A company has deployed an application in a single AWS Region. The application backend uses Amazon DynamoDB tables and Amazon S3 buckets.
The company wants to deploy the application in a secondary Region. The company must ensure that the data in the DynamoDB tables and the S3 buckets persists across both Regions. The data must also immediately propagate across Regions.
Which solution will meet these requirements with the MOST operational efficiency?
A. Implement two-way S3 bucket replication between the primary Region's S3 buckets and the secondary Region’s S3 buckets. Convert the DynamoDB tables into global tables. Set the secondary Region as the additional Region.
B. Implement S3 Batch Operations copy jobs between the primary Region and the secondary Region for all S3 buckets. Convert the DynamoDB tables into global tables. Set the secondary Region as the additional Region.
C. Implement two-way S3 bucket replication between the primary Region's S3 buckets and the secondary Region's S3 buckets. Enable DynamoDB streams on the DynamoDB tables in both Regions. In each Region, create an AWS Lambda function that subscribes to the DynamoDB streams. Configure the Lambda function to copy new records to the DynamoDB tables in the other Region.
D. Implement S3 Batch Operations copy jobs between the primary Region and the secondary Region for all S3 buckets. Enable DynamoDB streams on the DynamoDB tables in both Regions. In each Region, create an AWS Lambda function that subscribes to the DynamoDB streams. Configure the Lambda function to copy new records to the DynamoDB tables in the other Region.
Show Answer
Correct Answer: A
Explanation: Use DynamoDB global tables for native multi-Region active-active replication with low-latency automatic propagation and minimal operational overhead. For Amazon S3, configure cross-Region replication in both directions (two-way replication) so objects written in either Region are replicated to the other. S3 Batch Operations are for bulk copy tasks, not continuous immediate replication, and DynamoDB Streams with Lambda is a custom solution that is less operationally efficient than global tables.
Question 165
A company uses Amazon EC2 as its primary compute platform. A DevOps team wants to audit the company's EC2 instances to check whether any prohibited applications have been installed on the EC2 instances.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure AWS Systems Manager on each instance. Use AWS Systems Manager Inventory. Use Systems Manager resource data sync to synchronize and store findings in an Amazon S3 bucket. Create an AWS Lambda function that runs when new objects are added to the S3 bucket. Configure the Lambda function to identify prohibited applications.
B. Configure AWS Systems Manager on each instance. Use Systems Manager Inventory Create AWS Config rules that monitor changes from Systems Manager Inventory to identify prohibited applications.
C. Configure AWS Systems Manager on each instance. Use Systems Manager Inventory. Filter a trail in AWS CloudTrail for Systems Manager Inventory events to identify prohibited applications.
D. Designate Amazon CloudWatch Logs as the log destination for all application instances. Run an automated script across all instances to create an inventory of installed applications. Configure the script to forward the results to CloudWatch Logs. Create a CloudWatch alarm that uses filter patterns to search log data to identify prohibited applications.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Inventory is designed to collect software inventory from EC2 instances, and AWS Config can record Systems Manager Inventory data and evaluate it with Config rules. This provides a managed, low-operational-overhead way to detect prohibited (blacklisted) applications and track compliance. The other options rely on custom Lambda logic, CloudTrail (which is not intended for inventory content analysis), or custom scripts and CloudWatch Logs, all of which require more operational effort.
Question 166
A company uses an organization in AWS Organizations that has all features enabled. The company uses AWS Backup in a primary account and uses an AWS Key Management Service (AWS KMS) key to encrypt the backups.
The company needs to automate a cross-account backup of the resources that AWS Backup backs up in the primary account. The company configures cross-account backup in the Organizations management account. The company creates a new AWS account in the organization and configures an AWS Backup backup vault in the new account. The company creates a KMS key in the new account to encrypt the backups. Finally, the company configures a new backup plan in the primary account. The destination for the new backup plan is the backup vault in the new account.
When the AWS Backup job in the primary account is invoked, the job creates backups in the primary account. However, the backups are not copied to the new account's backup vault.
Which combination of steps must the company take so that backups can be copied to the new account's backup vault? (Choose two.)
A. Edit the backup vault access policy in the new account to allow access to the primary account.
B. Edit the backup vault access policy in the primary account to allow access to the new account.
C. Edit the backup vault access policy in the primary account to allow access to the KMS key in the new account.
D. Edit the key policy of the KMS key in the primary account to share the key with the new account.
E. Edit the key policy of the KMS key in the new account to share the key with the primary account.
Show Answer
Correct Answer: A, D
Explanation: For AWS Backup cross-account copy, the destination backup vault must have a resource-based access policy that allows the source account (AWS Backup) to copy recovery points into the vault. Additionally, if the source backups are encrypted with a customer managed KMS key, the source KMS key policy must grant the destination account permission to use that key for the cross-account copy operation. Sharing the destination KMS key with the source account is not the required step for this workflow.
Question 167
A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region strategy for the objects that are stored in the S3 bucket. The company needs to be able to fail over to an S3 bucket in another AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes.
The DevOps engineer enables two-way replication between the S3 buckets.
