A company has proprietary data available by using an Amazon CloudFront distribution. The company needs to ensure that the distribution is accessible by only users from the corporate office that have a known set of IP address ranges. An AWS WAF web ACL is associated with the distribution and has a default action set to Count.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new regex pattern set. Add the regex pattern set to a new rule group. Create a new web ACL that has a default action set to Block. Associate the web ACL with the CloudFront distribution. Add a rule that allows traffic based on the new rule group.
B. Create an AWS WAF IP address set that matches the corporate office IP address range. Create a new web ACL that has a default action set to Allow. Associate the web ACL with the CloudFront distribution. Add a rule that allows traffic from the IP address set.
C. Create a new regex pattern set. Add the regex pattern set to a new rule group. Set the default action on the existing web ACL to Allow. Add a rule that has priority 0 that allows traffic based on the regex pattern set.
D. Create a WAF IP address set that matches the corporate office IP address range. Set the default action on the existing web ACL to Block. Add a rule that has priority 0 that allows traffic from the IP address set.
Show Answer
Correct Answer: D
Explanation: The requirement is to allow access only from known corporate IP ranges with the least operational overhead. Using an AWS WAF IP address set is the correct mechanism for source IP restrictions. Reusing the existing web ACL minimizes overhead. Setting the default action to Block ensures all traffic is denied by default, and adding a highest-priority rule (priority 0) to Allow traffic from the corporate IP address set permits only authorized users. Regex pattern sets and new web ACLs add unnecessary complexity.
Question 97
A security team must record the configuration of AWS resources, detect issues, and send notifications for findings. The main workload in the AWS account consists of an Amazon EC2 Auto Scaling group that scales in and out several times during the day.
The team wants to be notified within 2 days if any Amazon EC2 security group allows traffic on port 22 for 0.0.0.0/0. The team also needs a snapshot of the configuration of the AWS resources to be taken routinely.
The security team has already created and subscribed to an Amazon Simple Notification Service (Amazon SNS) topic.
Which solution meets these requirements?
A. Configure AWS Config to use periodic recording for the AWS account. Deploy the vpc-sg-port-restriction-check AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
B. Configure AWS Config to use configuration change recording for the AWS account. Deploy the vpc-sg-open-only-to-authorized-ports AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
C. Configure AWS Config to use configuration change recording for the AWS account. Deploy the ssh-restricted AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
D. Create an AWS Lambda function to evaluate security groups and publish a message to the SNS topic. Use an Amazon EventBridge rule to schedule the Lambda function to run once a day.
Show Answer
Correct Answer: C
Explanation: AWS Config satisfies both requirements: it records resource configurations and evaluates compliance. Using configuration change recording is appropriate for a dynamic environment with Auto Scaling because it captures changes as they occur while still maintaining configuration history (snapshots). The managed rule ssh-restricted specifically checks whether any EC2 security group allows inbound SSH (port 22) from 0.0.0.0/0, which directly matches the requirement. Configuring AWS Config to publish findings to the existing SNS topic ensures timely notifications (well within 2 days) when noncompliance is detected.
Question 98
A DevOps team supports an application that runs in an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). Currently, the DevOps team uses AWS CodeDeploy to deploy the application by using a blue/green all-at-once strategy. Recently, the DevOps team had to roll back a deployment when a new version of the application dramatically increased response times for requests.
The DevOps team needs use to a deployment strategy that will allow the team to monitor a new version of the application before the team shifts all traffic to the new version. If a new version of the application increases response times, the deployment should be rolled back as quickly as possible.
Which combination of steps will meet these requirements? (Choose two.)
A. Modify the CodeDeploy deployment to use the CodeDeployDefault.ECSCanary10Percent5Minutes configuration.
B. Modify the CodeDeploy deployment to use the CodeDeployDefault.ECSLinear10PercentEvery3Minutes configuration.
C. Create an Amazon CloudWatch alarm to monitor the UnHealthyHostCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when a deployment fails.
D. Create an Amazon CloudWatch alarm to monitor the TargetResponseTime metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when alarm thresholds are met.
