A DevOps engineer provisioned an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with managed node groups. The DevOps engineer associated an OpenID Connect (OIDC) issuer with the cluster.
The DevOps engineer is configuring Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp3) volumes for the cluster. The DevOps engineer attempts to initiate a PersistentVolumeClaim (PVC) request but is unable to provision a volume. To troubleshoot the issue, the DevOps engineer runs the kubectl describe pyc command. The DevOps engineer receives a failed to provision volume with StorageClass error and a could not create volume in EC2:UnauthorizedOperation error.
Which solution will resolve these errors?
A. Create a Kubernetes cluster role that allows the persistent volumes to perform get, list, watch, create, and delete operations. Configure the cluster role to allow get, list, and watch operations for storage in the cluster.
B. Create an Amazon EBS Container Storage Interface (CSI) driver IAM role that has the required permissions and trust relationships. Attach the IAM role to the Amazon EBS CSI driver add-on in the cluster.
C. Add the ebs.csi.aws.com/volumeType:gp3 annotation to the PersistentVolumeClaim object in the cluster.
D. Create a Kubernetes storage class object. Set the provisioner value to ebs.csi.aws.com. Set the volumeBindingMode value to WaitForFirstConsumer in the luster.
Show Answer
Correct Answer: B
Explanation: The UnauthorizedOperation error when the EBS CSI driver attempts to create an EC2 volume indicates the CSI controller lacks the required IAM permissions. In an EKS cluster with an associated OIDC provider, the recommended configuration is IAM Roles for Service Accounts (IRSA): create an IAM role with the required Amazon EBS CSI driver permissions and an OIDC trust relationship, then associate that role with the Amazon EBS CSI driver add-on/service account. This allows the driver to call EC2 APIs such as CreateVolume successfully. The other options address Kubernetes RBAC, PVC annotations, or StorageClass configuration, none of which resolve missing EC2 IAM permissions.
Question 144
A security team sets up a workflow that invokes an AWS Step Functions workflow when Amazon EventBridge matches specific events. The events can be generated by several AWS services. AWS CloudTrail records user activities.
The security team notices that some important events do not invoke the workflow as expected. The CloudTrail logs do not indicate any direct errors related to the missing events.
Which combination of steps will identify the root cause of the missing event invocations? (Choose three.)
A. Enable EventBridge schema discovery on the event bus to determine whether the event patterns match the expected schema.
B. Configure Amazon CloudWatch to monitor EventBridge metrics and Step Functions metrics. Set up alerts for anomalies in event patterns and workflow invocations.
C. Configure an AWS Lambda logging function to monitor and log events from EventBridge to provide more details about the processed events.
D. Review the Step Functions execution history for patterns of failures or timeouts that could correlate to the missing event invocations.
E. Review metrics for the EventBridge failed invocations to ensure that the IAM execution role that is attached to the rule has sufficient permissions.
F. Verify that the Step Functions workflow has the correct permissions to be invoked by EventBridge.
Show Answer
Correct Answer: A, B, E
Explanation: Enable schema discovery to verify that incoming events match the rule pattern, monitor EventBridge and Step Functions metrics to determine where events stop flowing, and review EventBridge failed invocation metrics to identify IAM execution role permission problems. Step Functions does not rely on a resource-based policy for EventBridge invocation; the EventBridge rule's execution role needs permission to start the state machine.
Question 145
A company recently configured AWS Control Tower in its organization in AWS Organizations. The company enrolled all existing AWS accounts in AWS Control Tower. The company wants to ensure that all new AWS accounts are automatically enrolled in AWS Control Tower.
The company has an existing AWS Step Functions workflow that creates new AWS accounts and performs any actions required as part of account creation. The Step Functions workflow is defined in the same AWS account as AWS Control Tower.
Which combination of steps should the company add to the Step Functions workflow to meet these requirements? (Choose two.)
A. Create an Amazon EventBridge event that has an aws.controltower source and a CreateManagedAccount detail-type. Add the details of the new AWS account to the detail field of the event.
B. Create an Amazon EventBridge event that has an aws.controltower source and a SetupLandingZone detail-type. Add the details of the new AWS account to the detail field of the event.
C. Create an AWSControlTowerExecution role in the new AWS account. Configure the role to allow the AWS Control Tower administrator account to assume the role.
D. Call the AWS Service Catalog ProvisionProduct API operation with the details of the new AWS account.
E. Call the Organizations EnableAWSServiceAccess API operation with the controltower.amazonaws.com service name and the details of the new AWS account.
Show Answer
Correct Answer: C, D
Explanation: To enroll a newly created existing AWS account into AWS Control Tower programmatically, the account must contain the AWSControlTowerExecution role so Control Tower can assume it and apply governance. The enrollment workflow uses the AWS Control Tower Account Factory backed by AWS Service Catalog, so the Step Functions workflow should call the Service Catalog ProvisionProduct API to provision the enrollment product. Creating custom EventBridge events does not trigger enrollment, and EnableAWSServiceAccess is an organization-level setup operation, not something performed for each new account.
