A company has deployed an application in a single AWS Region. The application backend uses Amazon DynamoDB tables and Amazon S3 buckets.
The company wants to deploy the application in a secondary Region. The company must ensure that the data in the DynamoDB tables and the S3 buckets persists across both Regions. The data must also immediately propagate across Regions.
Which solution will meet these requirements with the MOST operational efficiency?
A. Implement two-way S3 bucket replication between the primary Region's S3 buckets and the secondary Region’s S3 buckets. Convert the DynamoDB tables into global tables. Set the secondary Region as the additional Region.
B. Implement S3 Batch Operations copy jobs between the primary Region and the secondary Region for all S3 buckets. Convert the DynamoDB tables into global tables. Set the secondary Region as the additional Region.
C. Implement two-way S3 bucket replication between the primary Region's S3 buckets and the secondary Region's S3 buckets. Enable DynamoDB streams on the DynamoDB tables in both Regions. In each Region, create an AWS Lambda function that subscribes to the DynamoDB streams. Configure the Lambda function to copy new records to the DynamoDB tables in the other Region.
D. Implement S3 Batch Operations copy jobs between the primary Region and the secondary Region for all S3 buckets. Enable DynamoDB streams on the DynamoDB tables in both Regions. In each Region, create an AWS Lambda function that subscribes to the DynamoDB streams. Configure the Lambda function to copy new records to the DynamoDB tables in the other Region.
Show Answer
Correct Answer: A
Explanation: The requirement is immediate cross-Region data propagation with the most operational efficiency. Amazon DynamoDB global tables provide built-in, active-active, near-real-time replication across Regions without custom code. S3 Cross-Region Replication provides automatic, continuous replication of object changes. S3 Batch Operations are for bulk, non-immediate copies, and DynamoDB Streams with Lambda adds significant operational complexity. Therefore, using global tables and S3 replication is the most efficient solution.
Question 127
A company uses Amazon EC2 as its primary compute platform. A DevOps team wants to audit the company's EC2 instances to check whether any prohibited applications have been installed on the EC2 instances.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure AWS Systems Manager on each instance. Use AWS Systems Manager Inventory. Use Systems Manager resource data sync to synchronize and store findings in an Amazon S3 bucket. Create an AWS Lambda function that runs when new objects are added to the S3 bucket. Configure the Lambda function to identify prohibited applications.
B. Configure AWS Systems Manager on each instance. Use Systems Manager Inventory Create AWS Config rules that monitor changes from Systems Manager Inventory to identify prohibited applications.
C. Configure AWS Systems Manager on each instance. Use Systems Manager Inventory. Filter a trail in AWS CloudTrail for Systems Manager Inventory events to identify prohibited applications.
D. Designate Amazon CloudWatch Logs as the log destination for all application instances. Run an automated script across all instances to create an inventory of installed applications. Configure the script to forward the results to CloudWatch Logs. Create a CloudWatch alarm that uses filter patterns to search log data to identify prohibited applications.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Inventory can collect detailed information about installed software on EC2 instances. When integrated with AWS Config, this inventory data can be recorded, tracked over time, and evaluated using AWS Config rules to detect noncompliant or prohibited applications. This is a native, managed solution that provides continuous compliance monitoring with minimal custom code or operational overhead, making it the most operationally efficient choice.
Question 128
A company uses an organization in AWS Organizations that has all features enabled. The company uses AWS Backup in a primary account and uses an AWS Key Management Service (AWS KMS) key to encrypt the backups.
The company needs to automate a cross-account backup of the resources that AWS Backup backs up in the primary account. The company configures cross-account backup in the Organizations management account. The company creates a new AWS account in the organization and configures an AWS Backup backup vault in the new account. The company creates a KMS key in the new account to encrypt the backups. Finally, the company configures a new backup plan in the primary account. The destination for the new backup plan is the backup vault in the new account.
When the AWS Backup job in the primary account is invoked, the job creates backups in the primary account. However, the backups are not copied to the new account's backup vault.
Which combination of steps must the company take so that backups can be copied to the new account's backup vault? (Choose two.)
A. Edit the backup vault access policy in the new account to allow access to the primary account.
B. Edit the backup vault access policy in the primary account to allow access to the new account.
C. Edit the backup vault access policy in the primary account to allow access to the KMS key in the new account.
D. Edit the key policy of the KMS key in the primary account to share the key with the new account.
E. Edit the key policy of the KMS key in the new account to share the key with the primary account.
Show Answer
Correct Answer: A, D
Explanation: For cross-account AWS Backup copy, two permissions are required. First, the destination backup vault must explicitly trust the source (primary) account; this is done by editing the backup vault access policy in the new account (A). Second, when source resources are encrypted with a customer managed KMS key, that source KMS key must allow the destination account to use it during the copy operation; therefore, the key policy of the KMS key in the primary account must be shared with the new account (D). Sharing only the destination account’s KMS key is insufficient, because AWS Backup must read and re-encrypt data using the source key during the copy process.
Question 129
A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region strategy for the objects that are stored in the S3 bucket. The company needs to be able to fail over to an S3 bucket in another AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes.
