A company runs several applications in the same AWS account. The applications send logs to Amazon CloudWatch.
A data analytics team needs to collect performance metrics and custom metrics from the applications. The analytics team needs to transform the metrics data before storing the data in an Amazon S3 bucket. The analytics team must automatically collect any new metrics that are added to the CloudWatch namespace.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure a CloudWatch metric stream to include metrics from the application and the CloudWatch namespace. Configure the metric stream to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
B. Configure a CloudWatch metrics stream to include all the metrics and to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
C. Configure metric filters for the CloudWatch logs to create custom metrics. Configure a CloudWatch metric stream to deliver the application metrics to the S3 bucket.
D. Configure subscription filters on the application log groups to target an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
Show Answer
Correct Answer: B
Explanation: Using a CloudWatch metric stream configured for all metrics automatically includes newly created metrics without needing to update stream filters. Sending the stream to Amazon Data Firehose, invoking AWS Lambda for transformation, and delivering to Amazon S3 satisfies the transformation and storage requirements with the least operational overhead.
Question 134
A company has proprietary data available by using an Amazon CloudFront distribution. The company needs to ensure that the distribution is accessible by only users from the corporate office that have a known set of IP address ranges. An AWS WAF web ACL is associated with the distribution and has a default action set to Count.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new regex pattern set. Add the regex pattern set to a new rule group. Create a new web ACL that has a default action set to Block. Associate the web ACL with the CloudFront distribution. Add a rule that allows traffic based on the new rule group.
B. Create an AWS WAF IP address set that matches the corporate office IP address range. Create a new web ACL that has a default action set to Allow. Associate the web ACL with the CloudFront distribution. Add a rule that allows traffic from the IP address set.
C. Create a new regex pattern set. Add the regex pattern set to a new rule group. Set the default action on the existing web ACL to Allow. Add a rule that has priority 0 that allows traffic based on the regex pattern set.
D. Create a WAF IP address set that matches the corporate office IP address range. Set the default action on the existing web ACL to Block. Add a rule that has priority 0 that allows traffic from the IP address set.
Show Answer
Correct Answer: D
Explanation: Use an AWS WAF IP set to match the known corporate IP ranges. Modify the existing web ACL instead of creating a new one to minimize operational overhead. Change the default action from Count to Block, then add a highest-priority allow rule for the IP set so only requests from the corporate office are permitted. Regex pattern sets are for matching request components, not source IP addresses.
Question 135
A security team must record the configuration of AWS resources, detect issues, and send notifications for findings. The main workload in the AWS account consists of an Amazon EC2 Auto Scaling group that scales in and out several times during the day.
The team wants to be notified within 2 days if any Amazon EC2 security group allows traffic on port 22 for 0.0.0.0/0. The team also needs a snapshot of the configuration of the AWS resources to be taken routinely.
The security team has already created and subscribed to an Amazon Simple Notification Service (Amazon SNS) topic.
Which solution meets these requirements?
A. Configure AWS Config to use periodic recording for the AWS account. Deploy the vpc-sg-port-restriction-check AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
B. Configure AWS Config to use configuration change recording for the AWS account. Deploy the vpc-sg-open-only-to-authorized-ports AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
C. Configure AWS Config to use configuration change recording for the AWS account. Deploy the ssh-restricted AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
D. Create an AWS Lambda function to evaluate security groups and publish a message to the SNS topic. Use an Amazon EventBridge rule to schedule the Lambda function to run once a day.
Show Answer
Correct Answer: C
Explanation: Configuration change recording is the best fit for a dynamic environment with EC2 Auto Scaling because AWS Config records resource changes as they occur while still maintaining configuration history and snapshots. The managed rule 'ssh-restricted' specifically detects security groups that allow unrestricted SSH (port 22) access from 0.0.0.0/0. AWS Config can publish compliance change notifications to the existing SNS topic, satisfying the notification requirement well within 2 days.
Question 136
A DevOps team supports an application that runs in an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). Currently, the DevOps team uses AWS CodeDeploy to deploy the application by using a blue/green all-at-once strategy. Recently, the DevOps team had to roll back a deployment when a new version of the application dramatically increased response times for requests.
The DevOps team needs use to a deployment strategy that will allow the team to monitor a new version of the application before the team shifts all traffic to the new version. If a new version of the application increases response times, the deployment should be rolled back as quickly as possible.
Which combination of steps will meet these requirements? (Choose two.)
A. Modify the CodeDeploy deployment to use the CodeDeployDefault.ECSCanary10Percent5Minutes configuration.
B. Modify the CodeDeploy deployment to use the CodeDeployDefault.ECSLinear10PercentEvery3Minutes configuration.
C. Create an Amazon CloudWatch alarm to monitor the UnHealthyHostCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when a deployment fails.
D. Create an Amazon CloudWatch alarm to monitor the TargetResponseTime metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when alarm thresholds are met.
