A company use an organization in AWS Organizations to manage multiple AWS accounts. The company has enabled all features enabled for the organization. The company configured the organization as a hierarchy of OUs under the root OU. The company recently registered all its OUs and enrolled all its AWS accounts in AWS Control Tower.
The company needs to customize the AWS Control Tower managed AWS Config configuration recorder in each of the company's AWS accounts. The company needs to apply the customizations to both the existing AWS accounts and to any new AWS accounts that the company enrolls in AWS Control Tower in the future.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account. Create an AWS Lambda function in the new account to apply the customizations to the AWS Config configuration recorder in each AWS account in the organization.
B. Create a new AWS account as an AWS Config delegated administrator. Create an AWS Lambda function in the delegated administrator account to apply the customizations to the AWS Config configuration recorder in the delegated administrator account.
C. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when the Organizations OU is registered or reregistered. Re-register the root Organizations OU.
D. Configure the AWSControlTowerExecution IAM role in each AWS account in the organization to be assumable by an AWS Lambda function. Configure the Lambda function to assume the AWSControlTowerExecution IAM role.
E. Create an IAM role in the AWS Control Tower management account that an AWS Lambda function can assume. Grant the IAM role permission to assume the AWSControlTowerExecution IAM role in any account in the organization. Configure the Lambda function to use the new IAM role.
F. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when an AWS account is updated or enrolled in AWS Control Tower or when the landing zone is updated. Re-register each Organizations OU in the organization.
Show Answer
Correct Answer: D, E, F
Explanation: Use Control Tower lifecycle events to trigger automation for existing and newly enrolled accounts. The Lambda should assume the existing AWSControlTowerExecution role in each enrolled account for cross-account changes. The Lambda itself should run with a role in the Control Tower management account that is permitted to assume AWSControlTowerExecution in member accounts. Option C refers to an unsupported OU registration event, and B incorrectly limits the Lambda's scope to the delegated administrator account rather than organization-wide customization.
Sources:
https://docs.aws.amazon.com/controltower/latest/userguide/enroll-account.html
Question 114
A company that uses electronic patient health records runs a fleet of Amazon EC2 instances with an Amazon Linux operating system. The company must continuously ensure that the EC2 instances are running operating system patches and application patches that are in compliance with current privacy regulations. The company uses a custom repository to store application patches.
A DevOps engineer needs to automate the deployment of operating system patches and application patches. The DevOps engineer wants to use both the default operating system patch repository and the custom patch repository.
Which solution will meet these requirements with the LEAST effort?
A. Use AWS Systems Manager to create a new custom patch baseline that includes the default operating system repository and the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the new custom patch baseline.
B. Use AWS Direct Connect to integrate the custom repository with the EC2 instances. Use Amazon EventBridge events to deploy the patches.
C. Use the yum-config-manager command to add the custom repository to the /etc/yum.repos.d configuration. Run the yum-config-manager-enable command to activate the new repository.
D. Use AWS Systems Manager to create a patch baseline for the default operating system repository and a second patch baseline for the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the default patch baseline and the custom patch baseline.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager Patch Manager is the managed service designed to automate OS patching. For Amazon Linux, you can configure the instance to use both the default repositories and a custom repository, then use the AWS-RunPatchBaseline document to scan and install patches. Using a single custom patch baseline with BaselineOverride is the least operational effort. Option B is unrelated to patch management, Option C only configures a YUM repository and does not automate compliance or deployment, and Option D adds unnecessary complexity because Patch Manager applies a single effective baseline rather than managing two separate baselines simultaneously for one patch operation.
Question 115
A company has multiple AWS accounts in an organization in AWS Organizations that has all features enabled. The company’s DevOps administrator needs to improve security across all the company's AWS accounts. The administrator needs to identify the top users and roles in use across all accounts.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new organization trail in AWS CloudTrail. Configure the trail to send log events to Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule for the userIdentity.arn log field. View the results in CloudWatch Contributor Insights.
