A company that uses electronic patient health records runs a fleet of Amazon EC2 instances with an Amazon Linux operating system. The company must continuously ensure that the EC2 instances are running operating system patches and application patches that are in compliance with current privacy regulations. The company uses a custom repository to store application patches.
A DevOps engineer needs to automate the deployment of operating system patches and application patches. The DevOps engineer wants to use both the default operating system patch repository and the custom patch repository.
Which solution will meet these requirements with the LEAST effort?
A. Use AWS Systems Manager to create a new custom patch baseline that includes the default operating system repository and the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the new custom patch baseline.
B. Use AWS Direct Connect to integrate the custom repository with the EC2 instances. Use Amazon EventBridge events to deploy the patches.
C. Use the yum-config-manager command to add the custom repository to the /etc/yum.repos.d configuration. Run the yum-config-manager-enable command to activate the new repository.
D. Use AWS Systems Manager to create a patch baseline for the default operating system repository and a second patch baseline for the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the default patch baseline and the custom patch baseline.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager Patch Manager is designed to automate patching with minimal operational effort. A single custom patch baseline can include the default Amazon Linux patch rules and reference a custom repository for application patches, centralizing control. Running the AWS-RunPatchBaseline document via Run Command handles both scanning and installation in one workflow. Option D is incorrect because Systems Manager applies only one patch baseline at a time per instance, and managing two baselines would add unnecessary complexity and is not supported as described.
Question 77
A company has multiple AWS accounts in an organization in AWS Organizations that has all features enabled. The company’s DevOps administrator needs to improve security across all the company's AWS accounts. The administrator needs to identify the top users and roles in use across all accounts.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new organization trail in AWS CloudTrail. Configure the trail to send log events to Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule for the userIdentity.arn log field. View the results in CloudWatch Contributor Insights.
B. Create an unused access analysis for the organization by using AWS Identity and Access Management Access Analyzer. Review the analyzer results and determine if each finding has the intended level of permissions required for the workload.
C. Create a new organization trail in AWS CloudTrail. Create a table in Amazon Athena that uses partition projection. Load the Athena table with CloudTrail data. Query the Athena table to find the top users and roles.
D. Generate a Service access report for each account by using Organizations. From the results, pull the last accessed date and last accessed by account fields to find the top users and roles.
Show Answer
Correct Answer: A
Explanation: The requirement is to identify the top users and roles across all accounts with the MOST operational efficiency. An organization-wide CloudTrail combined with CloudWatch Contributor Insights directly aggregates and ranks contributors (for example, userIdentity.arn) without building data pipelines, managing schemas, or running queries. This provides near-real-time insights with minimal setup and ongoing maintenance. Athena-based analysis works but requires ongoing query management and data handling, which is less operationally efficient. The other options do not identify top users and roles in active use across accounts.
Question 78
A company discovers that its production environment and disaster recovery (DR) environment are deployed to the same AWS Region. All the production applications run on Amazon EC2 instances and are deployed by AWS CloudFormation. The applications use an Amazon FSx for NetApp ONTAP volume for application storage. No application data resides on the EC2 instances.
A DevOps engineer copies the required AMIs to a new DR Region. The DevOps engineer also updates the CloudFormation code to accept a Region as a parameter. The storage needs to have an RPO of 10 minutes in the DR Region.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket in both Regions. Configure S3 Cross-Region Replication (CRR) for the S3 buckets. Create a scheduled AWS Lambda function to copy any new content from the FSx for ONTAP volume to the S3 bucket in the production Region.
B. Use AWS Backup to create a backup vault and a custom backup plan that has a 10-minute frequency. Specify the DR Region as the target Region. Assign the EC2 instances in the production Region to the backup plan.
C. Create an AWS Lambda function to create snapshots of the instance store volumes that are attached to the EC2 instances. Configure the Lambda function to copy the snapshots to the DR Region and to remove the previous copies. Create an Amazon EventBridge scheduled rule that invokes the Lambda function every 10 minutes.
