A DevOps engineer uses AWS CodeBuild to frequently produce software packages. The CodeBuild project builds large Docker images that the DevOps engineer can use across multiple builds.
The DevOps engineer wants to improve build performance and minimize costs.
Which solution will meet these requirements?
A. Store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Implement a local Docker layer cache for CodeBuild.
B. Cache the Docker images in an Amazon S3 bucket that is available across multiple build hosts. Expire the cache by using an S3 Lifecycle policy.
C. Store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Modify the CodeBuild project runtime configuration to always use the most recent image version.
D. Create custom AMIs that contain the cached Docker images. In the CodeBuild build, launch Amazon EC2 instances from the custom AMIs.
Show Answer
Correct Answer: A
Explanation: Using Amazon ECR to store Docker images provides a durable, integrated image repository, while enabling CodeBuild local Docker layer caching reuses unchanged image layers on the same build host, significantly reducing Docker build times and lowering compute costs. S3 is not the recommended Docker image cache, simply using the latest image does not provide layer caching, and managing custom AMIs with EC2 is unnecessary and increases operational overhead.
Question 102
A company's DevOps engineer must install a software package on 30 on-premises VMs and 15 Amazon EC2 instances.
The DevOps engineer needs to ensure that all VMs receive the package in a process that is auditable and that any configuration drift on the VMs is automatically identified and alerted on. The company uses AWS Direct Connect to connect its on-premises data center to AWS.
Which solution will meet these requirements with the MOST operational efficiency?
A. Write a script that iterates through the list of VMs once a week. Configure the script to check for the package and install the package if the package is not found. Configure the script to send an email message notification to the system administrator if the package is not found.
B. Install the AWS Systems Manager Agent (SSM Agent) on all VMs. Use the SSM Agent to install the package. Use AWS Config to monitor for configuration drift. Use Amazon Simple Notification Service (Amazon SNS) to notify the system administrator if any drift is found.
C. Write a script that checks if the package is installed across the environment. Configure the script to create a list of all VMs that are noncompliant. Configure the script to send the list to the system administrator, who will install the package on the noncompliant VMs.
D. Log in to each VM. Use a local package manager to install the package. Use AWS Config to monitor the AWS resources for configuration changes. Write a script to monitor the on-premises resources.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Agent can manage both Amazon EC2 instances and on-premises servers (hybrid activations) over Direct Connect, providing auditable software installation through Systems Manager. AWS Config can monitor supported configuration compliance for managed resources, and SNS can notify administrators of detected drift or noncompliance. This is the most operationally efficient managed solution compared with custom scripts or manual installation.
Question 103
A company has an AWS CodePipeline pipeline in the eu-west-1 Region. The pipeline stores the build artifacts in an Amazon S3 bucket. The pipeline builds and deploys an AWS Lambda function by using an AWS CloudFormation deploy action.
A DevOps engineer needs to update the existing pipeline to also deploy the Lambda function to the us-east-1 Region. The pipeline has already been updated to create an additional artifact to deploy to us-east-1.
Which combination of steps should the DevOps engineer take to meet these requirements? (Choose two.)
A. Modify the CloudFormation template to include a parameter for the Lambda function code's .zip file location. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to pass in the us-east-1 artifact location as a parameter override.
B. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the additional artifact that was created for us-east-1.
C. Create an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have read and write access.
D. Create an S3 bucket in us-east-1. Configure S3 Cross-Region Replication (CRR) from the S3 bucket in eu-west-1 to the S3 bucket in us-east-1.
E. Modify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 artifact.
Show Answer
Correct Answer: C, E
Explanation: For cross-Region actions, CodePipeline requires an artifact store in each Region where actions run. Therefore, create an S3 artifact bucket in us-east-1 and configure the pipeline to use it as the artifact store. Then add a CloudFormation deploy action in us-east-1 that consumes the us-east-1 artifact. Cross-Region Replication is not required because CodePipeline manages cross-Region artifacts via the configured regional artifact stores. Passing only a ZIP location parameter is insufficient, and simply pointing to a different template artifact without configuring a regional artifact store will not enable cross-Region deployment.