B. Create an unused access analysis for the organization by using AWS Identity and Access Management Access Analyzer. Review the analyzer results and determine if each finding has the intended level of permissions required for the workload.
C. Create a new organization trail in AWS CloudTrail. Create a table in Amazon Athena that uses partition projection. Load the Athena table with CloudTrail data. Query the Athena table to find the top users and roles.
D. Generate a Service access report for each account by using Organizations. From the results, pull the last accessed date and last accessed by account fields to find the top users and roles.
Show Answer
Correct Answer: A
Explanation: An organization-wide CloudTrail feeding CloudWatch Logs with a CloudWatch Contributor Insights rule on the userIdentity.arn field provides an aggregated, continuously updated view of the top users and roles across all accounts with minimal ongoing operational effort. Athena can answer the question but requires building and running queries, while IAM Access Analyzer unused access analysis identifies unused permissions rather than the most-used identities, and Organizations service access reports are about AWS service access, not top IAM users or roles.
Question 116
A company discovers that its production environment and disaster recovery (DR) environment are deployed to the same AWS Region. All the production applications run on Amazon EC2 instances and are deployed by AWS CloudFormation. The applications use an Amazon FSx for NetApp ONTAP volume for application storage. No application data resides on the EC2 instances.
A DevOps engineer copies the required AMIs to a new DR Region. The DevOps engineer also updates the CloudFormation code to accept a Region as a parameter. The storage needs to have an RPO of 10 minutes in the DR Region.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket in both Regions. Configure S3 Cross-Region Replication (CRR) for the S3 buckets. Create a scheduled AWS Lambda function to copy any new content from the FSx for ONTAP volume to the S3 bucket in the production Region.
B. Use AWS Backup to create a backup vault and a custom backup plan that has a 10-minute frequency. Specify the DR Region as the target Region. Assign the EC2 instances in the production Region to the backup plan.
C. Create an AWS Lambda function to create snapshots of the instance store volumes that are attached to the EC2 instances. Configure the Lambda function to copy the snapshots to the DR Region and to remove the previous copies. Create an Amazon EventBridge scheduled rule that invokes the Lambda function every 10 minutes.
D. Create an FSx for ONTAP instance in the DR Region. Configure a 5-minute schedule for a volume-level NetApp SnapMirror to replicate the volume from the production Region to the DR Region.
Show Answer
Correct Answer: D
Explanation: The application state resides on Amazon FSx for NetApp ONTAP, not on the EC2 instances. To meet a 10-minute RPO across Regions, the appropriate native solution is to deploy an FSx for ONTAP file system in the DR Region and configure NetApp SnapMirror replication at the volume level. A 5-minute replication schedule satisfies the required RPO. The AMIs and CloudFormation templates already enable rebuilding the compute layer in the DR Region. The other options either back up the wrong resource (EC2), rely on unsupported or inefficient file-copy workflows, or reference instance store snapshots, which are not applicable.
Question 117
A company has several AWS accounts. An Amazon Connect instance runs in each account. The company uses an Amazon EventBridge default event bus in each account for event handling.
A DevOps team needs to receive all the Amazon Connect events in a single DevOps account.
Which solution meets these requirements?
A. Update the resource-based policy of the default event bus in each account to allow the DevOps account to replay events. Configure an EventBridge rule in the DevOps account that matches Amazon Connect events and has a target of the default event bus in the other accounts.
B. Update the resource-based policy of the default event bus in each account to allow the DevOps account to receive events. Configure an EventBridge rule in the DevOps account that matches Amazon Connect events and has a target of the default event bus in the other accounts.
C. Update the resource-based policy of the default event bus in the DevOps account. Update the policy to allow events to be received from the accounts. Configure an EventBridge rule in each account that matches Amazon Connect events and has a target of the DevOps account's default event bus.
