the end of the pipeline to invoke the existing deployment pipeline.

D

Configure a CodePipeline V1 type pipeline that uses QUEUED mode. Add a trigger filter to the pipeline definition that includes all branches. Add a stage at the end of the pipeline to invoke the existing deployment pipeline.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 78

A large enterprise is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon RDS Oracle DB instance and Amazon DynamoDB. There are separate environments for development, testing, and production.

What is the MOST secure and flexible way to obtain password credentials during deployment?

A

Retrieve an access key from an AWS Systems Manager SecureString parameter to access AWS services. Retrieve the database credentials from a Systems Manager SecureString parameter.

B

Launch the EC2 instances with an EC2 IAM role to access AWS services. Retrieve the database credentials from AWS Secrets Manager.

C

Retrieve an access key from an AWS Systems Manager plaintext parameter to access AWS services. Retrieve the database credentials from a Systems Manager SecureString parameter.

D

Launch the EC2 instances with an EC2 IAM role to access AWS services. Store the database passwords in an encrypted config file with the application artifacts.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 79

A company is building a web application on AWS. The application uses AWS CodeConnections to access a Git repository The company sets up a pipeline in AWS CodePipeline that automatically builds and deploys the application to a staging environment when the company pushes code to the main branch. Bugs and integration issues sometimes occur in the main branch because there is no automated testing integrated into the pipeline.

The company wants to automatically run tests when code merges occur in the Git repository and to prevent deployments from reaching the staging environment if any test fails. Tests can run up to 20 minutes.

Which solution will meet these requirements?

A

Add an AWS CodeBuild action to the pipeline. Add a buildspec.yml file to the Git repository to define commands to run tests. Configure the pipeline to stop the deployment if a test fails.

B

Configure Git webhooks to initiate an AWS Lambda function during each code merge. Configure the Lambda function to run tests programmatically and to stop the pipeline if a test fails.

C

Configure AWS Batch to use Docker images of test environments. Integrate AWS Batch into the pipeline. Add an AWS Lambda function to the pipeline that submits the batch jobs and reverts the code merge if a test fails.

D

Configure the Git repository to push code to an Amazon S3 bucket during each code merge. Use S3 Event Notifications to initiate tests and to revert the code merge if a test fails.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 80

The Security team depends on AWS CloudTrail to detect sensitive security issues in the company’s AWS account. The DevOps Engineer needs a solution to auto-remediate CloudTrail being turned off in an AWS account.

What solution ensures the LEAST amount of downtime for the CloudTrail log deliveries?

A

Create an Amazon CloudWatch Events rule for the CloudTrail StopLogging event. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource in which StopLogging was called. Add the Lambda function ARN as a target to the CloudWatch Events rule.

B

Deploy the AWS-managed CloudTrail-enabled AWS Config rule, set with a periodic interval of 1 hour. Create an Amazon CloudWatch Events rule for AWS Config rules compliance change. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource in which StopLogging was called. Add the Lambda function ARN as a target to the CloudWatch Events rule.

C

Create an Amazon CloudWatch Events rule for a scheduled event every 5 minutes. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on a CloudTrail trail in the AWS account. Add the Lambda function ARN as a target to the CloudWatch Events rule.

D

Launch a t2.nano instance with a script running every 5 minutes that uses the AWS SDK to query CloudTrail in the current account. If the CloudTrail trail is disabled, have the script re-enable the trail.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 81

A development team manually builds a local artifact. The development team moves the artifact to an Amazon S3 bucket to support an application. The application has a local cache that must be cleared when the development team deploys the application to Amazon EC2 instances. For each deployment, the development team runs a command to clear the cache, download the artifact from the S3 bucket, and unzip the artifact to complete the deployment.

The development team wants to migrate the deployment process to a CI/CD process and to track the progress of each deployment.

Which combination of actions will meet these requirements with the MOST operational efficiency? (Select THREE.)

A Set up an AWS CodeConnections compatible Git repository. Allow developers to merge code into the repository. Use AWS CodeBuild to build an artifact and copy the object into the S3 bucket. Configure CodeBuild to run for every merge into the main branch.

