A company has deployed an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 node groups. The company's DevOps team uses the Kubernetes Horizontal Pod Autoscaler and recently installed a supported EKS cluster Autoscaler.
The DevOps team needs to implement a solution to collect metrics and logs of the EKS cluster to establish a baseline for performance. The DevOps team will create an initial set of thresholds for specific metrics and will update the thresholds over time as the cluster is used. The DevOps team must receive an Amazon Simple Notification Service (Amazon SNS) email notification if the initial set of thresholds is exceeded or if the EKS cluster Autoscaler is not functioning properly.
The solution must collect cluster, node, and pod metrics. The solution also must capture logs in Amazon CloudWatch.
Which combination of steps should the DevOps team take to meet these requirements? (Choose three.)
A. Deploy the CloudWatch agent and Fluent Bit to the cluster. Ensure that the EKS cluster has appropriate permissions to send metrics and logs to CloudWatch.
B. Deploy AWS Distro for OpenTelemetry to the cluster. Ensure that the EKS cluster has appropriate permissions to send metrics and logs to CloudWatch.
C. Create CloudWatch alarms to monitor the CPU, memory, and node failure metrics of the cluster. Configure the alarms to send an SNS email notification to the DevOps team if thresholds are exceeded.
D. Create a CloudWatch composite alarm to monitor a metric log filter of the CPU, memory, and node metrics of the cluster. Configure the alarm to send an SNS email notification to the DevOps team when anomalies are detected.
E. Create a CloudWatch alarm to monitor the logs of the Autoscaler deployments for errors. Configure the alarm to send an SNS email notification to the DevOps team if thresholds are exceeded.
F. Create a CloudWatch alarm to monitor a metric log filter of the Autoscaler deployments for errors. Configure the alarm to send an SNS email notification to the DevOps team if thresholds are exceeded.
Show Answer
Correct Answer: A, C, F
Explanation: To meet the requirements, the team must (1) collect cluster, node, and pod metrics and logs, and (2) configure alerting for performance thresholds and Autoscaler failures.
A is correct because deploying the CloudWatch agent with Fluent Bit is the standard EKS-supported approach to send container logs and detailed cluster, node, and pod metrics to Amazon CloudWatch.
C is correct because CloudWatch alarms on CPU, memory, and node-related metrics allow the team to define and iteratively adjust thresholds and receive SNS email notifications when those thresholds are exceeded.
F is correct because creating a metric filter on the Cluster Autoscaler logs and alarming on error patterns is the appropriate way to detect when the Autoscaler is not functioning properly and notify the team via SNS.
The other options are less suitable: D focuses on anomaly detection rather than explicit thresholds, E does not use metric filters (which are required for alarming on logs), and B is not necessary since CloudWatch agent with Fluent Bit already fulfills the metrics and logs requirement.
Question 67
A company uses AWS Systems Manager to manage a fleet of Amazon Linux EC2 instances that have SSM Agent installed. All EC2 instances are configured to use Instance Metadata Service Version 2 (IMDSv2) and are running in the same AWS account and AWS Region. Company policy requires developers to use only Amazon Linux.
The company wants to ensure that all new EC2 instances are automatically managed by Systems Manager after creation.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an IAM role that has a trust policy that allows Systems Manager to assume the role. Attach the AmazonSSMManagedEC2InstanceDefaultPolicy policy to the role. Configure the default-ec2-instance-management-role SSM service setting to use the role.
B. Ensure that AWS Config is set up. Create an AWS Config rule that validates if an EC2 instance has SSM Agent installed. Configure the rule to run on EC2 configuration changes. Configure automatic remediation for the rule to run the AWS-InstallSSMAgent SSM document to install SSM Agent.
C. Configure Systems Manager Patch Manager. Create a patch baseline that automatically installs SSM Agent on all new EC2 instances. Create a patch group for all EC2 instances. Attach the patch baseline to the patch group. Create a maintenance window and maintenance window task to start installing SSM Agent daily.