Which combination of steps should the DevOps engineer take next to meet the requirements? (Choose three.)
A. Enable S3 Replication Time Control (S3 RTC) on each replication rule.
B. Create an S3 Multi-Region Access Point in an active-passive configuration.
C. Call the SubmitMultiRegionAccessPointRoutes operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.
D. Enable S3 Transfer Acceleration on both S3 buckets.
E. Configure a routing control in Amazon Route 53 Recovery Controller. Add the S3 buckets in an active-passive configuration.
F. Call the UpdateRoutingControlStates operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.
Show Answer
Correct Answer: A, B, C
Explanation: Enable S3 Replication Time Control (S3 RTC) to meet the 15-minute replication SLA. Use an S3 Multi-Region Access Point configured for active-passive access to provide a single global endpoint across the two buckets. For failover, update the Multi-Region Access Point routing by calling SubmitMultiRegionAccessPointRoutes to direct traffic to the secondary Region. S3 Transfer Acceleration does not control replication or failover, and Route 53 Recovery Controller routing controls are not used to switch S3 Multi-Region Access Point traffic.
Question 168
A company uses the AWS Cloud Development Kit (AWS CDK) to define its application. The company uses a pipeline that consists of AWS CodePipeline and AWS CodeBuild to deploy the CDK application.
The company wants to introduce unit tests to the pipeline to test various infrastructure components. The company wants to ensure that a deployment proceeds if no unit tests result in a failure.
Which combination of steps will enforce the testing requirement in the pipeline? (Choose two.)
A. Update the CodeBuild build phase commands to run the tests then to deploy the application. Set the OnFailure phase property to ABORT.
B. Update the CodeBuild build phase commands to run the tests then to deploy the application. Add the --rollback true flag to the cdk deploy command.
C. Update the CodeBuild build phase commands to run the tests then to deploy the application. Add the --require-approval any-change flag to the cdk deploy command.
D. Create a test that uses the AWS CDK assertions module. Use the template.hasResourceProperties assertion to test that resources have the expected properties.
E. Create a test that uses the cdk diff command. Configure the test to fail if any resources have changed.
Show Answer
Correct Answer: A, D
Explanation: Run the unit tests as part of the CodeBuild build phase before deployment and configure the build to abort on failure so deployment does not occur if tests fail. For infrastructure unit testing in AWS CDK, use the AWS CDK assertions library, such as template.hasResourceProperties, to verify synthesized CloudFormation resources have the expected properties. The rollback and approval flags do not enforce unit-test success, and cdk diff is for detecting changes rather than unit testing.
Question 169
A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are in multiple Availability Zones. The application was misconfigured in a single Availability Zone, which caused a partial outage of the application.
A DevOps engineer made changes to ensure that the unhealthy EC2 instances in one Availability Zone do not affect the healthy EC2 instances in the other Availability Zones. The DevOps engineer needs to test the application's failover and shift where the ALB sends traffic. During failover, the ALB must avoid sending traffic to the Availability Zone where the failure has occurred.
Which solution will meet these requirements?
A. Turn off cross-zone load balancing on the ALB. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.
B. Turn off cross-zone load balancing on the ALB’s target group. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.
C. Create an Amazon Route 53 Application Recovery Controller resource set that uses the DNS hostname of the ALB. Start a zonal shift for the resource set away from the Availability Zone.
D. Create an Amazon Route 53 Application Recovery Controller resource set that uses the ARN of the ALB’s target group. Create a readiness check that uses the ElbV2TargetGroupsCanServeTraffic rule.
Show Answer
Correct Answer: B
Explanation: Application Load Balancers always have cross-zone load balancing enabled at the load balancer level. To support Route 53 Application Recovery Controller zonal shift behavior for an ALB, you must explicitly disable cross-zone load balancing on the ALB's target group(s). Then, initiate a zonal shift with Route 53 ARC so the ALB avoids sending traffic to the impaired Availability Zone. Option A is invalid because you cannot turn off cross-zone load balancing on the ALB itself. Options C and D describe ARC resources/readiness features but do not implement the required zonal traffic shifting behavior.
Question 170
A company sends its AWS Network Firewall flow logs to an Amazon S3 bucket. The company then analyzes the flow logs by using Amazon Athena.
The company needs to transform the flow logs and add additional data before the flow logs are delivered to the existing S3 bucket.
Which solution will meet these requirements?
A. Create an AWS Lambda function to transform the data and to write a new object to the existing S3 bucket. Configure the Lambda function with an S3 trigger for the existing S3 bucket. Specify all object create events for the event type. Acknowledge the recursive invocation.
B. Enable Amazon EventBridge notifications on the existing S3 bucket. Create a custom EventBridge event bus. Create an EventBridge rule that is associated with the custom event bus. Configure the rule to react to all object create events for the existing S3 bucket and to invoke an AWS Step Functions workflow. Configure a Step Functions task to transform the data and to write the data into a new S3 bucket.
C. Create an Amazon EventBridge rule that is associated with the default EventBridge event bus. Configure the rule to react to all object create events for the existing S3 bucket. Define a new S3 bucket as the target for the rule. Create an EventBridge input transformation to customize the event before passing the event to the rule target.