B

Create a custom script to clear the cache. Specify the script in the Beforeinstall lifecycle hook in the AppSpec file.

C

Create user data for each EC2 instance that contains the cache clearing script. Test the application after deployment. If the deployment is not successful, then redeploy.

D

Use AWS CodePipeline to deploy the application. Set up an AWS CodeConnections compatible Git repository. Allow developers to merge code into the repository as a source for the pipeline.

E

A company has an organization in AWS Organizations for its multi-account environment. A DevOps engineer is developing an AWS CodeArtifact based strategy for application package management across the organization. Each application team at the company has its own account in the organization. Each application team also has limited access to a centralized shared services account.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 82

A company is testing a web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The company uses a blue/green deployment process with immutable instances when deploying new software.

During testing, users are being automatically logged out of the application at random times. Testers also report that, when a new version of the application is deployed, all users are logged out. The Development team needs a solution to ensure users remain logged in across scaling events and application deployments.

What is the MOST efficient way to ensure users remain logged in?

A

Enable smart sessions on the load balancer and modify the application to check for an existing session.

B

Enable session sharing on the load balancer and modify the application to read from the session store.

C

Store user session information in an Amazon S3 bucket and modify the application to read session information from the bucket.

D

Modify the application to store user session information in an Amazon ElastiCache cluster.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 83

A company has an application that streams logs to an Amazon CloudWatch Logs log group. The logs must be available for the team to search in CloudWatch for at least 30 days. Logs must be accessible with low latency for at least 90 days. After 180 days, log retrieval is rare and latency is not important.

A DevOps engineer creates an Amazon S3 bucket to store the logs. Log availability metrics and data protection are important to the company.

Which solution will meet these requirements in the MOST cost-effective way?

A

Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Kinesis Data Streams to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon Glacier Flexible Retrieval after 180 days.

B

Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 90 days and to Amazon S3 Glacier Flexible Retrieval after 180 days.

C

Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Kinesis Data Streams to send log events to the S3 bucket by writing files. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Instant Retrieval after 180 days.

D

Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Deep Archive after 180 days

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 84

A DevOps Engineer manages a large commercial website that runs on Amazon EC2. The website uses Amazon Kinesis Data Streams to collect and process web logs. The DevOps Engineer manages the Kinesis consumer application, which also runs on Amazon EC2.

Sudden increases of data cause the Kinesis consumer application to fall behind, and the streams drop records before they can be processed. The DevOps engineer must implement a solution to improve stream handling.

What is the FASTEST method to improve stream handling?

A

Modify the Kinesis consumer application to store the logs durably in Amazon S3. Use Amazon EMR to process the data directly on S3 to derive customer insights and store the results in S3.

B

Horizontally scale the Kinesis consumer application by adding more EC2 instances based on the GetRecord.IteratorAgeMilliseconds Amazon CloudWatch metric. Increase the Kinesis Data Streams retention period.

C

Convert the Kinesis consumer application to run as an AWS Lambda function. Configure the Kinesis Data Streams as the event source for the Lambda function to process the data streams.

D

Increase the number of shards in the Kinesis Data Streams to increase the overall throughput so that the consumer processes data faster.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 85

A company is developing a mobile app that requires extensive automated testing across multiple device types. The company is using AWS CodePipeline for its CI/CD pipeline.

The company must implement a scalable testing solution that can handle increased test loads as the app grows.

Which solution will meet these requirements with the LEAST management overhead?

A

Integrate AWS Device Farm with the pipeline to run the tests and scale as needed.

B

Deploy a fleet of Amazon EC2 instances with various mobile device emulators and auto scaling to run the tests. Create a custom AWS Lambda function to invoke EC2 test runs.

C

Implement a containerized testing solution that uses Amazon Elastic Container Service (Amazon ECS) with auto scaling. Configure the pipeline to invoke an AWS Lambda function to start the test runs on the ECS cluster.

D

Use AWS Lambda functions with custom runtime emulators to run the tests. Integrate the Lambda functions with the pipeline

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 86

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.