D. Create an EC2 instance role that has a trust policy that allows Amazon EC2 to assume the role. Attach the AmazonSSMManagedInstanceCore policy to the role. Ensure that AWS Config is set up. Use the ec2-instance-profile-attached managed AWS Config rule to validate if an EC2 instance has the role attached. Configure the rule to run on EC2 configuration changes. Configure automatic remediation for the rule to run the AWS-SetupManagedRoleOnEc2Instance SSM document to attach the role to the EC2 instance.
Show Answer
Correct Answer: A
Explanation: Amazon Linux already includes SSM Agent, so the remaining requirement is automatic permission and registration with Systems Manager. Configuring the default-ec2-instance-management-role SSM service setting with an IAM role that has AmazonSSMManagedEC2InstanceDefaultPolicy ensures all newly created EC2 instances automatically assume the correct role and are managed by Systems Manager without additional configuration. This is the most operationally efficient approach compared to using AWS Config rules or maintenance workflows.
Question 68
A company uses Amazon Elastic Container Registry (Amazon ECR) private registries to store container images.
A DevOps team needs to ensure that the container images are regularly scanned for software package vulnerabilities.
Which solution will meet this requirement?
A. Enable enhanced scanning for private registries in Amazon ECR.
B. Enable basic continuous scanning for private registries in Amazon ECR.
C. Create an AWS System Manager Automation document to scan images by using the AWS SDK. Configure the Automation document to run when a new image is pushed to an ECR registry.
D. Create an AWS Lambda function that scans all images in Amazon ECR by using the AWS SDK. Create an Amazon EventBridge rule to invoke the Lambda function each day.
Show Answer
Correct Answer: A
Explanation: The requirement is for container images in Amazon ECR private registries to be regularly scanned for vulnerabilities. Amazon ECR enhanced scanning provides continuous vulnerability scanning, including automatic rescans when new vulnerabilities are discovered, using Amazon Inspector. Basic scanning only scans on image push and is not continuous. The custom automation or Lambda options add unnecessary operational complexity compared to the fully managed enhanced scanning feature. Therefore, enabling enhanced scanning best meets the requirement.
Question 69
A company uses an AWS Cloud Development Kit (AWS CDK) application for its infrastructure. The AWS CDK application creates AWS Lambda functions and the IAM roles that are attached to the functions. The company also uses AWS Organizations. The company's developers can assume the AWS CDK application deployment role.
The company's security team discovered that the developers and the role used to deploy the AWS CDK application have more permissions than necessary. The security team also discovered that the roles attached to the Lambda functions that the CDK application creates have more permissions than necessary. The developers must not have the ability to grant additional permissions.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role and the AWS CDK application deployment role. Centrally create new IAM roles to attach to the Lambda functions for the developers to use to provision Lambda functions.
B. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Update the account's AWS CDK bootstrapping to use the permission boundary. Update the configuration in the AWS CDK application for the default permissions boundary to use the policy.
C. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Instruct the developers to use the permission boundary policy name when they create a role in the AWS CDK application code.
D. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role. Give the AWS CDK deployment role access to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to verify that the Lambda functions role does not have permissions.
Show Answer
Correct Answer: B
Explanation: Using an IAM permission boundary integrated into the AWS CDK bootstrap and configured as the default boundary ensures that neither developers nor the CDK deployment role can grant permissions beyond the defined maximum. This automatically constrains all IAM roles created by the CDK application, including Lambda execution roles, enforces least privilege proactively, and requires minimal ongoing management. It avoids manual role creation, reactive analysis, or reliance on developer discipline, resulting in the least operational overhead.
Question 70
A company uses an organization in AWS Organizations to manage 10 AWS accounts. All features are enabled, and trusted access for AWS CloudFormation is enabled.
A DevOps engineer needs to use CloudFormation to deploy an IAM role to the Organizations management account and all member accounts in the organization.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target.
B. Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
C. Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target.
D. Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
Show Answer
Correct Answer: B
Explanation: CloudFormation StackSets with service-managed permissions cannot deploy stack instances to the AWS Organizations management account, even if the management account is included in the root OU. Therefore, using only a StackSet (option A) would deploy the IAM role to all member accounts but not to the management account. To meet the requirement of deploying the IAM role to both the management account and all member accounts with the least operational overhead, the correct approach is to use a service-managed StackSet targeting the root OU for member accounts and deploy a separate CloudFormation stack directly in the management account.