Question 146
A DevOps engineer deploys an application to a fleet of Amazon Linux EC2 instances. The DevOps engineer needs to monitor system metrics across the fleet. The DevOps engineer wants to monitor the relationship between network traffic and memory utilization for the application code. The DevOps engineer wants to track the data on a 60 second interval.
Which solution will meet these requirements?
A. Use Amazon CloudWatch basic monitoring to collect the NetworkIn metric and the MemoryBytesUsed metric. Graph the metrics in CloudWatch.
B. Use Amazon CloudWatch detailed monitoring to collect the NetworkIn metric and the MemoryBytesUsed metric. Graph the metrics in CloudWatch.
C. Use Amazon CloudWatch detailed monitoring to collect the NetworkIn metric. Install the CloudWatch agent on the EC2 instances to collect the mem_used metric. Graph the metrics in CloudWatch.
D. Use Amazon CloudWatch basic monitoring to collect the built-in NetworkIn metric. Install the CloudWatch agent on the EC2 instances to collect the mem_used metric. Graph the metrics in CloudWatch.
Show Answer
Correct Answer: C
Explanation: EC2 built-in CloudWatch metrics include NetworkIn but do not include memory utilization. Memory metrics such as mem_used require the CloudWatch agent. The requirement is a 60-second interval, so detailed monitoring is needed for the EC2 NetworkIn metric (basic monitoring is 5-minute intervals). Graph NetworkIn and mem_used together in CloudWatch.
Question 147
A DevOps engineer needs to configure a blue/green deployment for an existing three-tier application. The application runs on Amazon EC2 instances and uses an Amazon RDS database. The EC2 instances run behind an Application Load Balancer (ALB) and are in an Auto Scaling group.
The DevOps engineer has created launch templates, Auto Scaling groups, and ALB target groups for the blue environment and the green environment. Each target group specifies which application version, blue or green, will be loaded on the EC2 instances. An Amazon Route 53 record for www.example.com points to the ALB.
The deployment must shift traffic all at once from the blue environment to the green environment.
Which solution will meet these requirements?
A. Starta rolling restart of the Auto Scaling group for the green environment to deploy the new application version to the green environment's EC2 instances. When the rolling restart is complete, use an AWS CLI command to update the ALB to send traffic to the green environment's target group.
B. Use an AWS CLI command to update the ALB to send traffic to the green environments target group. Start a rolling restart of the Auto Scaling group for the green environment to deploy the new application version to the green environment's EC2 instances.
C. Update the launch template to deploy the green environment's application version to the blue environment's EC2 instances. Do not change the target groups or the Auto Scaling groups in either environment. Perform a rolling restart of the blue environments EC2 instances.
D. Starta rolling restart of the Auto Scaling group for the green environment to deploy the new application version to the green environment's EC2 instances. When the rolling restart is complete, update Route 53 to point to the green environment's endpoint on the ALB.
Show Answer
Correct Answer: A
Explanation: In a blue/green deployment, the green environment is prepared and validated before any production traffic is shifted. After the green Auto Scaling group has the new application version running, traffic should be switched atomically by changing the Application Load Balancer listener to forward requests to the green target group. Updating Route 53 is unnecessary because both environments are behind the same ALB, and updating the launch template for the blue environment is a rolling update rather than a blue/green deployment.
Question 148
A company has multiple AWS accounts. The company uses AWS IAM Identity Center that is integrated with a third-party SAML 2.0 identity provider (IdP).
The attributes for access control feature is enabled in IAM Identity Center. The attribute mapping list maps the department key from the IdP to the ${path:enterprise.department} attribute. All existing Amazon EC2 instances have a d1, d2, d3 department tag that corresponds to three company’s departments.
A DevOps engineer must create policies based on the matching attributes. The policies must grant each user access to only the EC2 instances that are tagged with the user’s respective department name.
Which condition key should the DevOps engineer include in the custom permissions policies to meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: C
Explanation: With IAM Identity Center ABAC, the IdP attribute (enterprise.department) is mapped into a principal tag. The IAM policy should compare the EC2 resource tag for the department with the authenticated user's principal tag using the global condition key aws:PrincipalTag. For example, a condition such as ec2:ResourceTag/department = ${aws:PrincipalTag/department} restricts access to instances whose department tag matches the user's department.
Question 149
A company uses Amazon Redshift as its data warehouse solution. The company wants to create a dashboard to view changes to the Redshift users and the queries the users perform.
Which combination of steps will meet this requirement? (Choose two.)
A. Create an Amazon CloudWatch log group. Create an AWS CloudTrail trail that writes to the CloudWatch log group.
B. Create a new Amazon S3 bucket. Configure default audit logging on the Redshift cluster. Configure the S3 bucket as the target.