D. Create an FSx for ONTAP instance in the DR Region. Configure a 5-minute schedule for a volume-level NetApp SnapMirror to replicate the volume from the production Region to the DR Region.
Show Answer
Correct Answer: D
Explanation: The applications store all data on Amazon FSx for NetApp ONTAP, so disaster recovery must replicate FSx data, not EC2 instances. FSx for ONTAP natively supports NetApp SnapMirror for cross-Region, volume-level replication with low RPO. Configuring SnapMirror with a 5-minute schedule meets the 10-minute RPO requirement and allows the DR Region to have an up-to-date copy of the storage. The other options either do not replicate FSx data correctly, do not meet the RPO, or focus on EC2/instance storage that is not used for application data.
Question 79
A company has several AWS accounts. An Amazon Connect instance runs in each account. The company uses an Amazon EventBridge default event bus in each account for event handling.
A DevOps team needs to receive all the Amazon Connect events in a single DevOps account.
Which solution meets these requirements?
A. Update the resource-based policy of the default event bus in each account to allow the DevOps account to replay events. Configure an EventBridge rule in the DevOps account that matches Amazon Connect events and has a target of the default event bus in the other accounts.
B. Update the resource-based policy of the default event bus in each account to allow the DevOps account to receive events. Configure an EventBridge rule in the DevOps account that matches Amazon Connect events and has a target of the default event bus in the other accounts.
C. Update the resource-based policy of the default event bus in the DevOps account. Update the policy to allow events to be received from the accounts. Configure an EventBridge rule in each account that matches Amazon Connect events and has a target of the DevOps account's default event bus.
D. Update the resource-based policy of the default event bus in the DevOps account. Update the policy to allow events to be replayed by the accounts. Configure an EventBridge rule in each account that matches Amazon Connect events and has a target of the DevOps account's default event bus.
Show Answer
Correct Answer: C
Explanation: To centralize Amazon Connect events from multiple AWS accounts, EventBridge cross-account event routing must be configured with the receiving event bus granting permission to the source accounts. The correct approach is to update the resource-based policy on the DevOps account’s default event bus to allow other accounts to put events. Then, in each source account, create an EventBridge rule that matches Amazon Connect events and forwards them to the DevOps account’s default event bus as the target. This matches EventBridge’s supported cross-account pattern.
Question 80
A company's web application uses an Application Load Balancer (ALB) to direct traffic to Amazon EC2 instances across three Availability Zones.
The company has deployed a newer version of the application to one Availability Zone for testing. If a problem is detected with the application, the company wants to direct traffic away from the affected Availability Zone until the deployment has been rolled back. The application must remain available and maintain static stability during the rollback.
Which solution will meet these requirements with the MOST operational efficiency?
A. Disable cross-zone load balancing on the ALB's target group. Initiate a zonal shift on the ALB to direct traffic away from the affected Availability Zone.
B. Disable cross-zone load balancing on the ALB's target group. Manually remove instances in the target group that belong to the affected Availability Zone.
C. Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Initiate a zonal shift on the ALB to direct traffic away from the affected Availability Zone.
D. Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Remove the subnet that is associated with the affected Availability Zone.
Show Answer
Correct Answer: A
Explanation: Initiating a zonal shift is the most operationally efficient way to immediately route traffic away from a single Availability Zone while keeping the application available and statically stable during rollback. Disabling cross-zone load balancing ensures that traffic is not redistributed to targets in the affected AZ, allowing the zonal shift to fully isolate that zone without manual target group or subnet changes. Other options require manual intervention or risk traffic still reaching the impacted AZ.
Question 81
A company configured an Amazon S3 event source for an AWS Lambda function. The company needs the Lambda function to run when a new object is created or an existing object is modified in a specific S3 bucket. The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the new or modified S3 object. The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table.
The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table. During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified.