The buildspec.yml file contains the following:

The DevOps Engineer has noticed that anybody with an AWS account is able to download the artifacts.

What steps should the DevOps Engineer take to stop this?

A

Modify the post_build to command to use –-acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only.

B

Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access.

C

Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal “*”

D

Modify the post_build command to remove –-acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 87

A company uses Amazon Elastic Kubernetes Services (Amazon EKS) to host containerized applications that are available in Amazon Elastic Container Registry (Amazon ECR).

The company currently launches EKS clusters in the company's development environment by using the AWS CLI aws eks create-cluster command. The company uses the aws eks create-addon command to install required add-ons. All installed add-ons are currently version compatible with the version of Kubernetes that the company uses. All clusters exclusively use managed node groups for compute capacity.

Some of the EKS clusters require a version upgrade. A DevOps engineer must ensure that upgrades continuously occur within the AWS standard support schedule.

Which solution will meet this requirement with the LEAST operational overhead?

A

Run the aws eks update-cluster-version command. Providing appropriate arguments such as cluster name and version number.

B

Enable EKS Auto Mode on all EKS clusters. Remove all existing managed node groups.

C

Run the eksctl command to upgrade the EKS clusters. Provide appropriate arguments such as cluster name and version number.

D

Refactor the environment to create EKS clusters by using infrastructure as code (laC). Upgrade the clusters by using code changes

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 88

A company has developed an AWS Lambda function that handles orders received through an API. The company is using AWS CodeDeploy to deploy the Lambda function as the final stage of a CI/CD pipeline.

A DevOps Engineer has noticed there are intermittent failures of the ordering API for a few seconds after deployment. After some investigation, the DevOps Engineer believes the failures are due to database changes not having fully propagated before the Lambda function begins executing.

How should the DevOps Engineer overcome this?

A

Add a BeforeAllowTraffic hook to the AppSpec file that tests and waits for any necessary database changes before traffic can flow to the new version of the Lambda function.

B

Add an AfterAllowTraffic hook to the AppSpec file that forces traffic to wait for any pending database changes before allowing the new version of the Lambda function to respond.

C

Add a BeforeInstall hook to the AppSpec file that tests and waits for any necessary database changes before deploying the new version of the Lambda function.

D

Add a ValidateService hook to the AppSpec file that inspects incoming traffic and rejects the payload if dependent services, such as the database, are not yet ready.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 89

A DevOps engineer is building a photo sharing website that gives users the ability to upload photos and to view photos that other users share. Users upload photos to an Amazon S3 bucket by using presigned URLs.

The DevOps engineer must ensure that photos are scanned for malware before the website returns the photos to other users.

Which combination of steps will meet these requirements? (Select TWO.)

A

Enable Amazon GuardDuty S3 Protection. Create an AWS Lambda function to process S3 Protection findings and block access to any referenced objects.

B

Create a bucket policy for the S3 bucket. Update the IAM role that the website uses to restrict access to uploaded photos by using tag-based access control (TBAC).

C

Create a resource-based policy for the S3 bucket. Restrict access to uploaded photos by using the aws:Secure Transport condition key.

D

Enable Amazon Macie. Create an AWS Lambda function to process Macie findings and delete any referenced objects that contain malware.

E

Enable Amazon GuardDuty Malware Protection for S3 with object tagging

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 90

A company uses Amazon S3 to store proprietary information. The Development team creates buckets for new projects on a daily basis. The Security team wants to ensure that all existing and future buckets have encryption, logging, and versioning enabled. Additionally, no buckets should ever be publicly read or write accessible.

What should a DevOps Engineer do to meet these requirements?

A

Enable AWS CloudTrail and configure automatic remediation using AWS Lambda.

B

Enable AWS Config rules and configure automatic remediation using AWS Systems Manager documents.

C

Enable AWS Trusted Advisor and configure automatic remediation using Amazon CloudWatch Events.

D

Enable AWS Systems Manager and configure automatic remediation using Systems Manager documents.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 91

A company is running an application on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs to implement comprehensive logging for the control plane and the nodes. The company must analyze API requests to the Kubernetes control plane and must monitor container performance on the nodes.