Question 104
A company has deployed an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 node groups. The company's DevOps team uses the Kubernetes Horizontal Pod Autoscaler and recently installed a supported EKS cluster Autoscaler.
The DevOps team needs to implement a solution to collect metrics and logs of the EKS cluster to establish a baseline for performance. The DevOps team will create an initial set of thresholds for specific metrics and will update the thresholds over time as the cluster is used. The DevOps team must receive an Amazon Simple Notification Service (Amazon SNS) email notification if the initial set of thresholds is exceeded or if the EKS cluster Autoscaler is not functioning properly.
The solution must collect cluster, node, and pod metrics. The solution also must capture logs in Amazon CloudWatch.
Which combination of steps should the DevOps team take to meet these requirements? (Choose three.)
A. Deploy the CloudWatch agent and Fluent Bit to the cluster. Ensure that the EKS cluster has appropriate permissions to send metrics and logs to CloudWatch.
B. Deploy AWS Distro for OpenTelemetry to the cluster. Ensure that the EKS cluster has appropriate permissions to send metrics and logs to CloudWatch.
C. Create CloudWatch alarms to monitor the CPU, memory, and node failure metrics of the cluster. Configure the alarms to send an SNS email notification to the DevOps team if thresholds are exceeded.
D. Create a CloudWatch composite alarm to monitor a metric log filter of the CPU, memory, and node metrics of the cluster. Configure the alarm to send an SNS email notification to the DevOps team when anomalies are detected.
E. Create a CloudWatch alarm to monitor the logs of the Autoscaler deployments for errors. Configure the alarm to send an SNS email notification to the DevOps team if thresholds are exceeded.
F. Create a CloudWatch alarm to monitor a metric log filter of the Autoscaler deployments for errors. Configure the alarm to send an SNS email notification to the DevOps team if thresholds are exceeded.
Show Answer
Correct Answer: A, C, F
Explanation: Use the CloudWatch agent with Fluent Bit to collect EKS cluster, node, and pod metrics plus container logs into CloudWatch. Create CloudWatch alarms on key performance metrics such as CPU, memory, and node health with SNS notifications for threshold breaches. To detect Cluster Autoscaler failures, create a metric filter from the Autoscaler logs for error patterns and alarm on that metric, sending SNS notifications. Composite alarms with log filters are not appropriate for the primary resource metrics, and a CloudWatch alarm cannot directly alarm on logs without a metric filter.
Question 105
A company uses AWS Systems Manager to manage a fleet of Amazon Linux EC2 instances that have SSM Agent installed. All EC2 instances are configured to use Instance Metadata Service Version 2 (IMDSv2) and are running in the same AWS account and AWS Region. Company policy requires developers to use only Amazon Linux.
The company wants to ensure that all new EC2 instances are automatically managed by Systems Manager after creation.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an IAM role that has a trust policy that allows Systems Manager to assume the role. Attach the AmazonSSMManagedEC2InstanceDefaultPolicy policy to the role. Configure the default-ec2-instance-management-role SSM service setting to use the role.
B. Ensure that AWS Config is set up. Create an AWS Config rule that validates if an EC2 instance has SSM Agent installed. Configure the rule to run on EC2 configuration changes. Configure automatic remediation for the rule to run the AWS-InstallSSMAgent SSM document to install SSM Agent.
C. Configure Systems Manager Patch Manager. Create a patch baseline that automatically installs SSM Agent on all new EC2 instances. Create a patch group for all EC2 instances. Attach the patch baseline to the patch group. Create a maintenance window and maintenance window task to start installing SSM Agent daily.