The DevOps engineer enables two-way replication between the S3 buckets.
Which combination of steps should the DevOps engineer take next to meet the requirements? (Choose three.)
A. Enable S3 Replication Time Control (S3 RTC) on each replication rule.
B. Create an S3 Multi-Region Access Point in an active-passive configuration.
C. Call the SubmitMultiRegionAccessPointRoutes operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.
D. Enable S3 Transfer Acceleration on both S3 buckets.
E. Configure a routing control in Amazon Route 53 Recovery Controller. Add the S3 buckets in an active-passive configuration.
F. Call the UpdateRoutingControlStates operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.
Show Answer
Correct Answer: A, B, C
Explanation: The requirement to replicate objects within 15 minutes is met by enabling S3 Replication Time Control (RTC), which provides a 99.99% SLA for replication within 15 minutes. For multi-Region access and failover, an S3 Multi-Region Access Point (MRAP) in an active-passive configuration provides a single global endpoint over multiple buckets. During a failover event, traffic must be shifted to the other Region by updating MRAP routing, which is done by calling the SubmitMultiRegionAccessPointRoutes API operation. Other options either do not guarantee replication timing or apply to different services (such as Route 53 Recovery Controller).
Question 130
A company uses the AWS Cloud Development Kit (AWS CDK) to define its application. The company uses a pipeline that consists of AWS CodePipeline and AWS CodeBuild to deploy the CDK application.
The company wants to introduce unit tests to the pipeline to test various infrastructure components. The company wants to ensure that a deployment proceeds if no unit tests result in a failure.
Which combination of steps will enforce the testing requirement in the pipeline? (Choose two.)
A. Update the CodeBuild build phase commands to run the tests then to deploy the application. Set the OnFailure phase property to ABORT.
B. Update the CodeBuild build phase commands to run the tests then to deploy the application. Add the --rollback true flag to the cdk deploy command.
C. Update the CodeBuild build phase commands to run the tests then to deploy the application. Add the --require-approval any-change flag to the cdk deploy command.
D. Create a test that uses the AWS CDK assertions module. Use the template.hasResourceProperties assertion to test that resources have the expected properties.
E. Create a test that uses the cdk diff command. Configure the test to fail if any resources have changed.
Show Answer
Correct Answer: A, D
Explanation: The pipeline must both run unit tests and stop deployment if those tests fail. Updating the CodeBuild build phase to run tests before deployment and configuring failure handling to abort the build ensures the pipeline only continues when tests pass (A). Writing unit tests using the AWS CDK assertions module, such as template.hasResourceProperties, provides proper unit-level validation of the synthesized infrastructure (D). The other options do not enforce unit test execution or failure-based gating of deployments.
Question 131
A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are in multiple Availability Zones. The application was misconfigured in a single Availability Zone, which caused a partial outage of the application.
A DevOps engineer made changes to ensure that the unhealthy EC2 instances in one Availability Zone do not affect the healthy EC2 instances in the other Availability Zones. The DevOps engineer needs to test the application's failover and shift where the ALB sends traffic. During failover, the ALB must avoid sending traffic to the Availability Zone where the failure has occurred.
Which solution will meet these requirements?
A. Turn off cross-zone load balancing on the ALB. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.
B. Turn off cross-zone load balancing on the ALB’s target group. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.
C. Create an Amazon Route 53 Application Recovery Controller resource set that uses the DNS hostname of the ALB. Start a zonal shift for the resource set away from the Availability Zone.
D. Create an Amazon Route 53 Application Recovery Controller resource set that uses the ARN of the ALB’s target group. Create a readiness check that uses the ElbV2TargetGroupsCanServeTraffic rule.
Show Answer
Correct Answer: B
Explanation: Amazon Route 53 Application Recovery Controller (ARC) zonal shift requires cross-zone load balancing to be disabled so traffic can be isolated per Availability Zone. For Application Load Balancers, cross-zone load balancing cannot be turned off at the ALB level; it can only be disabled at the target group level (which overrides the ALB setting). Disabling it on the target group and then starting a zonal shift ensures the ALB avoids sending traffic to the failed Availability Zone.
Question 132
A company sends its AWS Network Firewall flow logs to an Amazon S3 bucket. The company then analyzes the flow logs by using Amazon Athena.
The company needs to transform the flow logs and add additional data before the flow logs are delivered to the existing S3 bucket.
Which solution will meet these requirements?
A. Create an AWS Lambda function to transform the data and to write a new object to the existing S3 bucket. Configure the Lambda function with an S3 trigger for the existing S3 bucket. Specify all object create events for the event type. Acknowledge the recursive invocation.
B. Enable Amazon EventBridge notifications on the existing S3 bucket. Create a custom EventBridge event bus. Create an EventBridge rule that is associated with the custom event bus. Configure the rule to react to all object create events for the existing S3 bucket and to invoke an AWS Step Functions workflow. Configure a Step Functions task to transform the data and to write the data into a new S3 bucket.
C. Create an Amazon EventBridge rule that is associated with the default EventBridge event bus. Configure the rule to react to all object create events for the existing S3 bucket. Define a new S3 bucket as the target for the rule. Create an EventBridge input transformation to customize the event before passing the event to the rule target.