E. Create an Amazon CloudWatch alarm to monitor the TargetConnectionErrorCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when alarm thresholds are met.
Show Answer
Correct Answer: A, D
Explanation: The team needs to observe a new version with limited traffic and roll back quickly if response times degrade. A canary deployment (CodeDeployDefault.ECSCanary10Percent5Minutes) initially shifts only 10% of traffic, allowing monitoring before full cutover. Monitoring the ALB TargetResponseTime metric with a CloudWatch alarm and associating it with the CodeDeploy deployment group enables automatic rollback when response times exceed acceptable thresholds, directly addressing the performance regression scenario.
Question 99
A company runs an application that stores artifacts in an Amazon S3 bucket. The application has a large user base. The application writes a high volume of objects to the S3 bucket. The company has enabled event notifications for the S3 bucket.
When the application writes an object to the S3 bucket, several processing tasks need to be performed simultaneously. The company's DevOps team needs to create an AWS Step Functions workflow to orchestrate the processing tasks.
Which combination of steps should the DevOps team take to meet these requirements with the LEAST operational overhead? (Choose two.)
A. Create a Standard workflow that contains a parallel state that defines the processing tasks. Create an Asynchronous Express workflow that contains a parallel state that defines the processing tasks.
B. Create a Synchronous Express workflow that contains a map state that defines the processing tasks.
C. Create an Amazon EventBridge rule to match when a new S3 object is created. Configure the EventBridge rule to invoke an AWS Lambda function. Configure the Lambda function to start the processing workflow.
D. Create an Amazon EventBridge rule to match when a new S3 object is created. Configure the EventBridge rule to start the processing workflow.
Show Answer
Correct Answer: A, D
Explanation: The application generates a high volume of S3 events and needs to run multiple processing tasks in parallel with minimal operational overhead.
Option A: A Step Functions workflow with a Parallel state is the correct construct to run several processing tasks simultaneously. Using a Standard workflow is appropriate for durable, reliable orchestration with built‑in retries and observability, which is typical for backend processing pipelines triggered by S3 events.
Option D: Amazon EventBridge can natively receive S3 object creation events and directly start a Step Functions workflow. This removes the need for an intermediate Lambda function, reducing custom code and operational overhead.
Other options are less suitable: B uses a synchronous Express workflow, which is designed for short‑lived, request/response patterns and is unnecessary here, and C adds an extra Lambda hop, increasing operational complexity.
Question 100
A DevOps engineer uses a pipeline in AWS CodePipeline. The pipeline has a build action and a deploy action for a single-page web application that is delivered to an Amazon S3 bucket. Amazon CloudFront serves the web application. The build action creates an artifact for the web application.
The DevOps engineer has created an AWS CloudFormation template that defines the S3 bucket and configures the S3 bucket to host the application. The DevOps engineer has configured a CloudFormation deploy action before the S3 action. The CloudFormation deploy action creates the S3 bucket. The DevOps engineer needs to configure the S3 deploy action to use the S3 bucket from the CloudFormation template.
Which combination of steps will meet these requirements? (Choose two.)
A. Add an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Configure the output value to export to an AWS::SSM::Parameter resource named Stackvariables.
B. Add an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Set the CloudFormation action's namespace to StackVariables in the pipeline.
C. Configure the output artifacts of the CloudFormation action in the pipeline to be an AWS Systems Manager Parameter Store parameter named StackVariables. Name the artifact BucketName.
D. Configure the build artifact from the build action as the input to the CodePipeline S3 deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.
E. Configure the build artifact from the build action and the AWS Systems Manager parameter as the inputs to the deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.
Show Answer
Correct Answer: B, D
Explanation: To pass the S3 bucket name created by a CloudFormation action to a later deploy action in CodePipeline, the bucket name must be exposed as a stack output and referenced through action variables.
Adding an output (BucketName) to the CloudFormation template and assigning a namespace to the CloudFormation action (for example, StackVariables) allows subsequent actions to reference that output as StackVariables.BucketName.