D. Update the resource-based policy of the default event bus in the DevOps account. Update the policy to allow events to be replayed by the accounts. Configure an EventBridge rule in each account that matches Amazon Connect events and has a target of the DevOps account's default event bus.
Show Answer
Correct Answer: C
Explanation: For cross-account EventBridge event routing, the receiving event bus (in the DevOps account) must have a resource-based policy allowing source accounts to call events:PutEvents. Each source account configures an EventBridge rule matching Amazon Connect events with the DevOps account's event bus as the target. Options mentioning replay are unrelated, and configuring rules only in the DevOps account cannot pull events from other accounts.
Question 118
A company's web application uses an Application Load Balancer (ALB) to direct traffic to Amazon EC2 instances across three Availability Zones.
The company has deployed a newer version of the application to one Availability Zone for testing. If a problem is detected with the application, the company wants to direct traffic away from the affected Availability Zone until the deployment has been rolled back. The application must remain available and maintain static stability during the rollback.
Which solution will meet these requirements with the MOST operational efficiency?
A. Disable cross-zone load balancing on the ALB's target group. Initiate a zonal shift on the ALB to direct traffic away from the affected Availability Zone.
B. Disable cross-zone load balancing on the ALB's target group. Manually remove instances in the target group that belong to the affected Availability Zone.
C. Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Initiate a zonal shift on the ALB to direct traffic away from the affected Availability Zone.
D. Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Remove the subnet that is associated with the affected Availability Zone.
Show Answer
Correct Answer: A
Explanation: AWS Route 53 Application Recovery Controller (ARC) Zonal Shift is designed to temporarily move traffic away from a single Availability Zone for supported Application Load Balancers while maintaining application availability. For zonal shift to effectively isolate traffic at the Availability Zone level, cross-zone load balancing should be disabled so each ALB node serves only targets in its own Availability Zone. This avoids manual target manipulation or subnet changes and is the most operationally efficient approach.
Question 119
A company configured an Amazon S3 event source for an AWS Lambda function. The company needs the Lambda function to run when a new object is created or an existing object is modified in a specific S3 bucket. The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the new or modified S3 object. The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table.
The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table. During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified.
Which solution will resolve these problems?
A. Create an S3 bucket policy for the S3 bucket that grants the S3 bucket permission to invoke the Lambda function.
B. Create a resource policy for the Lambda function to grant Amazon S3 permission to invoke the Lambda function on the S3 bucket.
C. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function. Update the Lambda function to process messages from the SQS queue and the S3 event notifications.
D. Configure an Amazon Simple Queue Service (Amazon SQS) queue as the destination for the S3 bucket event notifications. Update the Lambda function's execution role to have permission to read from the SQS queue. Update the Lambda function to consume messages from the SQS queue.
Show Answer
Correct Answer: B
Explanation: Amazon S3 invokes Lambda asynchronously and requires a resource-based policy on the Lambda function that grants the S3 service (for the specific bucket) permission to call lambda:InvokeFunction. The Lambda execution role permissions for S3 reads and DynamoDB writes are unrelated to invocation. An S3 bucket policy does not grant S3 permission to invoke Lambda, and introducing SQS does not address the missing invoke permission.
Question 120
During a security audit, a company discovered that some security groups allow SSH traffic from 0.0.0.0/0. A security team must implement a solution to detect and remediate this issue as soon as possible. The company uses one organization in AWS Organizations to manage all the company's AWS accounts.
Which solution will meet these requirements?
A. Enable AWS Config for all AWS accounts. Use a periodic trigger to activate the vpe-sg-port-restriction-check AWS Config rule. Create an AWS Lambda function to remediate any noncompliant rules.
B. Create an AWS Lambda function in each AWS account to delete all the security group rules. Create an Amazon EventBridge rule to match security group update events or creation events. Set the Lambda function in each account as a target for the rule.
C. Enable AWS Config for all AWS accounts. Create a custom AWS Config rule to run on the restricted-ssh configuration change trigger. Configure the rule to invoke an AWS Lambda function to remediate any noncompliant resources.
