A security team sets up a workflow that invokes an AWS Step Functions workflow when Amazon EventBridge matches specific events. The events can be generated by several AWS services. AWS CloudTrail records user activities.
The security team notices that some important events do not invoke the workflow as expected. The CloudTrail logs do not indicate any direct errors related to the missing events.
Which combination of steps will identify the root cause of the missing event invocations? (Choose three.)
A. Enable EventBridge schema discovery on the event bus to determine whether the event patterns match the expected schema.
B. Configure Amazon CloudWatch to monitor EventBridge metrics and Step Functions metrics. Set up alerts for anomalies in event patterns and workflow invocations.
C. Configure an AWS Lambda logging function to monitor and log events from EventBridge to provide more details about the processed events.
D. Review the Step Functions execution history for patterns of failures or timeouts that could correlate to the missing event invocations.
E. Review metrics for the EventBridge failed invocations to ensure that the IAM execution role that is attached to the rule has sufficient permissions.
F. Verify that the Step Functions workflow has the correct permissions to be invoked by EventBridge.
Show Answer
Correct Answer: A, B, E
Explanation: Missing EventBridge-triggered Step Functions executions are most commonly caused by event pattern mismatches, lack of observability, or IAM permission issues. Enabling EventBridge schema discovery helps confirm that incoming events actually match the rule pattern (A). Monitoring EventBridge and Step Functions metrics in CloudWatch helps identify dropped events or invocation anomalies even when CloudTrail shows no errors (B). Reviewing EventBridge failed invocation metrics verifies whether the rule’s execution role has sufficient permissions to start the Step Functions workflow, which is a frequent root cause (E).
Question 107
A company recently configured AWS Control Tower in its organization in AWS Organizations. The company enrolled all existing AWS accounts in AWS Control Tower. The company wants to ensure that all new AWS accounts are automatically enrolled in AWS Control Tower.
The company has an existing AWS Step Functions workflow that creates new AWS accounts and performs any actions required as part of account creation. The Step Functions workflow is defined in the same AWS account as AWS Control Tower.
Which combination of steps should the company add to the Step Functions workflow to meet these requirements? (Choose two.)
A. Create an Amazon EventBridge event that has an aws.controltower source and a CreateManagedAccount detail-type. Add the details of the new AWS account to the detail field of the event.
B. Create an Amazon EventBridge event that has an aws.controltower source and a SetupLandingZone detail-type. Add the details of the new AWS account to the detail field of the event.
C. Create an AWSControlTowerExecution role in the new AWS account. Configure the role to allow the AWS Control Tower administrator account to assume the role.
D. Call the AWS Service Catalog ProvisionProduct API operation with the details of the new AWS account.
E. Call the Organizations EnableAWSServiceAccess API operation with the controltower.amazonaws.com service name and the details of the new AWS account.
Show Answer
Correct Answer: C, D
Explanation: To automatically enroll new accounts into AWS Control Tower, the workflow must follow the Account Factory process that Control Tower uses. Each managed account must contain the AWSControlTowerExecution IAM role so Control Tower can assume it and apply guardrails (C). New accounts are enrolled by provisioning the Account Factory Service Catalog product, which is done programmatically via the Service Catalog ProvisionProduct API (D). EventBridge events do not enroll accounts, and enabling service access is an organization-level, one-time setup—not a per-account enrollment step.
Question 108
A DevOps engineer deploys an application to a fleet of Amazon Linux EC2 instances. The DevOps engineer needs to monitor system metrics across the fleet. The DevOps engineer wants to monitor the relationship between network traffic and memory utilization for the application code. The DevOps engineer wants to track the data on a 60 second interval.
Which solution will meet these requirements?
A. Use Amazon CloudWatch basic monitoring to collect the NetworkIn metric and the MemoryBytesUsed metric. Graph the metrics in CloudWatch.
B. Use Amazon CloudWatch detailed monitoring to collect the NetworkIn metric and the MemoryBytesUsed metric. Graph the metrics in CloudWatch.
C. Use Amazon CloudWatch detailed monitoring to collect the NetworkIn metric. Install the CloudWatch agent on the EC2 instances to collect the mem_used metric. Graph the metrics in CloudWatch.
D. Use Amazon CloudWatch basic monitoring to collect the built-in NetworkIn metric. Install the CloudWatch agent on the EC2 instances to collect the mem_used metric. Graph the metrics in CloudWatch.
Show Answer
Correct Answer: C
Explanation: EC2 basic monitoring provides metrics at 5‑minute intervals and does not include memory utilization. The requirement is 60‑second granularity and correlation of network traffic with memory usage. CloudWatch detailed monitoring provides the NetworkIn metric at 1‑minute resolution, and memory metrics (such as mem_used) must be collected by installing the CloudWatch agent on the instances. These metrics can then be graphed together in CloudWatch.