Which solution will resolve these problems?
A. Create an S3 bucket policy for the S3 bucket that grants the S3 bucket permission to invoke the Lambda function.
B. Create a resource policy for the Lambda function to grant Amazon S3 permission to invoke the Lambda function on the S3 bucket.
C. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function. Update the Lambda function to process messages from the SQS queue and the S3 event notifications.
D. Configure an Amazon Simple Queue Service (Amazon SQS) queue as the destination for the S3 bucket event notifications. Update the Lambda function's execution role to have permission to read from the SQS queue. Update the Lambda function to consume messages from the SQS queue.
Show Answer
Correct Answer: B
Explanation: Amazon S3 must be explicitly allowed to invoke a Lambda function via a resource-based policy on the Lambda function. Without this permission (lambda:InvokeFunction for the s3.amazonaws.com principal, scoped to the bucket), S3 event notifications will not trigger the function even if the execution role has S3 and DynamoDB permissions. Bucket policies do not grant invoke permissions to Lambda, and introducing SQS is unnecessary.
Question 82
During a security audit, a company discovered that some security groups allow SSH traffic from 0.0.0.0/0. A security team must implement a solution to detect and remediate this issue as soon as possible. The company uses one organization in AWS Organizations to manage all the company's AWS accounts.
Which solution will meet these requirements?
A. Enable AWS Config for all AWS accounts. Use a periodic trigger to activate the vpe-sg-port-restriction-check AWS Config rule. Create an AWS Lambda function to remediate any noncompliant rules.
B. Create an AWS Lambda function in each AWS account to delete all the security group rules. Create an Amazon EventBridge rule to match security group update events or creation events. Set the Lambda function in each account as a target for the rule.
C. Enable AWS Config for all AWS accounts. Create a custom AWS Config rule to run on the restricted-ssh configuration change trigger. Configure the rule to invoke an AWS Lambda function to remediate any noncompliant resources.
D. Create an AWS Systems Manager Automation document in each account to inspect all security groups and to delete noncompliant rules. Use an Amazon EventBridge rule to run the Automation document every hour.
Show Answer
Correct Answer: C
Explanation: Option C best meets the requirements by using AWS Config with a configuration change (real-time) trigger to detect security groups that allow SSH (port 22) from 0.0.0.0/0 and immediately remediate them using a Lambda function. This provides near real-time detection and automated remediation across all accounts in an AWS Organization. Option A relies on a periodic trigger and a less specific managed rule, which can delay detection. Options B and D lack centralized governance, are overly disruptive, or rely on scheduled checks rather than continuous compliance.
Question 83
A DevOps team manages a company's AWS account. The company wants to ensure that specific AWS resource configuration changes are automatically reverted.
Which solution will meet this requirement?
A. Use AWS Config rules to detect changes in resource configurations. Configure remediation action that uses AWS Systems Manager Automation documents to revert the configuration changes.
B. Use Amazon CloudWatch alarms to monitor resource metrics. When an alarm is activated, use an Amazon Simple Notification Service (Amazon SNS) topic to notify an administrator to manually reverts the configuration changes.
C. Use AWS CloudFormation to create a stack that deploys the necessary configuration changes. Update the stack when configuration changes need to be reverted.
D. Use AWS Trusted Advisor to check for noncompliant configurations. Manually apply necessary changes based on Trusted Advisor recommendations.
Show Answer
Correct Answer: A
Explanation: AWS Config rules can continuously evaluate resource configurations and detect noncompliance. By attaching automatic remediation actions that invoke AWS Systems Manager Automation documents, configuration drift can be corrected automatically without manual intervention. This directly satisfies the requirement to automatically revert specific AWS resource configuration changes, unlike the other options which are manual, reactive, or not designed for ongoing enforcement.
Question 84
A company has deployed a landing zone that has a well-defined AWS Organizations structure and an SCP. The company's development team can create their AWS resources only by using AWS CloudFormation and the AWS Cloud Development Kit (AWS CDK).
