A company manages AWS accounts in AWS Organizations. The company needs a solution to send Amazon CloudWatch Logs data to an Amazon S3 bucket in a dedicated AWS account. The solution must support all existing and future CloudWatch Logs log groups.
Which solution will meet these requirements?
A. Enable Organizations backup policies to back up all log groups to a dedicated S3 bucket. Add an S3 bucket policy that allows access from all accounts that belong to the company.
B. Create a backup plan in AWS Backup. Specify a dedicated S3 bucket as a backup vault. Assign all CloudWatch Logs log group resources to the backup plan. Create resource assignments in the backup plan for all accounts that belong to the company.
C. Create a backup plan in AWS Backup. Specify a dedicated S3 bucket as a backup vault. Assign all existing log groups to the backup plan. Create resource assignments in the backup plan for all accounts that belong to the company. Create an AWS Systems Manager Automation runbook to assign log groups to a backup plan. Create an AWS Config rule that has an automatic remediation action for all noncompliant log groups. Specify the runbook as the rule's target.
D. Create a CloudWatch Logs destination and an Amazon Kinesis Data Firehose delivery stream in the dedicated AWS account. Specify the S3 bucket as the destination of the delivery stream. Create subscription filters for all existing log groups in all accounts. Create an AWS Lambda function to call the CloudWatch Logs PutSubscriptionFilter API operation. Create an Amazon EventBridge rule to invoke the Lambda function when a CreateLogGroup event occurs.
Show Answer
Correct Answer: D
Explanation: CloudWatch Logs cannot be backed up or exported across accounts using AWS Backup or Organizations backup policies. To centrally send log data to S3 and automatically cover all existing and future log groups across accounts, the correct pattern is to use CloudWatch Logs subscription filters that send logs to a cross-account destination. A CloudWatch Logs destination paired with a Kinesis Data Firehose delivery stream in a dedicated account can deliver logs to S3. Automation with EventBridge and Lambda ensures new log groups automatically get subscription filters, satisfying the requirement for future log groups.
Question 117
A company is running a custom-built application that processes records. All the components run on Amazon EC2 instances that run in an Auto Scaling group. Each record's processing is a multistep sequential action that is compute-intensive. Each step is always completed in 5 minutes or less.
A limitation of the current system is that if any steps fail, the application has to reprocess the record from the beginning. The company wants to update the architecture so that the application must reprocess only the failed steps.
What is the MOST operationally efficient solution that meets these requirements?
A. Create a web application to write records to Amazon S3. Use S3 Event Notifications to publish to an Amazon Simple Notification Service (Amazon SNS) topic. Use an EC2 instance to poll Amazon SNS and start processing. Save intermediate results to Amazon S3 to pass on to the next step.
B. Perform the processing steps by using logic in the application. Convert the application code to run in a container. Use AWS Fargate to manage the container instances. Configure the container to invoke itself to pass the state from one step to the next.
C. Create a web application to pass records to an Amazon Kinesis data stream. Decouple the processing by using the Kinesis data stream and AWS Lambda functions.
D. Create a web application to pass records to AWS Step Functions. Decouple the processing into Step Functions tasks and AWS Lambda functions.
Show Answer
Correct Answer: D
Explanation: AWS Step Functions is designed to orchestrate multi-step, sequential workflows with built-in state management, error handling, and retry logic. By breaking the record processing into Step Functions tasks backed by AWS Lambda, each step’s state is preserved. If a step fails, only that step is retried or reprocessed instead of restarting the entire workflow. This serverless, managed approach removes the need to build custom retry and state-passing logic, making it the most operationally efficient solution.
Question 118
A company has an organization in AWS Organizations for its multi-account environment. A DevOps engineer is developing an AWS CodeArtifact based strategy for application package management across the organization. Each application team at the company has its own account in the organization. Each application team also has limited access to a centralized shared services account.
Each application team needs full access to download, publish, and grant access to its own packages. Some common library packages that the application teams use must also be shared with the entire organization.
Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose three.)
A. Create a domain in each application team's account. Grant each application team's account full read access and write access to the application team's domain.
