A company has set up AWS CodeArtifact repositories with public upstream repositories. The company's development team consumes open source dependencies from the repositories in the company's internal network.
The company's security team recently discovered a critical vulnerability in the most recent version of a package that the development team consumes. The security team has produced a patched version to fix the vulnerability. The company needs to prevent the vulnerable version from being downloaded. The company also needs to allow the security team to publish the patched version.
Which combination of steps will meet these requirements? (Choose two.)
A. Update the status of the affected CodeArtifact package version to unlisted.
B. Update the status of the affected CodeArtifact package version to deleted.
C. Update the status of the affected CodeArtifact package version to archived.
D. Update the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations.
E. Update the CodeArtifact package origin control settings to block direct publishing and to allow upstream operations.
Show Answer
Correct Answer: C, D
Explanation: CodeArtifact package version statuses include Published, Unlisted, Archived, and Disposed; 'deleted' is an operation, not a package version status. Setting a version to Archived prevents it from being installed/downloaded, whereas Unlisted only hides it from version listings. To allow the internal security team to publish a patched version while preventing the vulnerable version from being re-fetched from a public upstream, configure package origin controls to allow direct publishing and block upstream operations.
Question 175
A company is migrating its on-premises Windows applications and Linux applications to AWS. The company will use automation to launch Amazon EC2 instances to mirror the on-premises configurations. The migrated applications require access to shared storage that uses SMB for Windows and NFS for Linux.
The company is also creating a pilot light disaster recovery (DR) environment in another AWS Region. The company will use automation to launch and configure the EC2 instances in the DR Region. The company needs to replicate the storage to the DR Region.
Which storage solution will meet these requirements?
A. Use Amazon S3 for the application storage. Create an S3 bucket in the primary Region and an S3 bucket in the DR Region. Configure S3 Cross-Region Replication (CRR) from the primary Region to the DR Region.
B. Use Amazon Elastic Block Store (Amazon EBS) for the application storage. Create a backup plan in AWS Backup that creates snapshots of the EBS volumes that are in the primary Region and replicates the snapshots to the DR Region.
C. Use a Volume Gateway in AWS Storage Gateway for the application storage. Configure Cross-Region Replication (CRR) of the Volume Gateway from the primary Region to the DR Region.
D. Use Amazon FSx for NetApp ONTAP for the application storage. Create an FSx for ONTAP instance in the DR Region. Configure NetApp SnapMirror replication from the primary Region to the DR Region.
Show Answer
Correct Answer: D
Explanation: Amazon FSx for NetApp ONTAP supports multiprotocol file access, including SMB for Windows and NFS for Linux, satisfying the shared storage requirement with a single file system. It also supports cross-Region disaster recovery by replicating data between FSx for ONTAP file systems using NetApp SnapMirror, which fits a pilot light DR architecture where compute is launched on demand. S3 does not provide SMB/NFS file shares for these applications, EBS is block storage rather than shared SMB/NFS storage, and Storage Gateway Volume Gateway does not provide the required SMB/NFS shared file storage with the described cross-Region replication capability.
Question 176
A company's application uses a fleet of Amazon EC2 On-Demand Instances to analyze and process data. The EC2 instances are in an Auto Scaling group. The Auto Scaling group is a target group for an Application Load Balancer (ALB). The application analyzes critical data that cannot tolerate interruption. The application also analyzes noncritical data that can withstand interruption.
The critical data analysis requires quick scalability in response to real-time application demand. The noncritical data analysis involves memory consumption. A DevOps engineer must implement a solution that reduces scale-out latency for the critical data. The solution also must process the noncritical data.
Which combination of steps will meet these requirements? (Choose two.)
A. For the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use Spot Instances.
B. For the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use On-Demand Instances.
C. For the critical data, modify the existing Auto Scaling group. Create a lifecycle hook to ensure that bootstrap scripts are completed successfully. Ensure that the application on the instances is ready to accept traffic before the instances are registered. Create a new version of the launch template that has detailed monitoring enabled.
D. For the noncritical data, create a second Auto Scaling group that uses a launch template. Configure the launch template to install the unified Amazon CloudWatch agent and to configure the CloudWatch agent with a custom memory utilization metric. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.
E. For the noncritical data, create a second Auto Scaling group. Choose the predefined memory utilization metric type for the target tracking scaling policy. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.