E. Create an Amazon CloudWatch alarm to monitor the TargetConnectionErrorCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when alarm thresholds are met.
Show Answer
Correct Answer: A, D
Explanation: A canary deployment shifts a small percentage of traffic to the new ECS task set first, allowing performance to be observed before full rollout. Because the issue described is increased response time, a CloudWatch alarm on the ALB TargetResponseTime metric associated with the CodeDeploy deployment group can automatically stop and roll back the deployment when the threshold is exceeded. Linear deployment is slower to fully roll back after multiple increments, and UnHealthyHostCount or TargetConnectionErrorCount do not directly detect increased response latency.
Question 137
A company runs an application that stores artifacts in an Amazon S3 bucket. The application has a large user base. The application writes a high volume of objects to the S3 bucket. The company has enabled event notifications for the S3 bucket.
When the application writes an object to the S3 bucket, several processing tasks need to be performed simultaneously. The company's DevOps team needs to create an AWS Step Functions workflow to orchestrate the processing tasks.
Which combination of steps should the DevOps team take to meet these requirements with the LEAST operational overhead? (Choose two.)
A. Create a Standard workflow that contains a parallel state that defines the processing tasks. Create an Asynchronous Express workflow that contains a parallel state that defines the processing tasks.
B. Create a Synchronous Express workflow that contains a map state that defines the processing tasks.
C. Create an Amazon EventBridge rule to match when a new S3 object is created. Configure the EventBridge rule to invoke an AWS Lambda function. Configure the Lambda function to start the processing workflow.
D. Create an Amazon EventBridge rule to match when a new S3 object is created. Configure the EventBridge rule to start the processing workflow.
Show Answer
Correct Answer: A, D
Explanation: Use a Step Functions workflow with a Parallel state to run multiple processing tasks simultaneously. Among the provided choices, A is the only option that includes a Parallel state. S3 object creation events can be matched by Amazon EventBridge, and EventBridge can start a Step Functions state machine directly, avoiding an unnecessary Lambda function and minimizing operational overhead. Although Express workflows are generally recommended for very high-volume event processing, the option as written is malformed because it combines Standard and Asynchronous Express workflows into a single choice; given the available answers, A together with D is the best fit.
Question 138
A DevOps engineer uses a pipeline in AWS CodePipeline. The pipeline has a build action and a deploy action for a single-page web application that is delivered to an Amazon S3 bucket. Amazon CloudFront serves the web application. The build action creates an artifact for the web application.
The DevOps engineer has created an AWS CloudFormation template that defines the S3 bucket and configures the S3 bucket to host the application. The DevOps engineer has configured a CloudFormation deploy action before the S3 action. The CloudFormation deploy action creates the S3 bucket. The DevOps engineer needs to configure the S3 deploy action to use the S3 bucket from the CloudFormation template.
Which combination of steps will meet these requirements? (Choose two.)
A. Add an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Configure the output value to export to an AWS::SSM::Parameter resource named Stackvariables.
B. Add an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Set the CloudFormation action's namespace to StackVariables in the pipeline.
C. Configure the output artifacts of the CloudFormation action in the pipeline to be an AWS Systems Manager Parameter Store parameter named StackVariables. Name the artifact BucketName.
D. Configure the build artifact from the build action as the input to the CodePipeline S3 deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.
E. Configure the build artifact from the build action and the AWS Systems Manager parameter as the inputs to the deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.
Show Answer
Correct Answer: B, D
Explanation: Use CloudFormation stack outputs exposed through a CodePipeline action namespace so downstream actions can reference them as pipeline variables. Add a CloudFormation output named BucketName that references the created S3 bucket, set the CloudFormation action namespace to StackVariables, then configure the S3 deploy action to use the build artifact as its input and specify the destination bucket as the variable StackVariables.BucketName. Exporting to SSM Parameter Store or treating outputs as artifacts is not how CloudFormation action variables are passed to later pipeline actions.
Question 139
A DevOps administrator is configuring a repository to store a company's container images. The administrator needs to configure a lifecycle rule that automatically deletes container images that have a specific tag and that are older than 15 days.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a repository in Amazon Elastic Container Registry (Amazon ECR). Add a lifecycle policy to the repository to expire images that have the matching tag after 15 days.
B. Create a repository in AWS CodeArtifact. Add a repository policy to the CodeArtifact repository to expire old assets that have the matching tag after 15 days.
C. Create a bucket in Amazon S3. Add a bucket lifecycle policy to expire old objects that have the matching tag after 15 days
D. Create an EC2 Image Builder container recipe. Add a build component to expire the container that has the matching tag after 15 days.
Show Answer
Correct Answer: A
Explanation: Amazon Elastic Container Registry (ECR) is the AWS service purpose-built for storing container images and supports lifecycle policies that can automatically expire images based on tag status/prefix and age (such as older than 15 days). This provides the required automated cleanup with the least operational overhead. CodeArtifact is for software packages, S3 lifecycle rules operate on objects rather than container image metadata/tags, and EC2 Image Builder is for building images, not repository retention management.