The S3 deploy action must take the build artifact as its input (the website files) and use the variable StackVariables.BucketName to dynamically identify the target S3 bucket created by CloudFormation. This combination correctly links the CloudFormation-created resource with the S3 deploy action.
Question 101
A DevOps administrator is configuring a repository to store a company's container images. The administrator needs to configure a lifecycle rule that automatically deletes container images that have a specific tag and that are older than 15 days.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a repository in Amazon Elastic Container Registry (Amazon ECR). Add a lifecycle policy to the repository to expire images that have the matching tag after 15 days.
B. Create a repository in AWS CodeArtifact. Add a repository policy to the CodeArtifact repository to expire old assets that have the matching tag after 15 days.
C. Create a bucket in Amazon S3. Add a bucket lifecycle policy to expire old objects that have the matching tag after 15 days
D. Create an EC2 Image Builder container recipe. Add a build component to expire the container that has the matching tag after 15 days.
Show Answer
Correct Answer: A
Explanation: Amazon Elastic Container Registry (ECR) is purpose-built for storing container images and natively supports lifecycle policies. ECR lifecycle rules can target images by specific tags and automatically expire images older than a defined number of days (15 days in this case), requiring minimal setup and ongoing maintenance. The other options are not designed for container image lifecycle management or do not support tag- and age-based expiration for container images.
Question 102
A company is running an internal application in an Amazon Elastic Container Service (Amazon ECS) cluster on Amazon EC2. The ECS cluster instances can connect to the public internet. The ECS tasks that run on the cluster instances are configured to use images from both private Amazon Elastic Container Registry (Amazon ECR) repositories and a public ECR registry repository.
A new security policy requires the company to remove the ECS cluster's direct access to the internet. The company must remove any NAT gateways and internet gateways from the VPC that hosts the cluster. A DevOps engineer needs to ensure the ECS cluster can still download images from both the public ECR registry and the private ECR repositories. Images from the public ECR registry must remain up-to-date. New versions of the images must be available to the ECS cluster within 24 hours of publication.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
A. Create an AWS CodeBuild project and a new private ECR repository for each image that is downloaded from the public ECR registry. Configure each project to pull the image from the public ECR repository and push the image to the new private ECR repository. Create an Amazon EventBridge rule that invokes the CodeBuild project once every 24 hours. Update each task definition in the ECS cluster to refer to the new private ECR repository.
B. Create a new Amazon ECR pull through cache rule for each image that is downloaded from the public ECR registry. Create an AWS Lambda function that invokes each pull through cache rule. Create an Amazon EventBridge rule that invokes the Lambda function once every 24 hours. Update each task definition in the ECS cluster to refer to the image from the pull through cache.
C. Create a new Amazon ECR pull through cache rule for the public ECR registry. Update each task definition in the ECS cluster to refer to the image from the pull through cache. Ensure each public image has been downloaded through the pull through cache at least once before removing internet access from the VP
D. Create an Amazon ECR interface VPC endpoint for the public ECR repositories that are in the VPC.
E. Create an Amazon ECR interface VPC endpoint for the private ECR repositories that are in the VPC.
F. Create an Amazon S3 gateway endpoint in the VPC.
Show Answer
Correct Answer: C, E, F
Explanation: The ECS cluster must pull images without internet or NAT access and with minimal operational overhead. Using an Amazon ECR pull-through cache for public ECR images allows public images to be cached into private ECR automatically and kept up to date without custom jobs (C). Access to private ECR repositories from a private VPC requires an Amazon ECR interface VPC endpoint (E). Because ECR image layers are stored in Amazon S3, an S3 gateway endpoint is also required so the instances can download image layers without internet access (F). This combination satisfies the security requirement and update requirement with the least operational overhead.
Question 103
A company is using Amazon Elastic Kubernetes Service (Amazon EKS) to run its applications. The EKS cluster is successfully running multiple pods. The company stores the pod images in Amazon Elastic Container Registry (Amazon ECR).
The company needs to configure Pod Identity access for the EKS cluster. The company has already updated the node IAM role by using the permissions for Pod Identity access.