Question 109
A DevOps engineer needs to configure a blue/green deployment for an existing three-tier application. The application runs on Amazon EC2 instances and uses an Amazon RDS database. The EC2 instances run behind an Application Load Balancer (ALB) and are in an Auto Scaling group.
The DevOps engineer has created launch templates, Auto Scaling groups, and ALB target groups for the blue environment and the green environment. Each target group specifies which application version, blue or green, will be loaded on the EC2 instances. An Amazon Route 53 record for www.example.com points to the ALB.
The deployment must shift traffic all at once from the blue environment to the green environment.
Which solution will meet these requirements?
A. Starta rolling restart of the Auto Scaling group for the green environment to deploy the new application version to the green environment's EC2 instances. When the rolling restart is complete, use an AWS CLI command to update the ALB to send traffic to the green environment's target group.
B. Use an AWS CLI command to update the ALB to send traffic to the green environments target group. Start a rolling restart of the Auto Scaling group for the green environment to deploy the new application version to the green environment's EC2 instances.
C. Update the launch template to deploy the green environment's application version to the blue environment's EC2 instances. Do not change the target groups or the Auto Scaling groups in either environment. Perform a rolling restart of the blue environments EC2 instances.
D. Starta rolling restart of the Auto Scaling group for the green environment to deploy the new application version to the green environment's EC2 instances. When the rolling restart is complete, update Route 53 to point to the green environment's endpoint on the ALB.
Show Answer
Correct Answer: A
Explanation: Blue/green requires preparing the green environment fully before shifting traffic. Deploy the new version to the green Auto Scaling group first (rolling restart), then switch the ALB listener to route 100% of traffic to the green target group in a single action. This shifts traffic all at once without changing Route 53 or modifying the blue environment.
Question 110
A company has multiple AWS accounts. The company uses AWS IAM Identity Center that is integrated with a third-party SAML 2.0 identity provider (IdP).
The attributes for access control feature is enabled in IAM Identity Center. The attribute mapping list maps the department key from the IdP to the ${path:enterprise.department} attribute. All existing Amazon EC2 instances have a d1, d2, d3 department tag that corresponds to three company’s departments.
A DevOps engineer must create policies based on the matching attributes. The policies must grant each user access to only the EC2 instances that are tagged with the user’s respective department name.
Which condition key should the DevOps engineer include in the custom permissions policies to meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: C
Explanation: IAM Identity Center attribute mapping makes the IdP attribute available as an AWS principal tag (aws:PrincipalTag/enterprise.department). To grant access only to EC2 instances with a matching department tag, the policy must compare the EC2 resource tag to the principal tag, e.g., ec2:ResourceTag/department == ${aws:PrincipalTag/enterprise.department}. Option C represents this condition key usage.
Question 111
A company uses Amazon Redshift as its data warehouse solution. The company wants to create a dashboard to view changes to the Redshift users and the queries the users perform.
Which combination of steps will meet this requirement? (Choose two.)
A. Create an Amazon CloudWatch log group. Create an AWS CloudTrail trail that writes to the CloudWatch log group.
B. Create a new Amazon S3 bucket. Configure default audit logging on the Redshift cluster. Configure the S3 bucket as the target.
C. Configure the Redshift cluster database audit logging to include user activity logs. Configure Amazon CloudWatch as the target.
D. Create an Amazon CloudWatch dashboard that has a log widget. Configure the widget to display user details from the Redshift logs.
E. Create an AWS Lambda function that uses Amazon Athena to query the Redshift logs. Create an Amazon CloudWatch dashboard that has a custom widget type that uses the Lambda function.
Show Answer
Correct Answer: C, D
Explanation: To track Redshift user changes and executed queries, Redshift database audit logging must be enabled with user activity logs. These logs can be delivered directly to Amazon CloudWatch Logs. Once the logs are in CloudWatch, a CloudWatch dashboard with a log widget can visualize user details and query activity. CloudTrail does not capture SQL queries, and S3/Athena/Lambda is unnecessary for a simple dashboard requirement.
Question 112
A company runs a website by using an Amazon Elastic Container Service (Amazon ECS) service that is connected to an Application Load Balancer (ALB). The service was in a steady state with tasks responding to requests successfully.
A DevOps engineer updated the task definition with a new container image and deployed the new task definition to the service. The DevOps engineer noticed that the service is frequently stopping and starting new tasks because the ALB healtth checks are failing.
What should the DevOps engineer do to troubleshoot the failed deployment?
A. Ensure that a security group associated with the service allows traffic from the ALB.
B. Increase the ALB health check grace period for the service.
C. Increase the service minimum healthy percent setting.
D. Decrease the ALB health check interval.
Show Answer
Correct Answer: B
Explanation: After deploying a new container image, ECS tasks may take longer to start and become ready to serve traffic. During this startup period, the Application Load Balancer can mark the tasks as unhealthy if health checks fail too soon, causing ECS to stop and restart them repeatedly. Increasing the ALB health check grace period gives new tasks enough time to initialize before health checks are enforced, which is the correct way to troubleshoot this type of failed deployment.