Question 71
A company uses an organization in AWS Organizations to manage its 500 AWS accounts. The organization has all features enabled. The AWS accounts are in a single OU. The developers need to use the CostCenter tag key for all resources in the organization's member accounts. Some teams do not use the CostCenter tag key to tag their Amazon EC2 instances.
The cloud team wrote a script that scans all EC2 instances in the organization's member accounts. If the EC2 instances do not have a CostCenter tag key, the script will notify AWS account administrators. To avoid this notification, some developers use the CostCenter tag key with an arbitrary string in the tag value.
The cloud team needs to ensure that all EC2 instances in the organization use a CostCenter tag key with the appropriate cost center value.
Which solution will meet these requirements?
A. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Update the script to scan the tag keys and tag values. Modify the script to update noncompliant resources with a default approved tag value for the CostCenter tag key.
B. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Update the script to scan the tag keys and tag values and notify the administrators when the tag values are not valid.
C. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Create an IAM permission boundary in the organization's member accounts that restricts the CostCenter tag values to a list of valid cost centers.
D. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Configure an AWS Lambda function that adds an empty CostCenter tag key to an EC2 instance. Create an Amazon EventBridge rule that matches events to the RunInstances API action with the Lambda function as the target.
Show Answer
Correct Answer: A
Explanation: The requirement is to enforce both the presence of the CostCenter tag key and the correctness of its value across all EC2 instances in all member accounts. An SCP can prevent launching EC2 instances without the CostCenter tag key. A tag policy can define and enforce an allowed list of valid cost center values at the organization/OU level. Together, these address the root cause of arbitrary values. Updating the existing script to detect invalid values and remediate or apply a default approved value ensures ongoing compliance for existing resources. Other options either do not validate tag values effectively or rely on mechanisms (permission boundaries or Lambda tagging after launch) that cannot fully enforce correct values organization-wide.
Question 72
A company has an organization in AWS Organizations with many Oils that contain many AWS accounts. The organization has a dedicated delegated administrator AWS account.
The company needs the accounts in one OU to have server-side encryption enforced for all Amazon Elastic Block Store (Amazon EBS) volumes and Amazon Simple Queue Service (Amazon SQS) queues that are created or updated on an AWS CloudFormation stack.
Which solution will enforce this policy before a CloudFormation stack operation in the accounts of this OU?
A. Activate trusted access to CloudFormation StackSets. Create a CloudFormation Hook that enforces server-side encryption on EBS volumes and SQS queues. Deploy the Hook across the accounts in the OU by using StackSets.
B. Set up AWS Config in all the accounts in the OU. Use AWS Systems Manager to deploy AWS Config rules that enforce server-side encryption for EBS volumes and SQS queues across the accounts in the OU.
C. Write an SCP to deny the creation of EBS volumes and SQS queues unless the EBS volumes and SQS queues have server-side encryption. Attach the SCP to the OU.
D. Create an AWS Lambda function in the delegated administrator account that checks whether server-side encryption is enforced for EBS volumes and SQS queues. Create an IAM role to provide the Lambda function access to the accounts in the OU.
Show Answer
Correct Answer: A
Explanation: The requirement is to enforce encryption **before** a CloudFormation stack create or update in accounts within a specific OU. CloudFormation Hooks are specifically designed to perform pre-provisioning validation and can block stack operations if resources (EBS volumes or SQS queues) do not have server-side encryption enabled. By activating trusted access and deploying the Hook via CloudFormation StackSets, the policy can be centrally enforced across all accounts in the OU. AWS Config and Lambda are post-deployment or detective controls, and SCPs cannot inspect CloudFormation template properties with the required granularity.
Question 73
A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health.
The DevOps engineer must implement an automated solution that uses Amazon EventBridge to remediate the notifications during the company's scheduled maintenance windows.
How should the DevOps engineer configure an EventBridge rule to meet these requirements?
A. Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
B. Configure an event source of Systems Manager. Configure an event type that indicates a maintenance window. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
C. Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.
D. Configure an event source of EC2. Configure an event type that indicates instance state notification. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.