A DevOps engineer notices that Amazon Simple Queue Service (Amazon SQS) queues that are deployed in different CloudFormation stacks have different configurations. The DevOps engineer also notices that the application cost allocation tag is not always set.
The DevOps engineer needs a solution that will enforce tagging and promote the reuse of code. The DevOps engineer needs to avoid different configurations for the deployed SQS queues.
What should the DevOps engineer do to meet these requirements?
A. Create an Organizations tag policy to enforce the cost allocation tag in CloudFormation stacks. Instruct the development team to use CloudFormation to define SQS queues. Instruct the development team to deploy the SQS queues by using CloudFormation StackSets.
B. Update the SCP to enforce the cost allocation tag in CloudFormation stacks. Instruct the development team to use CloudFormation modules to define SQS queues. Instruct the development team to deploy the SQS queues by using CloudFormation stacks.
C. Use AWS CDK tagging to enforce the cost allocation tag in CloudFormation StackSets. Instruct the development team to use the AWS CDK to define SQS queues. Instruct the development team to deploy the SQS queues by using CDK stacks.
D. Use AWS CDK tagging to enforce the cost allocation tag in CloudFormation stacks. Instruct the development team to use the AWS CDK to define SQS queues. Instruct the development team to deploy the SQS queues by using CDK feature flags.
Show Answer
Correct Answer: B
Explanation: The requirements are to enforce tagging, promote code reuse, and ensure consistent SQS configurations. SCPs can enforce required tags across accounts regardless of how resources are deployed. CloudFormation modules provide reusable, standardized definitions for resources like SQS queues, preventing configuration drift. Options using CDK tagging rely on developer compliance rather than enforcement, and StackSets are not needed for per-application SQS deployment consistency. Therefore, updating the SCP and using CloudFormation modules best meets all requirements.
Question 85
A company uses an organization in AWS Organizations to manage multiple AWS accounts in a hierarchical structure. An SCP that is associated with the organization root allows IAM users to be created.
A DevOps team must be able to create IAM users with any level of permissions. Developers must also be able to create IAM users. However, developers must not be able to grant new IAM users excessive permissions. The developers have the CreateAndManageUsers role in each account. The DevOps team must be able to prevent other users from creating IAM users.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an SCP in the organization to deny users the ability to create and modify IAM users. Attach the SCP to the root of the organization. Attach the CreateAndManageUsers role to developers.
B. Create an SCP in the organization to grant users that have the DeveloperBoundary policy attached the ability to create new IAM users and to modify IAM users. Configure the SCP to require users to attach the PermissionBoundaries policy to any new IAM user. Attach the SCP to the root of the organization.
C. Create an IAM permissions policy named PermissionBoundaries within each account. Configure the PermissionBoundaries policy to specify the maximum permissions that a developer can grant to a new IAM user.
D. Create an IAM permissions policy named PermissionBoundaries within each account. Configure PermissionsBoundaries to allow users who have the PermissionBoundaries policy to create new IAM users.
E. Create an IAM permissions policy named DeveloperBoundary within each account. Configure the DeveloperBoundary policy to allow developers to create IAM users and to assign policies to IAM users of only if the developer includes the PermissionBoundaries policy as the permissions boundary. Attach the DeveloperBoundary policy to the CreateAndManageUsers role within each account.
Show Answer
Correct Answer: C, E
Explanation: Developers must be able to create IAM users but be prevented from granting excessive permissions, while DevOps retains full flexibility. This is achieved with IAM permissions boundaries. Option C creates a PermissionBoundaries policy that defines the maximum permissions any developer-created user can receive. Option E enforces its use by allowing developers (via the CreateAndManageUsers role) to create and manage IAM users only if they attach the PermissionBoundaries policy as a permissions boundary. This satisfies the requirement without restricting DevOps or relying on SCPs to manage per-user permission limits.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.