Question 113
An Amazon EC2 Auto Scaling group manages EC2 instances that were created from an AMI. The AMI has the AWS Systems Manager Agent installed. When an EC2 instance is launched into the Auto Scaling group, tags are applied to the EC2 instance.
EC2 instances that are launched by the Auto Scaling group must have the correct operating system configuration.
Which solution will meet these requirements?
A. Create a Systems Manager Run Command document that configures the desired instance configuration. Set up Systems Manager Compliance to invoke the Run Command document when the EC2 instances are not in compliance with the most recent patches.
B. Create a Systems Manager State Manager association that links to the Systems Manager command document. Create a tag query that runs immediately.
C. Create a Systems Manager Run Command task that specifies the desired instance configuration. Create a maintenance window in Systems Manager Maintenance Windows that runs daily. Register the Run Command task against the maintenance window. Designate the targets.
D. Create a Systems Manager Patch Manager patch baseline and a patch group that use the same tags that the Auto Scaling group applies. Register the patch group with the patch baseline. Define a Systems Manager command document to patch the instances Invoke the document by using Systems Manager Run Command.
Show Answer
Correct Answer: B
Explanation: Systems Manager State Manager is designed to enforce and maintain a desired configuration state on EC2 instances. By creating a State Manager association that references a command document and targets instances via tags applied by the Auto Scaling group, the configuration is applied automatically and immediately when new instances launch and continuously enforced over time. Other options are either ad hoc (Run Command), scheduled but not immediate (Maintenance Windows), or focused mainly on patching rather than full OS configuration (Patch Manager).
Question 114
A company uses AWS Organizations to manage its AWS accounts. The organization root has a child OU that is named Department. The Department OU has a child OU that is named Engineering. The default FullAWSAccess policy is attached to the root, the Department OU, and the Engineering OU.
The company has many AWS accounts in the Engineering OU. Each account has an administrative IAM role with the AdministratorAccess IAM policy attached. The default FullAWSAccessPolicy is also attached to each account.
A DevOps engineer plans to remove the FullAWSAccess policy from the Department OU. The DevOps engineer will replace the policy with a policy that contains an Allow statement for all Amazon EC2 API operations.
What will happen to the permissions of the administrative 1AM roles as a result of this change?
A. All API actions on all resources will be allowed.
B. All API actions on EC2 resources will be allowed. All other API actions will be denied.
C. All API actions on all resources will be denied.
D. All API actions on EC2 resources will be denied. All other API actions will be allowed.
Show Answer
Correct Answer: B
Explanation: Service control policies are evaluated as a permission boundary across the entire OU hierarchy. The effective permissions are the intersection of all SCPs attached at the root, parent OUs, and child OUs. Replacing FullAWSAccess at the Department OU with an SCP that allows only EC2 actions restricts all descendant accounts, even though the root and Engineering OU still have FullAWSAccess and the IAM role has AdministratorAccess. As a result, only EC2 API actions are allowed and all other actions are denied.
Question 115
A company uses an organization in AWS Organizations that a security team and a DevOps team manage. Both teams access the accounts by using AWS IAM Identity Center.
A dedicated group has been created for each team. The DevOps team's group has been assigned a permission set named DevOps. The permission set has the AdministratorAccess managed IAM policy attached. The permission set has been applied to all accounts in the organization.
The security team wants to ensure that the DevOps team does not have access to IAM Identity Center in the organization's management account. The security team has attached the following SCP to the organization root:
After implementing the policy, the security team discovers that the DevOps team can still access IAM Identity Center.
Which solution will fix the problem?
A. In the organization's management account, create a new OU. Move the organization's management account to the new OU. Detach the SCP from the organization root. Attach the SCP to the new OU.
B. In the organization's management account, update the SCP condition reference to the ARN of the DevOps team's group role to include the AWS account ID of the organization's management account.
C. In IAM Identity Center, create a new permission set. Ensure that the assigned policy has full access but explicitly denies permission for the sso:* action and the sso-directory:* action. Update the assigned permission set for the DevOps team's group role in the organization's management account. Delete the SCP.
D. In IAM Identity Center, update the DevOps permission set. Ensure that the assigned policy has full access but explicitly denies permission for the sso:* action and the sso-directory:* action. In the Deny statement, add a StringEquals condition that compares the aws:SourceAccount global condition context key with the organization's management account IDelete the SCP.
Show Answer
Correct Answer: C
Explanation: Service control policies do not restrict actions in the organization's management account, so options that try to fix the issue by moving or modifying SCPs (A and B) cannot work. To restrict access, the control must be applied at the IAM Identity Center permission set level. Creating a separate permission set for the management account that broadly allows access but explicitly denies sso:* and sso-directory:* ensures the DevOps team cannot access IAM Identity Center in that account. Option D is flawed because using aws:SourceAccount conditions is not appropriate for Identity Center console access and is unnecessary. Therefore, C is the correct solution.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.