A company has an AWS CodePipeline pipeline in the eu-west-1 Region. The pipeline stores the build artifacts in an Amazon S3 bucket. The pipeline builds and deploys an AWS Lambda function by using an AWS CloudFormation deploy action.
A DevOps engineer needs to update the existing pipeline to also deploy the Lambda function to the us-east-1 Region. The pipeline has already been updated to create an additional artifact to deploy to us-east-1.
Which combination of steps should the DevOps engineer take to meet these requirements? (Choose two.)
A. Modify the CloudFormation template to include a parameter for the Lambda function code's .zip file location. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to pass in the us-east-1 artifact location as a parameter override.
B. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the additional artifact that was created for us-east-1.
C. Create an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have read and write access.
D. Create an S3 bucket in us-east-1. Configure S3 Cross-Region Replication (CRR) from the S3 bucket in eu-west-1 to the S3 bucket in us-east-1.
E. Modify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 artifact.
Show Answer
Correct Answer: C, E
Explanation: For cross-Region actions, CodePipeline requires an artifact store in each Region where actions run. Therefore, create an S3 artifact bucket in us-east-1 and configure the pipeline to use it as the artifact store. Then add a CloudFormation deploy action in us-east-1 that consumes the us-east-1 artifact. Cross-Region Replication is not required because CodePipeline manages cross-Region artifacts via the configured regional artifact stores. Passing only a ZIP location parameter is insufficient, and simply pointing to a different template artifact without configuring a regional artifact store will not enable cross-Region deployment.
Question 104
A company has deployed an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 node groups. The company's DevOps team uses the Kubernetes Horizontal Pod Autoscaler and recently installed a supported EKS cluster Autoscaler.
The DevOps team needs to implement a solution to collect metrics and logs of the EKS cluster to establish a baseline for performance. The DevOps team will create an initial set of thresholds for specific metrics and will update the thresholds over time as the cluster is used. The DevOps team must receive an Amazon Simple Notification Service (Amazon SNS) email notification if the initial set of thresholds is exceeded or if the EKS cluster Autoscaler is not functioning properly.
The solution must collect cluster, node, and pod metrics. The solution also must capture logs in Amazon CloudWatch.
Which combination of steps should the DevOps team take to meet these requirements? (Choose three.)
A. Deploy the CloudWatch agent and Fluent Bit to the cluster. Ensure that the EKS cluster has appropriate permissions to send metrics and logs to CloudWatch.
B. Deploy AWS Distro for OpenTelemetry to the cluster. Ensure that the EKS cluster has appropriate permissions to send metrics and logs to CloudWatch.
C. Create CloudWatch alarms to monitor the CPU, memory, and node failure metrics of the cluster. Configure the alarms to send an SNS email notification to the DevOps team if thresholds are exceeded.
D. Create a CloudWatch composite alarm to monitor a metric log filter of the CPU, memory, and node metrics of the cluster. Configure the alarm to send an SNS email notification to the DevOps team when anomalies are detected.
E. Create a CloudWatch alarm to monitor the logs of the Autoscaler deployments for errors. Configure the alarm to send an SNS email notification to the DevOps team if thresholds are exceeded.
F. Create a CloudWatch alarm to monitor a metric log filter of the Autoscaler deployments for errors. Configure the alarm to send an SNS email notification to the DevOps team if thresholds are exceeded.
Show Answer
Correct Answer: A, C, F
Explanation: Use the CloudWatch agent with Fluent Bit to collect EKS cluster, node, and pod metrics plus container logs into CloudWatch. Create CloudWatch alarms on key performance metrics such as CPU, memory, and node health with SNS notifications for threshold breaches. To detect Cluster Autoscaler failures, create a metric filter from the Autoscaler logs for error patterns and alarm on that metric, sending SNS notifications. Composite alarms with log filters are not appropriate for the primary resource metrics, and a CloudWatch alarm cannot directly alarm on logs without a metric filter.
Question 105
A company uses AWS Systems Manager to manage a fleet of Amazon Linux EC2 instances that have SSM Agent installed. All EC2 instances are configured to use Instance Metadata Service Version 2 (IMDSv2) and are running in the same AWS account and AWS Region. Company policy requires developers to use only Amazon Linux.
The company wants to ensure that all new EC2 instances are automatically managed by Systems Manager after creation.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an IAM role that has a trust policy that allows Systems Manager to assume the role. Attach the AmazonSSMManagedEC2InstanceDefaultPolicy policy to the role. Configure the default-ec2-instance-management-role SSM service setting to use the role.
B. Ensure that AWS Config is set up. Create an AWS Config rule that validates if an EC2 instance has SSM Agent installed. Configure the rule to run on EC2 configuration changes. Configure automatic remediation for the rule to run the AWS-InstallSSMAgent SSM document to install SSM Agent.
C. Configure Systems Manager Patch Manager. Create a patch baseline that automatically installs SSM Agent on all new EC2 instances. Create a patch group for all EC2 instances. Attach the patch baseline to the patch group. Create a maintenance window and maintenance window task to start installing SSM Agent daily.