C. Configure the Redshift cluster database audit logging to include user activity logs. Configure Amazon CloudWatch as the target.
D. Create an Amazon CloudWatch dashboard that has a log widget. Configure the widget to display user details from the Redshift logs.
E. Create an AWS Lambda function that uses Amazon Athena to query the Redshift logs. Create an Amazon CloudWatch dashboard that has a custom widget type that uses the Lambda function.
Show Answer
Correct Answer: C, D
Explanation: Amazon Redshift database audit logging can be configured to send audit logs, including user activity logs (queries) and user-related events, to Amazon CloudWatch Logs. A CloudWatch dashboard can then display those logs using a log widget. CloudTrail does not capture SQL query activity, and the Athena/Lambda custom widget approach is unnecessary when CloudWatch Logs is the logging target.
Question 150
A company runs a website by using an Amazon Elastic Container Service (Amazon ECS) service that is connected to an Application Load Balancer (ALB). The service was in a steady state with tasks responding to requests successfully.
A DevOps engineer updated the task definition with a new container image and deployed the new task definition to the service. The DevOps engineer noticed that the service is frequently stopping and starting new tasks because the ALB healtth checks are failing.
What should the DevOps engineer do to troubleshoot the failed deployment?
A. Ensure that a security group associated with the service allows traffic from the ALB.
B. Increase the ALB health check grace period for the service.
C. Increase the service minimum healthy percent setting.
D. Decrease the ALB health check interval.
Show Answer
Correct Answer: B
Explanation: The most likely cause is that the new container image takes longer to start than the previous version, so ECS replaces tasks because they fail ALB health checks before they are ready. Increasing the ECS service health check grace period allows new tasks time to initialize before health check failures are considered. A security group issue is unlikely because only the task definition image changed and the service was previously healthy. Increasing minimum healthy percent affects deployment capacity, not health check failures. Decreasing the ALB health check interval would make checks occur more frequently and likely worsen the problem.
Question 151
An Amazon EC2 Auto Scaling group manages EC2 instances that were created from an AMI. The AMI has the AWS Systems Manager Agent installed. When an EC2 instance is launched into the Auto Scaling group, tags are applied to the EC2 instance.
EC2 instances that are launched by the Auto Scaling group must have the correct operating system configuration.
Which solution will meet these requirements?
A. Create a Systems Manager Run Command document that configures the desired instance configuration. Set up Systems Manager Compliance to invoke the Run Command document when the EC2 instances are not in compliance with the most recent patches.
B. Create a Systems Manager State Manager association that links to the Systems Manager command document. Create a tag query that runs immediately.
C. Create a Systems Manager Run Command task that specifies the desired instance configuration. Create a maintenance window in Systems Manager Maintenance Windows that runs daily. Register the Run Command task against the maintenance window. Designate the targets.
D. Create a Systems Manager Patch Manager patch baseline and a patch group that use the same tags that the Auto Scaling group applies. Register the patch group with the patch baseline. Define a Systems Manager command document to patch the instances Invoke the document by using Systems Manager Run Command.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager State Manager is designed to automatically apply and maintain a desired configuration on managed instances. By creating a State Manager association that targets instances by the tags applied by the Auto Scaling group and configuring it to run immediately, newly launched instances are configured as soon as they become managed by Systems Manager. The other options focus on compliance, scheduled maintenance, or patching rather than continuous configuration management.
Question 152
A company uses AWS Organizations to manage its AWS accounts. The organization root has a child OU that is named Department. The Department OU has a child OU that is named Engineering. The default FullAWSAccess policy is attached to the root, the Department OU, and the Engineering OU.
The company has many AWS accounts in the Engineering OU. Each account has an administrative IAM role with the AdministratorAccess IAM policy attached. The default FullAWSAccessPolicy is also attached to each account.
A DevOps engineer plans to remove the FullAWSAccess policy from the Department OU. The DevOps engineer will replace the policy with a policy that contains an Allow statement for all Amazon EC2 API operations.
What will happen to the permissions of the administrative 1AM roles as a result of this change?
A. All API actions on all resources will be allowed.
B. All API actions on EC2 resources will be allowed. All other API actions will be denied.
C. All API actions on all resources will be denied.
D. All API actions on EC2 resources will be denied. All other API actions will be allowed.
Show Answer
Correct Answer: B
Explanation: Service control policies (SCPs) define the maximum available permissions, and permissions are allowed only if an action is allowed by every SCP in the hierarchy (root, each OU in the path, and account). Replacing FullAWSAccess on the Department OU with an SCP that allows only Amazon EC2 actions means the effective SCP intersection is limited to EC2 API actions, even though FullAWSAccess remains attached at the root, Engineering OU, and account. The AdministratorAccess IAM policy cannot grant permissions beyond the SCP boundary. Therefore, only EC2 API actions are allowed and all other API actions are denied.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.