D. Create an AWS Systems Manager Automation document in each account to inspect all security groups and to delete noncompliant rules. Use an Amazon EventBridge rule to run the Automation document every hour.
Show Answer
Correct Answer: C
Explanation: AWS Config should be enabled across the organization's accounts, and the managed AWS Config rule for restricted SSH (restricted-ssh) or an equivalent custom rule should evaluate configuration changes so new or modified security groups are detected immediately. A Lambda remediation can automatically remove the noncompliant rule. Option A is incorrect because it uses a periodic trigger and the wrong managed rule (vpc-sg-port-restriction-check is not specific to unrestricted SSH from 0.0.0.0/0). Option B is overly destructive because it deletes all security group rules. Option D relies on hourly polling, which does not remediate the issue as soon as possible.
Question 121
A DevOps team manages a company's AWS account. The company wants to ensure that specific AWS resource configuration changes are automatically reverted.
Which solution will meet this requirement?
A. Use AWS Config rules to detect changes in resource configurations. Configure remediation action that uses AWS Systems Manager Automation documents to revert the configuration changes.
B. Use Amazon CloudWatch alarms to monitor resource metrics. When an alarm is activated, use an Amazon Simple Notification Service (Amazon SNS) topic to notify an administrator to manually reverts the configuration changes.
C. Use AWS CloudFormation to create a stack that deploys the necessary configuration changes. Update the stack when configuration changes need to be reverted.
D. Use AWS Trusted Advisor to check for noncompliant configurations. Manually apply necessary changes based on Trusted Advisor recommendations.
Show Answer
Correct Answer: A
Explanation: AWS Config can continuously evaluate resource configurations against rules. By attaching an automatic remediation action that invokes an AWS Systems Manager Automation runbook, noncompliant configuration changes can be automatically reverted. The other options either require manual intervention or are not designed for automatic configuration rollback.
Question 122
A company has deployed a landing zone that has a well-defined AWS Organizations structure and an SCP. The company's development team can create their AWS resources only by using AWS CloudFormation and the AWS Cloud Development Kit (AWS CDK).
A DevOps engineer notices that Amazon Simple Queue Service (Amazon SQS) queues that are deployed in different CloudFormation stacks have different configurations. The DevOps engineer also notices that the application cost allocation tag is not always set.
The DevOps engineer needs a solution that will enforce tagging and promote the reuse of code. The DevOps engineer needs to avoid different configurations for the deployed SQS queues.
What should the DevOps engineer do to meet these requirements?
A. Create an Organizations tag policy to enforce the cost allocation tag in CloudFormation stacks. Instruct the development team to use CloudFormation to define SQS queues. Instruct the development team to deploy the SQS queues by using CloudFormation StackSets.
B. Update the SCP to enforce the cost allocation tag in CloudFormation stacks. Instruct the development team to use CloudFormation modules to define SQS queues. Instruct the development team to deploy the SQS queues by using CloudFormation stacks.
C. Use AWS CDK tagging to enforce the cost allocation tag in CloudFormation StackSets. Instruct the development team to use the AWS CDK to define SQS queues. Instruct the development team to deploy the SQS queues by using CDK stacks.
D. Use AWS CDK tagging to enforce the cost allocation tag in CloudFormation stacks. Instruct the development team to use the AWS CDK to define SQS queues. Instruct the development team to deploy the SQS queues by using CDK feature flags.
Show Answer
Correct Answer: B
Explanation: CloudFormation modules are designed to promote reusable, standardized infrastructure definitions such as SQS queues with consistent configuration. An SCP can enforce required tags by denying resource creation when mandatory request tags are absent, providing actual enforcement rather than relying on developers to apply CDK tags. Organizations tag policies standardize tags but are not sufficient by themselves for enforcement of resource creation, and CDK tagging is not an enforcement mechanism. Therefore the combination of SCP enforcement and CloudFormation modules best satisfies both requirements.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.