D. Create an EC2 instance role that has a trust policy that allows Amazon EC2 to assume the role. Attach the AmazonSSMManagedInstanceCore policy to the role. Ensure that AWS Config is set up. Use the ec2-instance-profile-attached managed AWS Config rule to validate if an EC2 instance has the role attached. Configure the rule to run on EC2 configuration changes. Configure automatic remediation for the rule to run the AWS-SetupManagedRoleOnEc2Instance SSM document to attach the role to the EC2 instance.
Show Answer
Correct Answer: A
Explanation: Amazon Linux AMIs already include the SSM Agent. For IMDSv2-enabled Amazon Linux instances in the same account and Region, configuring the Systems Manager default EC2 instance management role (default-ec2-instance-management-role) with a role that has the AmazonSSMManagedEC2InstanceDefaultPolicy allows newly created instances to be automatically managed without attaching an instance profile to each instance. The other options add unnecessary AWS Config or Patch Manager remediation or rely on attaching instance profiles after launch, making them less operationally efficient.
Question 106
A company uses Amazon Elastic Container Registry (Amazon ECR) private registries to store container images.
A DevOps team needs to ensure that the container images are regularly scanned for software package vulnerabilities.
Which solution will meet this requirement?
A. Enable enhanced scanning for private registries in Amazon ECR.
B. Enable basic continuous scanning for private registries in Amazon ECR.
C. Create an AWS System Manager Automation document to scan images by using the AWS SDK. Configure the Automation document to run when a new image is pushed to an ECR registry.
D. Create an AWS Lambda function that scans all images in Amazon ECR by using the AWS SDK. Create an Amazon EventBridge rule to invoke the Lambda function each day.
Show Answer
Correct Answer: A
Explanation: Amazon ECR enhanced scanning integrates with Amazon Inspector to provide continuous vulnerability scanning and automatic rescanning of container images as new CVEs are published. Basic scanning does not provide continuous rescanning, and custom Systems Manager or Lambda solutions add unnecessary operational overhead compared to the managed feature.
Question 107
A company uses an AWS Cloud Development Kit (AWS CDK) application for its infrastructure. The AWS CDK application creates AWS Lambda functions and the IAM roles that are attached to the functions. The company also uses AWS Organizations. The company's developers can assume the AWS CDK application deployment role.
The company's security team discovered that the developers and the role used to deploy the AWS CDK application have more permissions than necessary. The security team also discovered that the roles attached to the Lambda functions that the CDK application creates have more permissions than necessary. The developers must not have the ability to grant additional permissions.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role and the AWS CDK application deployment role. Centrally create new IAM roles to attach to the Lambda functions for the developers to use to provision Lambda functions.
B. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Update the account's AWS CDK bootstrapping to use the permission boundary. Update the configuration in the AWS CDK application for the default permissions boundary to use the policy.
C. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Instruct the developers to use the permission boundary policy name when they create a role in the AWS CDK application code.
D. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role. Give the AWS CDK deployment role access to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to verify that the Lambda functions role does not have permissions.
Show Answer
Correct Answer: B
Explanation: Using IAM permissions boundaries integrated into the AWS CDK bootstrap and configured as the default permissions boundary ensures that the CDK deployment role cannot create roles with permissions beyond the defined maximum, and all IAM roles created by the CDK application (including Lambda execution roles) automatically receive the boundary. This prevents developers from granting additional permissions through newly created roles while preserving the CDK workflow and minimizing operational overhead. The SCP options either prevent necessary role creation or require centralized/manual role management, increasing operational effort. Simply instructing developers to apply a boundary relies on manual compliance and is weaker than enforcing it through CDK bootstrapping.
Question 108
A company uses an organization in AWS Organizations to manage 10 AWS accounts. All features are enabled, and trusted access for AWS CloudFormation is enabled.
A DevOps engineer needs to use CloudFormation to deploy an IAM role to the Organizations management account and all member accounts in the organization.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target.
B. Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
C. Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target.
D. Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
Show Answer
Correct Answer: B
Explanation: Use a CloudFormation StackSet with service-managed permissions to minimize operational overhead because AWS Organizations manages the required permissions. However, service-managed StackSets do not deploy stack instances to the AWS Organizations management account. Therefore, target the root OU for all member accounts and deploy a separate CloudFormation stack in the management account to create the IAM role.
Question 109
A company uses an organization in AWS Organizations to manage its 500 AWS accounts. The organization has all features enabled. The AWS accounts are in a single OU. The developers need to use the CostCenter tag key for all resources in the organization's member accounts. Some teams do not use the CostCenter tag key to tag their Amazon EC2 instances.
The cloud team wrote a script that scans all EC2 instances in the organization's member accounts. If the EC2 instances do not have a CostCenter tag key, the script will notify AWS account administrators. To avoid this notification, some developers use the CostCenter tag key with an arbitrary string in the tag value.
The cloud team needs to ensure that all EC2 instances in the organization use a CostCenter tag key with the appropriate cost center value.
Which solution will meet these requirements?
A. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Update the script to scan the tag keys and tag values. Modify the script to update noncompliant resources with a default approved tag value for the CostCenter tag key.
B. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Update the script to scan the tag keys and tag values and notify the administrators when the tag values are not valid.
C. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Create an IAM permission boundary in the organization's member accounts that restricts the CostCenter tag values to a list of valid cost centers.
D. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Configure an AWS Lambda function that adds an empty CostCenter tag key to an EC2 instance. Create an Amazon EventBridge rule that matches events to the RunInstances API action with the Lambda function as the target.
Show Answer
Correct Answer: A
Explanation: An SCP can deny launching EC2 instances unless the required CostCenter tag key is provided. A tag policy can standardize and validate the allowed CostCenter tag values across the organization. Because tag policies primarily provide compliance evaluation and standardization rather than hard enforcement of values at the API level, updating the existing compliance script to check both key and value and remediate noncompliant resources addresses existing instances and invalid values. The other options either fail to validate values adequately, rely on permission boundaries in a way that is not appropriate organization-wide, or use tag policies/Lambda in ways that do not ensure valid cost center values.
Question 110
A company has an organization in AWS Organizations with many Oils that contain many AWS accounts. The organization has a dedicated delegated administrator AWS account.
The company needs the accounts in one OU to have server-side encryption enforced for all Amazon Elastic Block Store (Amazon EBS) volumes and Amazon Simple Queue Service (Amazon SQS) queues that are created or updated on an AWS CloudFormation stack.
Which solution will enforce this policy before a CloudFormation stack operation in the accounts of this OU?
A. Activate trusted access to CloudFormation StackSets. Create a CloudFormation Hook that enforces server-side encryption on EBS volumes and SQS queues. Deploy the Hook across the accounts in the OU by using StackSets.
B. Set up AWS Config in all the accounts in the OU. Use AWS Systems Manager to deploy AWS Config rules that enforce server-side encryption for EBS volumes and SQS queues across the accounts in the OU.
C. Write an SCP to deny the creation of EBS volumes and SQS queues unless the EBS volumes and SQS queues have server-side encryption. Attach the SCP to the OU.
D. Create an AWS Lambda function in the delegated administrator account that checks whether server-side encryption is enforced for EBS volumes and SQS queues. Create an IAM role to provide the Lambda function access to the accounts in the OU.
Show Answer
Correct Answer: A
Explanation: CloudFormation Hooks are specifically designed to validate and enforce policy before CloudFormation creates or updates resources. A Hook can reject stack operations that attempt to create or update EBS volumes or SQS queues without server-side encryption. Using CloudFormation StackSets with trusted access allows the Hook to be deployed consistently across all accounts in the target OU. AWS Config detects noncompliance after deployment rather than blocking stack operations, SCPs cannot inspect CloudFormation template properties such as encryption settings for these resources, and a Lambda solution is not integrated into the CloudFormation pre-provisioning workflow.
Question 111
A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health.
The DevOps engineer must implement an automated solution that uses Amazon EventBridge to remediate the notifications during the company's scheduled maintenance windows.
How should the DevOps engineer configure an EventBridge rule to meet these requirements?
A. Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
B. Configure an event source of Systems Manager. Configure an event type that indicates a maintenance window. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
C. Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.
D. Configure an event source of EC2. Configure an event type that indicates instance state notification. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.
Show Answer
Correct Answer: C
Explanation: The requirement is not only to react to AWS Health notifications but to remediate them during the company's scheduled Systems Manager maintenance windows. AWS Health should be the EventBridge source because it emits scheduled instance retirement/termination notifications. Targeting the Automation runbook directly would execute immediately when the event arrives, not during a maintenance window. Using a Lambda function to register or schedule the Systems Manager maintenance window task allows the restart to occur in the defined maintenance window, satisfying the timing requirement.
Question 112
A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM).
The IAM team wants to implement AWS IAM Identity Center. The IAM team must have only the minimum required permissions to manage IAM Identity Center. The IAM team must not be able to gain unnecessary access to the Organizations management account. The IAM team must be able to provision new IAM Identity Center permission sets and assignments for new and existing member accounts.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account for the IAM team. Enable IAM Identity Center in the new account. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
B. Create a new AWS account for the IAM team. Enable IAM Identity Center in the Organizations management account. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
C. Create an SCP in Organizations. Create a new OU for the Organizations management account, and link the new SCP to the OU. Configure the SCP to deny all access to IAM Identity Center.
D. Create IAM users and an IAM group for the IAM team in IAM Identity Center. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group.
E. Assign the new permission set to the Organizations management account. Allow the IAM team's group to use the permission set.
F. Assign the new permission set to the new AWS account. Allow the IAM team's group to use the permission set.
Show Answer
Correct Answer: B, D, F
Explanation: IAM Identity Center must be enabled in the Organizations management account before delegating administration to a member account. A dedicated member account can then be registered as the delegated administrator. The IAM team should use IAM Identity Center with a permission set based on the AWSSSOMemberAccountAdministrator managed policy, and that permission set should be assigned in the delegated administrator account for the IAM team to manage permission sets and assignments with least privilege. Denying IAM Identity Center via an SCP on the management account is unnecessary, and assigning the permission set to the management account would provide access there rather than isolating administration.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.