Show Answer
Correct Answer: C
Explanation: The requirement is to remediate AWS Health notifications **during scheduled maintenance windows**, not immediately. An EventBridge rule can listen to AWS Health events (such as scheduled instance retirement/termination), but directly targeting an SSM Automation runbook would execute right away. To ensure execution within a maintenance window, the rule should invoke a Lambda function that programmatically registers or triggers a Systems Manager maintenance window task to restart the EC2 instances. This design satisfies both the AWS Health event source and the maintenance window constraint.
Question 74
A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM).
The IAM team wants to implement AWS IAM Identity Center. The IAM team must have only the minimum required permissions to manage IAM Identity Center. The IAM team must not be able to gain unnecessary access to the Organizations management account. The IAM team must be able to provision new IAM Identity Center permission sets and assignments for new and existing member accounts.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account for the IAM team. Enable IAM Identity Center in the new account. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
B. Create a new AWS account for the IAM team. Enable IAM Identity Center in the Organizations management account. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
C. Create an SCP in Organizations. Create a new OU for the Organizations management account, and link the new SCP to the OU. Configure the SCP to deny all access to IAM Identity Center.
D. Create IAM users and an IAM group for the IAM team in IAM Identity Center. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group.
E. Assign the new permission set to the Organizations management account. Allow the IAM team's group to use the permission set.
F. Assign the new permission set to the new AWS account. Allow the IAM team's group to use the permission set.
Show Answer
Correct Answer: B, D, F
Explanation: IAM Identity Center must be enabled in the Organizations management account before administration can be delegated, so the correct setup is to enable it in the management account and register a separate member account as the delegated administrator (B). To allow the IAM team to manage Identity Center with appropriate capabilities across member accounts, create users/groups in Identity Center and grant them a permission set that includes the required Identity Center administrative permissions, such as the AWSSSOMemberAccountAdministrator policy (D). To avoid unnecessary access to the Organizations management account while still allowing management activities, assign that permission set only to the dedicated IAM team account, not the management account (F).
Question 75
A company use an organization in AWS Organizations to manage multiple AWS accounts. The company has enabled all features enabled for the organization. The company configured the organization as a hierarchy of OUs under the root OU. The company recently registered all its OUs and enrolled all its AWS accounts in AWS Control Tower.
The company needs to customize the AWS Control Tower managed AWS Config configuration recorder in each of the company's AWS accounts. The company needs to apply the customizations to both the existing AWS accounts and to any new AWS accounts that the company enrolls in AWS Control Tower in the future.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account. Create an AWS Lambda function in the new account to apply the customizations to the AWS Config configuration recorder in each AWS account in the organization.
B. Create a new AWS account as an AWS Config delegated administrator. Create an AWS Lambda function in the delegated administrator account to apply the customizations to the AWS Config configuration recorder in the delegated administrator account.
C. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when the Organizations OU is registered or reregistered. Re-register the root Organizations OU.
D. Configure the AWSControlTowerExecution IAM role in each AWS account in the organization to be assumable by an AWS Lambda function. Configure the Lambda function to assume the AWSControlTowerExecution IAM role.
E. Create an IAM role in the AWS Control Tower management account that an AWS Lambda function can assume. Grant the IAM role permission to assume the AWSControlTowerExecution IAM role in any account in the organization. Configure the Lambda function to use the new IAM role.
F. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when an AWS account is updated or enrolled in AWS Control Tower or when the landing zone is updated. Re-register each Organizations OU in the organization.
Show Answer
Correct Answer: C, E, F
Explanation: To customize the AWS Control Tower–managed AWS Config recorder across all existing and future accounts, automation must run from the Control Tower management account and react to Control Tower lifecycle events.
E is required so a Lambda function can centrally assume the AWSControlTowerExecution role in every enrolled account without modifying Control Tower–managed roles.
F is required because AWS Control Tower emits lifecycle events (account enrollment, account update, landing zone update). An EventBridge rule ensures the customization is automatically applied to newly enrolled or updated accounts, and re-registering OUs applies changes to existing accounts.
C completes the solution by handling OU (re)registration scenarios so existing accounts under OUs are remediated consistently when governance is reapplied. Other options either introduce unnecessary accounts, rely on unsupported events, or require modifying Control Tower–managed roles.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.