D. Create an EC2 instance role that has a trust policy that allows Amazon EC2 to assume the role. Attach the AmazonSSMManagedInstanceCore policy to the role. Ensure that AWS Config is set up. Use the ec2-instance-profile-attached managed AWS Config rule to validate if an EC2 instance has the role attached. Configure the rule to run on EC2 configuration changes. Configure automatic remediation for the rule to run the AWS-SetupManagedRoleOnEc2Instance SSM document to attach the role to the EC2 instance.
Show Answer
Correct Answer: A
Explanation: Amazon Linux AMIs already include the SSM Agent. For IMDSv2-enabled Amazon Linux instances in the same account and Region, configuring the Systems Manager default EC2 instance management role (default-ec2-instance-management-role) with a role that has the AmazonSSMManagedEC2InstanceDefaultPolicy allows newly created instances to be automatically managed without attaching an instance profile to each instance. The other options add unnecessary AWS Config or Patch Manager remediation or rely on attaching instance profiles after launch, making them less operationally efficient.
Question 106
A company uses Amazon Elastic Container Registry (Amazon ECR) private registries to store container images.
A DevOps team needs to ensure that the container images are regularly scanned for software package vulnerabilities.
Which solution will meet this requirement?
A. Enable enhanced scanning for private registries in Amazon ECR.
B. Enable basic continuous scanning for private registries in Amazon ECR.
C. Create an AWS System Manager Automation document to scan images by using the AWS SDK. Configure the Automation document to run when a new image is pushed to an ECR registry.
D. Create an AWS Lambda function that scans all images in Amazon ECR by using the AWS SDK. Create an Amazon EventBridge rule to invoke the Lambda function each day.
Show Answer
Correct Answer: A
Explanation: Amazon ECR enhanced scanning integrates with Amazon Inspector to provide continuous vulnerability scanning and automatic rescanning of container images as new CVEs are published. Basic scanning does not provide continuous rescanning, and custom Systems Manager or Lambda solutions add unnecessary operational overhead compared to the managed feature.
Question 107
A company uses an AWS Cloud Development Kit (AWS CDK) application for its infrastructure. The AWS CDK application creates AWS Lambda functions and the IAM roles that are attached to the functions. The company also uses AWS Organizations. The company's developers can assume the AWS CDK application deployment role.
The company's security team discovered that the developers and the role used to deploy the AWS CDK application have more permissions than necessary. The security team also discovered that the roles attached to the Lambda functions that the CDK application creates have more permissions than necessary. The developers must not have the ability to grant additional permissions.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role and the AWS CDK application deployment role. Centrally create new IAM roles to attach to the Lambda functions for the developers to use to provision Lambda functions.
B. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Update the account's AWS CDK bootstrapping to use the permission boundary. Update the configuration in the AWS CDK application for the default permissions boundary to use the policy.
C. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Instruct the developers to use the permission boundary policy name when they create a role in the AWS CDK application code.
D. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role. Give the AWS CDK deployment role access to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to verify that the Lambda functions role does not have permissions.
Show Answer
Correct Answer: B
Explanation: Using IAM permissions boundaries integrated into the AWS CDK bootstrap and configured as the default permissions boundary ensures that the CDK deployment role cannot create roles with permissions beyond the defined maximum, and all IAM roles created by the CDK application (including Lambda execution roles) automatically receive the boundary. This prevents developers from granting additional permissions through newly created roles while preserving the CDK workflow and minimizing operational overhead. The SCP options either prevent necessary role creation or require centralized/manual role management, increasing operational effort. Simply instructing developers to apply a boundary relies on manual compliance and is weaker than enforcing it through CDK bootstrapping.
Question 108
A company uses an organization in AWS Organizations to manage 10 AWS accounts. All features are enabled, and trusted access for AWS CloudFormation is enabled.
A DevOps engineer needs to use CloudFormation to deploy an IAM role to the Organizations management account and all member accounts in the organization.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target.
B. Create a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
C. Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target.