B. Create a domain in the shared services account. Grant the organization read access and CreateRepository access.
C. Create a repository in each application team’s account. Grant each application team’s account full read access and write access to its own repository.
D. Create a repository in the shared services account. Grant the organization read access to the repository in the shared services account Set the repository as the upstream repository in each application team's repository.
E. For teams that require shared packages, create resource-based policies that allow read access to the repository from other application teams' accounts.
F. Set the other application teams' repositories as upstream repositories.
Show Answer
Correct Answer: B, C, D
Explanation: Using a single CodeArtifact domain in the shared services account with organization-wide permissions minimizes duplication and central administration (B). Each application team then manages its own repository in its own account with full publish and download permissions, satisfying team autonomy with minimal cross-account policy management (C). Common libraries are placed in a shared services repository that is readable by the entire organization and configured as an upstream repository for team repositories, enabling seamless consumption of shared packages with the least ongoing overhead (D).
Question 119
A company has an organization in AWS Organizations. A DevOps engineer needs to maintain multiple AWS accounts that belong to different OUs in the organization. All resources, including IAM policies and Amazon S3 policies within an account, are deployed through AWS CloudFormation. All templates and code are maintained in an AWS CodeCommit repository. Recently, some developers have not been able to access an S3 bucket from some accounts in the organization.
The following policy is attached to the S3 bucket:
What should the DevOps engineer do to resolve this access issue?
A. Modify the S3 bucket policy. Turn off the S3 Block Public Access setting on the S3 bucket. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue.
B. Verify that no IAM permissions boundaries are denying developers access to the S3 bucket. Make the necessary changes to IAM permissions boundaries. Use an AWS Config recorder in the individual developer accounts that are experiencing the issue to revert any changes that are blocking access. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
C. Configure an SCP that stops anyone from modifying IAM resources in developer OUs. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
D. Ensure that no SCP is blocking access for developers to the S3 bucket. Ensure that no IAM policy permissions boundaries are denying access to developer IAM users. Make the necessary changes to the SCP and IAM policy permissions boundaries in the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
Show Answer
Correct Answer: D
Explanation: In an AWS Organizations setup, access to resources can be implicitly denied by higher-level controls even if the S3 bucket policy appears correct. Service control policies (SCPs) and IAM permissions boundaries can restrict S3 access for only some accounts or users, depending on OU placement and boundary attachment. The correct approach is to verify that no SCP is blocking S3 actions and that IAM permissions boundaries are not denying access. Any fixes must follow the company’s governance model by updating templates in CodeCommit and redeploying with CloudFormation. Other options focus on S3 bucket policy changes or public access settings, which do not address organization-level or boundary-based denies.
Question 120
A company needs to increase the security of the container images that run in its production environment. The company wants to integrate operating system scanning and programming language package vulnerability scanning for the containers in its CI/CD pipeline. The CI/CD pipeline is an AWS CodePipeline pipeline that includes an AWS CodeBuild build project, AWS CodeDeploy actions, and an Amazon Elastic Container Registry (Amazon ECR) repository.
A DevOps engineer needs to add an image scan to the CI/CD pipeline. The CI/CD pipeline must deploy only images without CRITICAL and HIGH findings into production.
Which combination of steps will meet these requirements? (Choose two.)
A. Use Amazon ECR basic scanning.
B. Use Amazon ECR enhanced scanning.
C. Configure Amazon ECR to submit a Rejected status to the CI/CD pipeline when the image scan returns CRITICAL or HIGH findings.
D. Configure an Amazon EventBridge rule to invoke an AWS Lambda function when the image scan is completed. Configure the Lambda function to consume the Amazon Inspector scan status and to submit an Approved or Rejected status to the CI/CD pipeline.
E. Configure an Amazon EventBridge rule to invoke an AWS Lambda function when the image scan is completed. Configure the Lambda function to consume the Clair scan status and to submit an Approved or Rejected status to the CI/CD pipeline.
