A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health.
The DevOps engineer must implement an automated solution that uses Amazon EventBridge to remediate the notifications during the company's scheduled maintenance windows.
How should the DevOps engineer configure an EventBridge rule to meet these requirements?
A. Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
B. Configure an event source of Systems Manager. Configure an event type that indicates a maintenance window. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
C. Configure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.
D. Configure an event source of EC2. Configure an event type that indicates instance state notification. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.
Show Answer
Correct Answer: C
Explanation: The requirement is not only to react to AWS Health notifications but to remediate them during the company's scheduled Systems Manager maintenance windows. AWS Health should be the EventBridge source because it emits scheduled instance retirement/termination notifications. Targeting the Automation runbook directly would execute immediately when the event arrives, not during a maintenance window. Using a Lambda function to register or schedule the Systems Manager maintenance window task allows the restart to occur in the defined maintenance window, satisfying the timing requirement.
Question 112
A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM).
The IAM team wants to implement AWS IAM Identity Center. The IAM team must have only the minimum required permissions to manage IAM Identity Center. The IAM team must not be able to gain unnecessary access to the Organizations management account. The IAM team must be able to provision new IAM Identity Center permission sets and assignments for new and existing member accounts.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account for the IAM team. Enable IAM Identity Center in the new account. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
B. Create a new AWS account for the IAM team. Enable IAM Identity Center in the Organizations management account. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
C. Create an SCP in Organizations. Create a new OU for the Organizations management account, and link the new SCP to the OU. Configure the SCP to deny all access to IAM Identity Center.
D. Create IAM users and an IAM group for the IAM team in IAM Identity Center. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group.
E. Assign the new permission set to the Organizations management account. Allow the IAM team's group to use the permission set.
F. Assign the new permission set to the new AWS account. Allow the IAM team's group to use the permission set.
Show Answer
Correct Answer: B, D, F
Explanation: IAM Identity Center must be enabled in the Organizations management account before delegating administration to a member account. A dedicated member account can then be registered as the delegated administrator. The IAM team should use IAM Identity Center with a permission set based on the AWSSSOMemberAccountAdministrator managed policy, and that permission set should be assigned in the delegated administrator account for the IAM team to manage permission sets and assignments with least privilege. Denying IAM Identity Center via an SCP on the management account is unnecessary, and assigning the permission set to the management account would provide access there rather than isolating administration.
Question 113
A company use an organization in AWS Organizations to manage multiple AWS accounts. The company has enabled all features enabled for the organization. The company configured the organization as a hierarchy of OUs under the root OU. The company recently registered all its OUs and enrolled all its AWS accounts in AWS Control Tower.
The company needs to customize the AWS Control Tower managed AWS Config configuration recorder in each of the company's AWS accounts. The company needs to apply the customizations to both the existing AWS accounts and to any new AWS accounts that the company enrolls in AWS Control Tower in the future.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account. Create an AWS Lambda function in the new account to apply the customizations to the AWS Config configuration recorder in each AWS account in the organization.
B. Create a new AWS account as an AWS Config delegated administrator. Create an AWS Lambda function in the delegated administrator account to apply the customizations to the AWS Config configuration recorder in the delegated administrator account.
C. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when the Organizations OU is registered or reregistered. Re-register the root Organizations OU.
D. Configure the AWSControlTowerExecution IAM role in each AWS account in the organization to be assumable by an AWS Lambda function. Configure the Lambda function to assume the AWSControlTowerExecution IAM role.
E. Create an IAM role in the AWS Control Tower management account that an AWS Lambda function can assume. Grant the IAM role permission to assume the AWSControlTowerExecution IAM role in any account in the organization. Configure the Lambda function to use the new IAM role.
F. Configure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when an AWS account is updated or enrolled in AWS Control Tower or when the landing zone is updated. Re-register each Organizations OU in the organization.
Show Answer
Correct Answer: D, E, F
Explanation: Use Control Tower lifecycle events to trigger automation for existing and newly enrolled accounts. The Lambda should assume the existing AWSControlTowerExecution role in each enrolled account for cross-account changes. The Lambda itself should run with a role in the Control Tower management account that is permitted to assume AWSControlTowerExecution in member accounts. Option C refers to an unsupported OU registration event, and B incorrectly limits the Lambda's scope to the delegated administrator account rather than organization-wide customization.
Sources:
https://docs.aws.amazon.com/controltower/latest/userguide/enroll-account.html
Question 114
A company that uses electronic patient health records runs a fleet of Amazon EC2 instances with an Amazon Linux operating system. The company must continuously ensure that the EC2 instances are running operating system patches and application patches that are in compliance with current privacy regulations. The company uses a custom repository to store application patches.
A DevOps engineer needs to automate the deployment of operating system patches and application patches. The DevOps engineer wants to use both the default operating system patch repository and the custom patch repository.
Which solution will meet these requirements with the LEAST effort?
A. Use AWS Systems Manager to create a new custom patch baseline that includes the default operating system repository and the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the new custom patch baseline.