D. Create a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
Show Answer
Correct Answer: B
Explanation: Use a CloudFormation StackSet with service-managed permissions to minimize operational overhead because AWS Organizations manages the required permissions. However, service-managed StackSets do not deploy stack instances to the AWS Organizations management account. Therefore, target the root OU for all member accounts and deploy a separate CloudFormation stack in the management account to create the IAM role.
Question 109
A company uses an organization in AWS Organizations to manage its 500 AWS accounts. The organization has all features enabled. The AWS accounts are in a single OU. The developers need to use the CostCenter tag key for all resources in the organization's member accounts. Some teams do not use the CostCenter tag key to tag their Amazon EC2 instances.
The cloud team wrote a script that scans all EC2 instances in the organization's member accounts. If the EC2 instances do not have a CostCenter tag key, the script will notify AWS account administrators. To avoid this notification, some developers use the CostCenter tag key with an arbitrary string in the tag value.
The cloud team needs to ensure that all EC2 instances in the organization use a CostCenter tag key with the appropriate cost center value.
Which solution will meet these requirements?
A. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Update the script to scan the tag keys and tag values. Modify the script to update noncompliant resources with a default approved tag value for the CostCenter tag key.
B. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Update the script to scan the tag keys and tag values and notify the administrators when the tag values are not valid.
C. Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Create an IAM permission boundary in the organization's member accounts that restricts the CostCenter tag values to a list of valid cost centers.
D. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Configure an AWS Lambda function that adds an empty CostCenter tag key to an EC2 instance. Create an Amazon EventBridge rule that matches events to the RunInstances API action with the Lambda function as the target.
Show Answer
Correct Answer: A
Explanation: An SCP can deny launching EC2 instances unless the required CostCenter tag key is provided. A tag policy can standardize and validate the allowed CostCenter tag values across the organization. Because tag policies primarily provide compliance evaluation and standardization rather than hard enforcement of values at the API level, updating the existing compliance script to check both key and value and remediate noncompliant resources addresses existing instances and invalid values. The other options either fail to validate values adequately, rely on permission boundaries in a way that is not appropriate organization-wide, or use tag policies/Lambda in ways that do not ensure valid cost center values.
Question 110
A company has an organization in AWS Organizations with many Oils that contain many AWS accounts. The organization has a dedicated delegated administrator AWS account.
The company needs the accounts in one OU to have server-side encryption enforced for all Amazon Elastic Block Store (Amazon EBS) volumes and Amazon Simple Queue Service (Amazon SQS) queues that are created or updated on an AWS CloudFormation stack.
Which solution will enforce this policy before a CloudFormation stack operation in the accounts of this OU?
A. Activate trusted access to CloudFormation StackSets. Create a CloudFormation Hook that enforces server-side encryption on EBS volumes and SQS queues. Deploy the Hook across the accounts in the OU by using StackSets.
B. Set up AWS Config in all the accounts in the OU. Use AWS Systems Manager to deploy AWS Config rules that enforce server-side encryption for EBS volumes and SQS queues across the accounts in the OU.
C. Write an SCP to deny the creation of EBS volumes and SQS queues unless the EBS volumes and SQS queues have server-side encryption. Attach the SCP to the OU.
D. Create an AWS Lambda function in the delegated administrator account that checks whether server-side encryption is enforced for EBS volumes and SQS queues. Create an IAM role to provide the Lambda function access to the accounts in the OU.
Show Answer
Correct Answer: A
Explanation: CloudFormation Hooks are specifically designed to validate and enforce policy before CloudFormation creates or updates resources. A Hook can reject stack operations that attempt to create or update EBS volumes or SQS queues without server-side encryption. Using CloudFormation StackSets with trusted access allows the Hook to be deployed consistently across all accounts in the target OU. AWS Config detects noncompliance after deployment rather than blocking stack operations, SCPs cannot inspect CloudFormation template properties such as encryption settings for these resources, and a Lambda solution is not integrated into the CloudFormation pre-provisioning workflow.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.