Show Answer
Correct Answer: B, D
Explanation: Amazon ECR enhanced scanning integrates with Amazon Inspector and provides both operating system and programming language package vulnerability scanning, which meets the requirement for comprehensive container image security. To ensure that only images without CRITICAL or HIGH findings are deployed, an Amazon EventBridge rule can detect scan completion and invoke a Lambda function. The Lambda function evaluates the Amazon Inspector scan results and reports an Approved or Rejected status back to the CI/CD pipeline, gating deployment appropriately.
Question 121
A company wants to decrease the time it takes to develop new features. The company uses AWS CodeBuild and AWS CodeDeploy to build and deploy its applications. The company uses AWS CodePipeline to deploy each microservice with its own CI/CD pipeline.
The company needs more visibility into the average time between the release of new features and the average time to recover after a failed deployment.
Which solution will provide this visibility with the LEAST configuration effort?
A. Program an AWS Lambda function that creates Amazon CloudWatch custom metrics with information about successful runs and failed runs for each pipeline. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minutes. Use the metrics to build a CloudWatch dashboard.
B. Program an AWS Lambda function that creates Amazon CloudWatch custom metrics with information about successful runs and failed runs for each pipeline. Create an Amazon EventBridge rule to invoke the Lambda function after every successful run and after every failed run. Use the metrics to build a CloudWatch dashboard.
C. Program an AWS Lambda function that writes information about successful runs and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule to invoke the Lambda function after every successful run and after every failed run. Build an Amazon QuickSight dashboard to show the information from DynamoDB.
D. Program an AWS Lambda function that writes information about successful runs and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minutes. Build an Amazon QuickSight dashboard to show the information from DynamoDB.
Show Answer
Correct Answer: B
Explanation: Event-driven metrics collection using EventBridge on pipeline success/failure requires the least configuration and provides near-real-time visibility. Publishing CloudWatch custom metrics directly enables easy calculation of deployment frequency and mean time to recovery with a simple dashboard. Polling every 5 minutes adds unnecessary complexity and delay, while DynamoDB and QuickSight significantly increase setup and maintenance effort.
Question 122
A developer is creating a proof of concept for a new software as a service (SaaS) application. The application is in a shared development AWS account that is part of an organization in AWS Organizations.
The developer needs to create service-linked IAM roles for the AWS services that are being considered for the proof of concept. The solution needs to give the developer the ability to create and configure the service-linked roles only.
Which solution will meet these requirements?
A. Create an IAM user for the developer in the organization's management account. Configure a cross-account role in the development account for the developer to use. Limit the scope of the cross-account role to common services.
B. Add the developer to an IAM group. Attach the PowerUserAccess managed policy to the IAM group. Enforce multi-factor authentication (MFA) on the user account.
C. Add an SCP to the development account in Organizations. Configure the SCP with a Deny rule for iam:* to limit the developer's access.
D. Create an IAM role that has the necessary IAM access to allow the developer to create policies and roles. Create and attach a permissions boundary to the role. Grant the developer access to assume the role.
Show Answer
Correct Answer: D
Explanation: The requirement is to allow the developer to create and configure only service-linked IAM roles, following least privilege. Creating an IAM role with specific IAM permissions for service-linked role creation, combined with a permissions boundary, tightly constrains what the developer can do while still enabling the proof of concept. The developer can assume the role when needed, and the permissions boundary prevents escalation beyond the intended scope. Other options either grant overly broad permissions, add unnecessary complexity, or only restrict permissions without granting the required access.
Question 123
A company runs its container workloads in AWS App Runner. A DevOps engineer manages the company's container repository in Amazon Elastic Container Registry (Amazon ECR).
The DevOps engineer must implement a solution that continuously monitors the container repository. The solution must create a new container image when the solution detects an operating system vulnerability or language package vulnerability.
Which solution will meet these requirements?
A. Use EC2 Image Builder to create a container image pipeline. Use Amazon ECR as the target repository. Turn on enhanced scanning on the ECR repository. Create an Amazon EventBridge rule to capture an Inspector? finding event. Use the event to invoke the image pipeline. Re-upload the container to the repository.
B. Use EC2 Image Builder to create a container image pipeline. Use Amazon ECR as the target repository. Enable Amazon GuardDuty Malware Protection on the container workload. Create an Amazon EventBridge rule to capture a GuardDuty finding event. Use the event to invoke the image pipeline.