Which solution will meet these requirements?
A. Create an IAM OpenID Connect (OIDC) provider for the EKS cluster.
B. Ensure that the nodes can reach the EKS Auth API. Add and configure the EKS Pod Identity Agent add-on for the EKS cluster.
C. Create an EKS access entry that uses the API_AND-CONFIG_MAP cluster authentication mode.
D. Configure the AWS Security Token Service (AWS STS) endpoint for the Kubernetes service account that the pods in the EKS cluster use.
Show Answer
Correct Answer: B
Explanation: Amazon EKS Pod Identity is a newer mechanism that does not rely on IAM OIDC providers or IRSA. Since the node IAM role is already updated with the required Pod Identity permissions, the remaining required step is to install and configure the EKS Pod Identity Agent add-on and ensure nodes can reach the EKS Auth API. The agent is responsible for obtaining credentials on behalf of pods. Therefore, option B correctly meets the requirements.
Question 104
A company runs a fleet of Amazon EC2 instances in a VPC. The company's employees remotely access the EC2 instances by using the Remote Desktop Protocol (RDP).
The company wants to collect metrics about how many RDP sessions the employees initiate every day.
Which combination of steps will meet this requirement? (Choose three.)
A. Create an Amazon EventBridge rule that reacts to EC2 Instance State-change Notification events.
B. Create an Amazon CloudWatch Logs log group. Specify the log group as a target for the EventBridge rule.
C. Create a flow log in VPC Flow Logs.
D. Create an Amazon CloudWatch Logs log group. Specify the log group as a destination for the flow log.
E. Create a log group metric filter.
F. Create a log group subscription filter. Use EventBridge as the destination.
Show Answer
Correct Answer: C, D, E
Explanation: To count how many RDP sessions are initiated, the company needs visibility into network-level RDP traffic and a way to turn that data into metrics. VPC Flow Logs capture network traffic metadata, including TCP port 3389 used by RDP. Sending the flow logs to an Amazon CloudWatch Logs log group allows the data to be stored and analyzed. A CloudWatch Logs metric filter can then match RDP traffic (for example, destination port 3389 with ACCEPT actions) and publish a custom metric that can be aggregated daily. EventBridge and subscription filters are not required for simple metric collection.
Question 105
A DevOps engineer provisioned an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with managed node groups. The DevOps engineer associated an OpenID Connect (OIDC) issuer with the cluster.
The DevOps engineer is configuring Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp3) volumes for the cluster. The DevOps engineer attempts to initiate a PersistentVolumeClaim (PVC) request but is unable to provision a volume. To troubleshoot the issue, the DevOps engineer runs the kubectl describe pyc command. The DevOps engineer receives a failed to provision volume with StorageClass error and a could not create volume in EC2:UnauthorizedOperation error.
Which solution will resolve these errors?
A. Create a Kubernetes cluster role that allows the persistent volumes to perform get, list, watch, create, and delete operations. Configure the cluster role to allow get, list, and watch operations for storage in the cluster.
B. Create an Amazon EBS Container Storage Interface (CSI) driver IAM role that has the required permissions and trust relationships. Attach the IAM role to the Amazon EBS CSI driver add-on in the cluster.
C. Add the ebs.csi.aws.com/volumeType:gp3 annotation to the PersistentVolumeClaim object in the cluster.
D. Create a Kubernetes storage class object. Set the provisioner value to ebs.csi.aws.com. Set the volumeBindingMode value to WaitForFirstConsumer in the luster.
Show Answer
Correct Answer: B
Explanation: The error "could not create volume in EC2: UnauthorizedOperation" indicates that the Amazon EBS CSI driver lacks the required IAM permissions to call EC2 APIs such as CreateVolume and AttachVolume. In an EKS cluster with OIDC enabled, the correct solution is to use IAM Roles for Service Accounts (IRSA). Creating an IAM role with the necessary EBS permissions and a trust relationship with the cluster’s OIDC provider, and attaching this role to the EBS CSI driver add-on, allows the driver to assume the role and successfully provision gp3 volumes.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.