Which solution will meet these requirements with the LEAST operational overhead?

A

Enable AWS CloudTrail for control plane logging. Deploy Logstash as a ReplicaSet on the nodes to collect logs from the nodes. Use Amazon OpenSearch Service to store and analyze the logs for the control plane and the nodes.

B

Enable control plane logging for the EKS cluster. Send the logs to Amazon CloudWatch. Use CloudWatch Container Insights to collect logs for the nodes and the containers. Use CloudWatch Logs Insights to query and analyze the logs for the control plane and the nodes.

C

Enable API server control plane logging for the EKS cluster. Send the logs to Amazon S3. Deploy Kubernetes Event Exporter to the nodes to collect logs from the nodes. Send the logs to Amazon S3. Use Amazon Athena to query logs for the control plane and the nodes. Use Amazon QuickSight for visualization.

D

Use AWS Distro for Open Telemetry to collect logs for the control plane and the nodes. Stream all the logs to Amazon Data Firehose. Use Amazon Redshift to analyze the aggregated log data for the control plane and the nodes.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 92

A highly regulated company has a policy that DevOps Engineers should not log in to their Amazon EC2 instances except in emergencies. If a DevOps Engineer does log in, the Security team must be notified within 15 minutes of the occurrence.

Which solution will meet these requirements?

A

Install the Amazon Inspector agent on each EC2 instance. Subscribe to Amazon CloudWatch Events notifications. Trigger an AWS Lambda function to check if a message is about user logins. If it is, send a notification to the Security team using Amazon SNS.

B

Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user logins. If a login is found, send a notification to the Security team using Amazon SNS.

C

Set up AWS CloudTrail with Amazon CloudWatch Logs. Subscribe CloudWatch Logs to Amazon Kinesis. Attach AWS Lambda to Kinesis to parse and determine if a log contains a user login. If it does, send a notification to the Security team using Amazon SNS.

D

Set up a script on each Amazon EC2 instance to push all logs to Amazon S3. Set up an S3 event to trigger an AWS Lambda function, which triggers an Amazon Athena query to run. The Athena query checks for logins and sends the output to the Security team using Amazon SNS.

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 93

A DevOps engineer needs to implement a CI/CD pipeline that uses AWS CodeBuild to run a test suite. The test suite contains many test cases and takes a long time to finish running. The DevOps engineer wants to reduce the duration to run the tests. However, the DevOps engineer still wants to generate a single test report for all the test cases.

Which solution will meet these requirements?

A

Run the test suite in a batch build type of build matrix by using the codebuild-tests-run command.

B

Run the test suite in a batch build type of build fanout by using the codebuild-tests-run command.

C

Run the test suite in a batch build type of build list by using different subsets of the test cases.

D

Run the test suite in a batch build type of build graph by using different subsets of the test cases

Premium Solution Locked

Unlock all 469 answers & explanations

QUESTION 94

An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). A DevOps Engineer is using AWS CodeDeploy to release a new version. The deployment fails during the AllowTraffic lifecycle event, but a cause for the failure is not indicated in the deployment logs.

What would cause this?

A

The appspec.yml file contains an invalid script to execute in the AllowTraffic lifecycle hook.

B

The user who initiated the deployment does not have the necessary permissions to interact with the ALB.

C

The health checks specified for the ALB target group are misconfigured.

D

The CodeDeploy agent was not installed in the EC2 instances that are part of the ALB target group.Correct Answer: CExplanation/

Premium Solution Locked

Unlock all 469 answers & explanations

Amazon AWS Certified DevOps Engineer - Professional (DOP-C02)

Test the Practice Engine

Premium Bundle

Standard Simulation

Basic Tier

Verified Community

Success Network

Exam Overview

Skills Measured

Career Path

Common Questions

Is the material up to date?

What format do I get?

Is there a guarantee?

When do I get the download?

Free Study Guide Samples

Full Question Bank Locked

Certification Path

Related Certifications

Customer Reviews

David M.

Sarah J.

Michael C.

Need Assistance?

Get Exam Updates