C. Create an AWS CodeBuild project to create a container image. Use Amazon ECR as the target repository. Turn on basic scanning on the repository. Create an Amazon EventBridge rule to capture an ECR image action event. Use the event to invoke the CodeBuild project. Re-upload the container to the repository.
D. Create an AWS CodeBuild project to create a container image. Use Amazon ECR as the target repository. Configure AWS Systems Manager Compliance to scan all managed nodes. Create an Amazon EventBridge rule to capture a configuration compliance state change event. Use the event to invoke the CodeBuild project.
Show Answer
Correct Answer: A
Explanation: Amazon ECR enhanced scanning uses Amazon Inspector to continuously scan container images for operating system and language package vulnerabilities. Inspector findings are emitted as events that can be captured by Amazon EventBridge. EC2 Image Builder can then be invoked to rebuild the container image pipeline and push an updated image back to ECR, meeting the requirement for continuous monitoring and automatic image recreation when vulnerabilities are detected.
Question 124
A company wants to deploy a workload on several hundred Amazon EC2 instances. The company will provision the EC2 instances in an Auto Scaling group by using a launch template.
The workload will pull files from an Amazon S3 bucket, process the data, and put the results into a different S3 bucket. The EC2 instances must have least-privilege permissions and must use temporary security credentials.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an IAM role that has the appropriate permissions for S3 buckets Add the IAM role to an instance profile.
B. Update the launch template to include the IAM instance profile.
C. Create an IAM user that has the appropriate permissions for Amazon S3 Generate a secret key and token.
D. Create a trust anchor and profile Attach the IAM role to the profile.
E. Update the launch template Modify the user data to use the new secret key and token.
Show Answer
Correct Answer: A, B
Explanation: To grant EC2 instances least-privilege access with temporary credentials, the correct approach is to use an IAM role attached via an instance profile. Creating an IAM role with only the required Amazon S3 permissions and adding it to an instance profile enables EC2 to obtain temporary credentials automatically. Updating the launch template to include this instance profile ensures all instances in the Auto Scaling group assume the role at launch. The other options rely on long-term credentials or unrelated IAM features and do not meet security best practices.
Question 125
A company has configured Amazon RDS storage autoscaling for its RDS DB instances. A DevOps team needs to visualize the autoscaling events on an Amazon CloudWatch dashboard.
Which solution will meet this requirement?
A. Create an Amazon EventBridge rule that reacts to RDS storage autoscaling events from RDS events. Create an AWS Lambda function that publishes a CloudWatch custom metric. Configure the EventBridge rule to invoke the Lambda function. Visualize the custom metric by using the CloudWatch dashboard.
B. Create a trail by using AWS CloudTrail with management events configured. Configure the trail to send the management events to Amazon CloudWatch Logs. Create a metric filter in CloudWatch Logs to match the RDS storage autoscaling events. Visualize the metric filter by using the CloudWatch dashboard.
C. Create an Amazon EventBridge rule that reacts to RDS storage autoscaling events from the RDS events. Create a CloudWatch alarm. Configure the EventBridge rule to change the status of the CloudWatch alarm. Visualize the alarm status by using the CloudWatch dashboard.
D. Create a trail by using AWS CloudTrail with data events configured. Configure the trail to send the data events to Amazon CloudWatch Logs. Create a metric filter in CloudWatch Logs to match the RDS storage autoscaling events. Visualize the metric filter by using the CloudWatch dashboard.
Show Answer
Correct Answer: A
Explanation: RDS storage autoscaling emits RDS events that can be consumed by Amazon EventBridge, but these events are not exposed as native CloudWatch metrics. To visualize autoscaling activity on a CloudWatch dashboard, the events must be converted into metrics. Using EventBridge to capture the autoscaling events and a Lambda function to publish a custom CloudWatch metric enables direct dashboard visualization. CloudTrail options are incorrect because RDS storage autoscaling is not logged as CloudTrail management or data events, and alarms cannot be directly driven or visualized as metrics by EventBridge.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.