B. Use AWS Direct Connect to integrate the custom repository with the EC2 instances. Use Amazon EventBridge events to deploy the patches.
C. Use the yum-config-manager command to add the custom repository to the /etc/yum.repos.d configuration. Run the yum-config-manager-enable command to activate the new repository.
D. Use AWS Systems Manager to create a patch baseline for the default operating system repository and a second patch baseline for the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the default patch baseline and the custom patch baseline.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager Patch Manager is the managed service designed to automate OS patching. For Amazon Linux, you can configure the instance to use both the default repositories and a custom repository, then use the AWS-RunPatchBaseline document to scan and install patches. Using a single custom patch baseline with BaselineOverride is the least operational effort. Option B is unrelated to patch management, Option C only configures a YUM repository and does not automate compliance or deployment, and Option D adds unnecessary complexity because Patch Manager applies a single effective baseline rather than managing two separate baselines simultaneously for one patch operation.
Question 115
A company has multiple AWS accounts in an organization in AWS Organizations that has all features enabled. The company’s DevOps administrator needs to improve security across all the company's AWS accounts. The administrator needs to identify the top users and roles in use across all accounts.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new organization trail in AWS CloudTrail. Configure the trail to send log events to Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule for the userIdentity.arn log field. View the results in CloudWatch Contributor Insights.
B. Create an unused access analysis for the organization by using AWS Identity and Access Management Access Analyzer. Review the analyzer results and determine if each finding has the intended level of permissions required for the workload.
C. Create a new organization trail in AWS CloudTrail. Create a table in Amazon Athena that uses partition projection. Load the Athena table with CloudTrail data. Query the Athena table to find the top users and roles.
D. Generate a Service access report for each account by using Organizations. From the results, pull the last accessed date and last accessed by account fields to find the top users and roles.
Show Answer
Correct Answer: A
Explanation: An organization-wide CloudTrail feeding CloudWatch Logs with a CloudWatch Contributor Insights rule on the userIdentity.arn field provides an aggregated, continuously updated view of the top users and roles across all accounts with minimal ongoing operational effort. Athena can answer the question but requires building and running queries, while IAM Access Analyzer unused access analysis identifies unused permissions rather than the most-used identities, and Organizations service access reports are about AWS service access, not top IAM users or roles.
Question 116
A company discovers that its production environment and disaster recovery (DR) environment are deployed to the same AWS Region. All the production applications run on Amazon EC2 instances and are deployed by AWS CloudFormation. The applications use an Amazon FSx for NetApp ONTAP volume for application storage. No application data resides on the EC2 instances.
A DevOps engineer copies the required AMIs to a new DR Region. The DevOps engineer also updates the CloudFormation code to accept a Region as a parameter. The storage needs to have an RPO of 10 minutes in the DR Region.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket in both Regions. Configure S3 Cross-Region Replication (CRR) for the S3 buckets. Create a scheduled AWS Lambda function to copy any new content from the FSx for ONTAP volume to the S3 bucket in the production Region.
B. Use AWS Backup to create a backup vault and a custom backup plan that has a 10-minute frequency. Specify the DR Region as the target Region. Assign the EC2 instances in the production Region to the backup plan.
C. Create an AWS Lambda function to create snapshots of the instance store volumes that are attached to the EC2 instances. Configure the Lambda function to copy the snapshots to the DR Region and to remove the previous copies. Create an Amazon EventBridge scheduled rule that invokes the Lambda function every 10 minutes.
D. Create an FSx for ONTAP instance in the DR Region. Configure a 5-minute schedule for a volume-level NetApp SnapMirror to replicate the volume from the production Region to the DR Region.
Show Answer
Correct Answer: D
Explanation: The application state resides on Amazon FSx for NetApp ONTAP, not on the EC2 instances. To meet a 10-minute RPO across Regions, the appropriate native solution is to deploy an FSx for ONTAP file system in the DR Region and configure NetApp SnapMirror replication at the volume level. A 5-minute replication schedule satisfies the required RPO. The AMIs and CloudFormation templates already enable rebuilding the compute layer in the DR Region. The other options either back up the wrong resource (EC2), rely on unsupported or inefficient file-copy workflows, or reference instance store snapshots, which are not applicable.
Question 117
A company has several AWS accounts. An Amazon Connect instance runs in each account. The company uses an Amazon EventBridge default event bus in each account for event handling.
A DevOps team needs to receive all the Amazon Connect events in a single DevOps account.
Which solution meets these requirements?
A. Update the resource-based policy of the default event bus in each account to allow the DevOps account to replay events. Configure an EventBridge rule in the DevOps account that matches Amazon Connect events and has a target of the default event bus in the other accounts.
B. Update the resource-based policy of the default event bus in each account to allow the DevOps account to receive events. Configure an EventBridge rule in the DevOps account that matches Amazon Connect events and has a target of the default event bus in the other accounts.
C. Update the resource-based policy of the default event bus in the DevOps account. Update the policy to allow events to be received from the accounts. Configure an EventBridge rule in each account that matches Amazon Connect events and has a target of the DevOps account's default event bus.