D. Create an Amazon Kinesis Data Firehose delivery stream that is configured with an AWS Lambda transformer. Specify the existing S3 bucket as the destination. Change the Network Firewall logging destination from Amazon S3 to Kinesis Data Firehose.
Show Answer
Correct Answer: D
Explanation: The requirement is to transform AWS Network Firewall flow logs and add additional data *before* delivery to the existing S3 bucket. Amazon Kinesis Data Firehose natively supports data transformation using an AWS Lambda function in the delivery stream, and it can deliver the transformed records directly to Amazon S3. By changing the Network Firewall logging destination from S3 to Kinesis Data Firehose, the logs can be transformed inline and then written to the same S3 bucket. The other options either react after objects are already written to S3, risk recursion, or only transform event metadata rather than the log content.
Question 133
A DevOps engineer needs to implement integration tests into an existing AWS CodePipeline CI/CD workflow for an Amazon Elastic Container Service (Amazon ECS) service. The CI/CD workflow retrieves new application code from an AWS CodeCommit repository and builds a container image. The Cl/CD workflow then uploads the container image to Amazon Elastic Container Registry (Amazon ECR) with a new image tag version.
The integration tests must ensure that new versions of the service endpoint are reachable and that various API methods return successful response data. The DevOps engineer has already created an ECS cluster to test the service.
Which combination of steps will meet these requirements with the LEAST management overhead? (Choose three.)
A. Add a deploy stage to the pipeline. Configure Amazon ECS as the action provider.
B. Add a deploy stage to the pipeline. Configure AWS CodeDeploy as the action provider.
C. Add an appspec.yml file to the CodeCommit repository.
D. Update the image build pipeline stage to output an imagedefinitions.json file that references the new image tag.
E. Create an AWS Lambda function that runs connectivity checks and API calls against the service. Integrate the Lambda function with CodePipeline by using a Lambda action stage.
F. Write a script that runs integration tests against the service. Upload the script to an Amazon S3 bucket. Integrate the script in the S3 bucket with CodePipeline by using an S3 action stage.
Show Answer
Correct Answer: A, D, E
Explanation: To add integration tests to an existing ECS-based CI/CD pipeline with the least management overhead: (A) Using Amazon ECS as the deploy action provider allows CodePipeline to directly update the ECS service with the new image, avoiding the extra complexity of CodeDeploy. (D) ECS deploy actions require an imagedefinitions.json file so the pipeline can reference and deploy the newly built image tag. (E) A Lambda function integrated as a CodePipeline action is a lightweight, serverless way to run endpoint connectivity checks and API calls, minimizing infrastructure and operational management compared to managing test hosts or scripts.
Question 134
A company runs applications on Windows and Linux Amazon EC2 instances. The instances run across multiple Availability Zones in an AWS Region. The company uses Auto Scaling groups for each application.
The company needs a durable storage solution for the instances. The solution must use SMB for Windows and must use NFS for Linux. The solution must also have sub-millisecond latencies. All instances will read and write the data.
Which combination of steps will meet these requirements? (Choose three.)
A. Create an Amazon Elastic File System (Amazon EFS) file system that has targets in multiple Availability Zones.
B. Create an Amazon FSx for NetApp ONTAP Multi-AZ file system.
C. Create a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume to use for shared storage.
D. Update the user data for each application’s launch template to mount the file system.
E. Perform an instance refresh on each Auto Scaling group.
F. Update the EC2 instances for each application to mount the file system when new instances are launched.
Show Answer
Correct Answer: B, D, E
Explanation: The storage must support both SMB (Windows) and NFS (Linux), be shared read/write by all instances, provide sub-millisecond latency, and be durable across multiple Availability Zones. Amazon FSx for NetApp ONTAP Multi-AZ meets these requirements by supporting both SMB and NFS with high performance and Multi-AZ durability. Updating the launch template user data ensures that the file system is automatically mounted on all newly launched instances. Performing an Auto Scaling group instance refresh is required to replace existing instances so they pick up the updated launch template and mount the file system, ensuring consistency across all running instances.
Question 135
A company deploys an application to Amazon EC2 instances. The application runs Amazon Linux 2 and uses AWS CodeDeploy. The application has the following file structure for its code repository:
The appspec.yml file has the following contents in the files section:
What will the result be for the deployment of the config.txt file?
A. The config.txt file will be deployed to only /var/www/html/config/config.txt.
B. The config.txt file will be deployed to /usr/local/src/config.txt and to /var/www/html/config/config.txt.
C. The config.txt file will be deployed to only /usr/local/src/config.txt.
D. The config.txt file will be deployed to /usr/local/src/config.txt and to /var/www/html/application/web/config.txt.
Show Answer
Correct Answer: B
Explanation: In CodeDeploy, each entry in the files section is applied independently. One rule explicitly maps source: config/config.txt to destination: /usr/local/src/config.txt, so the file is copied there. Another rule maps source: / (the repository root) to destination: /var/www/html, which copies the entire repository contents, including config/config.txt, to /var/www/html/config/config.txt. Therefore, the same file is deployed to both locations.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.