Question 140
A company is running an internal application in an Amazon Elastic Container Service (Amazon ECS) cluster on Amazon EC2. The ECS cluster instances can connect to the public internet. The ECS tasks that run on the cluster instances are configured to use images from both private Amazon Elastic Container Registry (Amazon ECR) repositories and a public ECR registry repository.
A new security policy requires the company to remove the ECS cluster's direct access to the internet. The company must remove any NAT gateways and internet gateways from the VPC that hosts the cluster. A DevOps engineer needs to ensure the ECS cluster can still download images from both the public ECR registry and the private ECR repositories. Images from the public ECR registry must remain up-to-date. New versions of the images must be available to the ECS cluster within 24 hours of publication.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
A. Create an AWS CodeBuild project and a new private ECR repository for each image that is downloaded from the public ECR registry. Configure each project to pull the image from the public ECR repository and push the image to the new private ECR repository. Create an Amazon EventBridge rule that invokes the CodeBuild project once every 24 hours. Update each task definition in the ECS cluster to refer to the new private ECR repository.
B. Create a new Amazon ECR pull through cache rule for each image that is downloaded from the public ECR registry. Create an AWS Lambda function that invokes each pull through cache rule. Create an Amazon EventBridge rule that invokes the Lambda function once every 24 hours. Update each task definition in the ECS cluster to refer to the image from the pull through cache.
C. Create a new Amazon ECR pull through cache rule for the public ECR registry. Update each task definition in the ECS cluster to refer to the image from the pull through cache. Ensure each public image has been downloaded through the pull through cache at least once before removing internet access from the VP
D. Create an Amazon ECR interface VPC endpoint for the public ECR repositories that are in the VPC.
E. Create an Amazon ECR interface VPC endpoint for the private ECR repositories that are in the VPC.
F. Create an Amazon S3 gateway endpoint in the VPC.
Show Answer
Correct Answer: C, E, F
Explanation: Use an ECR pull through cache rule for Amazon ECR Public so public images are cached into private ECR and referenced by ECS. Seed the cache before removing internet access. Access to private ECR requires Amazon ECR interface VPC endpoints (PrivateLink), and image layers are stored in Amazon S3, so an S3 gateway endpoint is also required. This avoids custom synchronization jobs and provides the least operational overhead.
Question 141
A company is using Amazon Elastic Kubernetes Service (Amazon EKS) to run its applications. The EKS cluster is successfully running multiple pods. The company stores the pod images in Amazon Elastic Container Registry (Amazon ECR).
The company needs to configure Pod Identity access for the EKS cluster. The company has already updated the node IAM role by using the permissions for Pod Identity access.
Which solution will meet these requirements?
A. Create an IAM OpenID Connect (OIDC) provider for the EKS cluster.
B. Ensure that the nodes can reach the EKS Auth API. Add and configure the EKS Pod Identity Agent add-on for the EKS cluster.
C. Create an EKS access entry that uses the API_AND-CONFIG_MAP cluster authentication mode.
D. Configure the AWS Security Token Service (AWS STS) endpoint for the Kubernetes service account that the pods in the EKS cluster use.
Show Answer
Correct Answer: B
Explanation: Amazon EKS Pod Identity is distinct from IAM Roles for Service Accounts (IRSA). Pod Identity does not require creating an IAM OIDC provider. After updating the node IAM role with the required Pod Identity permissions, the remaining required step is to ensure worker nodes can reach the EKS Auth API and install/configure the EKS Pod Identity Agent add-on, which retrieves credentials for pods. EKS access entries are for cluster authentication/authorization, not Pod Identity, and configuring an STS endpoint for the service account is not the required setup for EKS Pod Identity.
Question 142
A company runs a fleet of Amazon EC2 instances in a VPC. The company's employees remotely access the EC2 instances by using the Remote Desktop Protocol (RDP).
The company wants to collect metrics about how many RDP sessions the employees initiate every day.
Which combination of steps will meet this requirement? (Choose three.)
A. Create an Amazon EventBridge rule that reacts to EC2 Instance State-change Notification events.
B. Create an Amazon CloudWatch Logs log group. Specify the log group as a target for the EventBridge rule.
C. Create a flow log in VPC Flow Logs.
D. Create an Amazon CloudWatch Logs log group. Specify the log group as a destination for the flow log.
E. Create a log group metric filter.
F. Create a log group subscription filter. Use EventBridge as the destination.
Show Answer
Correct Answer: C, D, E
Explanation: Use VPC Flow Logs to capture network connections, including RDP traffic on TCP port 3389. Configure the flow logs to publish to a CloudWatch Logs log group, then create a CloudWatch Logs metric filter that matches accepted RDP traffic to generate a custom metric counting RDP session initiations. EC2 state-change events do not indicate RDP logins, and EventBridge is not required for this metric collection.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.