D. Update the resource-based policy of the default event bus in the DevOps account. Update the policy to allow events to be replayed by the accounts. Configure an EventBridge rule in each account that matches Amazon Connect events and has a target of the DevOps account's default event bus.
Show Answer
Correct Answer: C
Explanation: For cross-account EventBridge event routing, the receiving event bus (in the DevOps account) must have a resource-based policy allowing source accounts to call events:PutEvents. Each source account configures an EventBridge rule matching Amazon Connect events with the DevOps account's event bus as the target. Options mentioning replay are unrelated, and configuring rules only in the DevOps account cannot pull events from other accounts.
Question 118
A company's web application uses an Application Load Balancer (ALB) to direct traffic to Amazon EC2 instances across three Availability Zones.
The company has deployed a newer version of the application to one Availability Zone for testing. If a problem is detected with the application, the company wants to direct traffic away from the affected Availability Zone until the deployment has been rolled back. The application must remain available and maintain static stability during the rollback.
Which solution will meet these requirements with the MOST operational efficiency?
A. Disable cross-zone load balancing on the ALB's target group. Initiate a zonal shift on the ALB to direct traffic away from the affected Availability Zone.
B. Disable cross-zone load balancing on the ALB's target group. Manually remove instances in the target group that belong to the affected Availability Zone.
C. Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Initiate a zonal shift on the ALB to direct traffic away from the affected Availability Zone.
D. Configure cross-zone load balancing on the ALB's target group to inherit settings from the ALB. Remove the subnet that is associated with the affected Availability Zone.
Show Answer
Correct Answer: A
Explanation: AWS Route 53 Application Recovery Controller (ARC) Zonal Shift is designed to temporarily move traffic away from a single Availability Zone for supported Application Load Balancers while maintaining application availability. For zonal shift to effectively isolate traffic at the Availability Zone level, cross-zone load balancing should be disabled so each ALB node serves only targets in its own Availability Zone. This avoids manual target manipulation or subnet changes and is the most operationally efficient approach.
Question 119
A company configured an Amazon S3 event source for an AWS Lambda function. The company needs the Lambda function to run when a new object is created or an existing object is modified in a specific S3 bucket. The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the new or modified S3 object. The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table.
The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table. During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified.
Which solution will resolve these problems?
A. Create an S3 bucket policy for the S3 bucket that grants the S3 bucket permission to invoke the Lambda function.
B. Create a resource policy for the Lambda function to grant Amazon S3 permission to invoke the Lambda function on the S3 bucket.
C. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function. Update the Lambda function to process messages from the SQS queue and the S3 event notifications.
D. Configure an Amazon Simple Queue Service (Amazon SQS) queue as the destination for the S3 bucket event notifications. Update the Lambda function's execution role to have permission to read from the SQS queue. Update the Lambda function to consume messages from the SQS queue.
Show Answer
Correct Answer: B
Explanation: Amazon S3 invokes Lambda asynchronously and requires a resource-based policy on the Lambda function that grants the S3 service (for the specific bucket) permission to call lambda:InvokeFunction. The Lambda execution role permissions for S3 reads and DynamoDB writes are unrelated to invocation. An S3 bucket policy does not grant S3 permission to invoke Lambda, and introducing SQS does not address the missing invoke permission.
Question 120
During a security audit, a company discovered that some security groups allow SSH traffic from 0.0.0.0/0. A security team must implement a solution to detect and remediate this issue as soon as possible. The company uses one organization in AWS Organizations to manage all the company's AWS accounts.
Which solution will meet these requirements?
A. Enable AWS Config for all AWS accounts. Use a periodic trigger to activate the vpe-sg-port-restriction-check AWS Config rule. Create an AWS Lambda function to remediate any noncompliant rules.
B. Create an AWS Lambda function in each AWS account to delete all the security group rules. Create an Amazon EventBridge rule to match security group update events or creation events. Set the Lambda function in each account as a target for the rule.
C. Enable AWS Config for all AWS accounts. Create a custom AWS Config rule to run on the restricted-ssh configuration change trigger. Configure the rule to invoke an AWS Lambda function to remediate any noncompliant resources.
D. Create an AWS Systems Manager Automation document in each account to inspect all security groups and to delete noncompliant rules. Use an Amazon EventBridge rule to run the Automation document every hour.
Show Answer
Correct Answer: C
Explanation: AWS Config should be enabled across the organization's accounts, and the managed AWS Config rule for restricted SSH (restricted-ssh) or an equivalent custom rule should evaluate configuration changes so new or modified security groups are detected immediately. A Lambda remediation can automatically remove the noncompliant rule. Option A is incorrect because it uses a periodic trigger and the wrong managed rule (vpc-sg-port-restriction-check is not specific to unrestricted SSH from 0.0.0.0/0). Option B is overly destructive because it deletes all security group rules. Option D relies on hourly polling, which does not remediate the issue as soon as possible.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.