D. Create an Amazon Kinesis Data Firehose delivery stream that is configured with an AWS Lambda transformer. Specify the existing S3 bucket as the destination. Change the Network Firewall logging destination from Amazon S3 to Kinesis Data Firehose.
Show Answer
Correct Answer: D
Explanation: AWS Network Firewall supports logging to Amazon S3 or Kinesis Data Firehose. To transform records before they are stored in the existing S3 bucket, configure logging to a Kinesis Data Firehose delivery stream with an AWS Lambda data transformer and use the existing S3 bucket as the destination. The other options either transform only after the data is already written to S3, misuse EventBridge capabilities, or do not support transforming S3 object contents before delivery.
Question 171
A DevOps engineer needs to implement integration tests into an existing AWS CodePipeline CI/CD workflow for an Amazon Elastic Container Service (Amazon ECS) service. The CI/CD workflow retrieves new application code from an AWS CodeCommit repository and builds a container image. The Cl/CD workflow then uploads the container image to Amazon Elastic Container Registry (Amazon ECR) with a new image tag version.
The integration tests must ensure that new versions of the service endpoint are reachable and that various API methods return successful response data. The DevOps engineer has already created an ECS cluster to test the service.
Which combination of steps will meet these requirements with the LEAST management overhead? (Choose three.)
A. Add a deploy stage to the pipeline. Configure Amazon ECS as the action provider.
B. Add a deploy stage to the pipeline. Configure AWS CodeDeploy as the action provider.
C. Add an appspec.yml file to the CodeCommit repository.
D. Update the image build pipeline stage to output an imagedefinitions.json file that references the new image tag.
E. Create an AWS Lambda function that runs connectivity checks and API calls against the service. Integrate the Lambda function with CodePipeline by using a Lambda action stage.
F. Write a script that runs integration tests against the service. Upload the script to an Amazon S3 bucket. Integrate the script in the S3 bucket with CodePipeline by using an S3 action stage.
Show Answer
Correct Answer: A, D, E
Explanation: Use the native Amazon ECS deploy action in CodePipeline to deploy the updated task definition to the test ECS service with minimal operational overhead. The ECS deploy action requires an imagedefinitions.json artifact that maps the container name to the newly built image tag. After deployment, invoke a Lambda function from a CodePipeline Lambda action to perform endpoint reachability and API integration tests. CodeDeploy and appspec.yml are used for ECS blue/green deployments and are unnecessary here, while an S3 action is not intended to execute test scripts.
Question 172
A company runs applications on Windows and Linux Amazon EC2 instances. The instances run across multiple Availability Zones in an AWS Region. The company uses Auto Scaling groups for each application.
The company needs a durable storage solution for the instances. The solution must use SMB for Windows and must use NFS for Linux. The solution must also have sub-millisecond latencies. All instances will read and write the data.
Which combination of steps will meet these requirements? (Choose three.)
A. Create an Amazon Elastic File System (Amazon EFS) file system that has targets in multiple Availability Zones.
B. Create an Amazon FSx for NetApp ONTAP Multi-AZ file system.
C. Create a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume to use for shared storage.
D. Update the user data for each application’s launch template to mount the file system.
E. Perform an instance refresh on each Auto Scaling group.
F. Update the EC2 instances for each application to mount the file system when new instances are launched.
Show Answer
Correct Answer: B, D, E
Explanation: Amazon FSx for NetApp ONTAP Multi-AZ is the only option that provides a shared, durable file system supporting both SMB (Windows) and NFS (Linux) with high performance and sub-millisecond latency. Updating the launch template user data ensures all newly launched Auto Scaling instances automatically mount the file system. Performing an instance refresh replaces existing instances so they pick up the updated launch template and mount configuration. Amazon EFS does not support SMB, Amazon EBS is not suitable as shared multi-instance file storage, and updating instances directly is unnecessary when the launch template plus instance refresh accomplishes the rollout.
Question 173
A company deploys an application to Amazon EC2 instances. The application runs Amazon Linux 2 and uses AWS CodeDeploy. The application has the following file structure for its code repository:
The appspec.yml file has the following contents in the files section:
What will the result be for the deployment of the config.txt file?
A. The config.txt file will be deployed to only /var/www/html/config/config.txt.
B. The config.txt file will be deployed to /usr/local/src/config.txt and to /var/www/html/config/config.txt.
C. The config.txt file will be deployed to only /usr/local/src/config.txt.
D. The config.txt file will be deployed to /usr/local/src/config.txt and to /var/www/html/application/web/config.txt.
Show Answer
Correct Answer: B
Explanation: In CodeDeploy, each entry in the files section is processed independently. A mapping from source: config/config.txt to destination: /usr/local/src/config.txt copies that specific file to that path. A separate mapping from source: / to destination: /var/www/html copies the entire application bundle, including config/config.txt, preserving its relative path under /var/www/html, resulting in /var/www/html/config/config.txt. Therefore the file is deployed to both locations.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.