Show Answer
Correct Answer: B, D
Explanation: For critical workloads that cannot tolerate interruption and need reduced scale-out latency, use an Auto Scaling warm pool with On-Demand Instances. Warm pools keep pre-initialized instances ready, reducing launch time. Spot Instances are inappropriate for critical processing due to interruption risk. For noncritical workloads, a separate Auto Scaling group using Spot Instances is appropriate. Because EC2 Auto Scaling does not provide a predefined memory utilization metric for target tracking, install the CloudWatch agent and publish a custom memory utilization metric, then scale on that metric. Lifecycle hooks improve initialization correctness but do not reduce scale-out latency as directly as warm pools.
Question 177
A company recently migrated its application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that uses Amazon EC2 instances. The company configured the application to automatically scale based on CPU utilization.
The application produces memory errors when it experiences heavy loads. The application also does not scale out enough to handle the increased load. The company needs to collect and analyze memory metrics for the application over time.
Which combination of steps will meet these requirements? (Choose three.)
A. Attach the CloudWatchAgentServerPolicy managed IAM policy to the IAM instance profile that the cluster uses.
B. Attach the CloudWatchAgentServerPolicy managed IAM policy to a service account role for the cluster.
C. Collect performance metrics by deploying the unified Amazon CloudWatch agent to the existing EC2 instances in the cluster. Add the agent to the AMI for any new EC2 instances that are added to the cluster.
D. Collect performance logs by deploying the AWS Distro for OpenTelemetry collector as a DaemonSet.
E. Analyze the pod_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the Service dimension.
F. Analyze the node_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the ClusterName dimension.
Show Answer
Correct Answer: A, C, E
Explanation: For EC2-based Amazon EKS, the CloudWatch agent runs on the worker nodes and needs IAM permissions to publish metrics, so attaching CloudWatchAgentServerPolicy to the EC2 instance profile is appropriate. Deploying the unified CloudWatch agent collects memory and other performance metrics from the nodes and enables Container Insights metrics over time. To diagnose application memory issues and improve autoscaling based on memory visibility, analyze the pod_memory_utilization metric in the ContainerInsights namespace at the Service dimension, which provides pod/application-level memory usage rather than only node-level utilization.
Question 178
A company's video streaming platform usage has increased from 10,000 users each day to 50,000 users each day in multiple countries. The company deploys the streaming platform on Amazon Elastic Kubernetes Service (Amazon EKS). The EKS workload scales up to thousands of nodes during peak viewing time.
The company's users report occurrences of unauthorized logins. Users also report sudden interruptions and logouts from the platform.
The company wants additional security measures for the entire platform. The company also needs a summarized view of the resource behaviors and interactions across the company's entire AWS environment. The summarized view must show login attempts, API calls, and network traffic. The solution must permit network traffic analysis while minimizing the overhead of managing logs. The solution must also quickly investigate any potential malicious behavior that is associated with the EKS workload.
Which solution will meet these requirements?
A. Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
B. Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon Detective in the company's AWS account. Enable EKS audit logs from optional source packages in Detective.
C. Enable Amazon CloudWatch Container Insights. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
D. Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon CloudWatch Container Insights and VPC Flow Logs. Enable AWS CloudTrail logs.
Show Answer
Correct Answer: B
Explanation: Amazon GuardDuty for EKS Audit Log Monitoring detects suspicious activity affecting EKS workloads. Amazon Detective provides a summarized behavior graph across the AWS environment, correlating login attempts, API activity, network flow data, and GuardDuty findings to accelerate investigations. Detective also supports EKS audit logs as a data source, meeting the requirement for rapid investigation with minimal log-management overhead.
Question 179
A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM).
The IAM team wants to implement AWS IAM Identity Center (AWS Single Sign-On). The IAM team must have only the minimum needed permissions to manage IAM Identity Center. The IAM team must not be able to gain unneeded access to the Organizations management account. The IAM team must be able to provision new IAM Identity Center permission sets and assignments for existing and new member accounts.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account for the IAM team. In the new account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
B. Create a new AWS account for the IAM team. In the Organizations management account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
C. In IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSODirectoryAdministrator managed IAM policy to the group.
D. In IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group.
E. Assign the permission set to the Organizations management account. Allow the IAM team group to use the permission set.
F. Assign the permission set to the new AWS account. Allow the IAM team group to use the permission set.
Show Answer
Correct Answer: B, D, F
Explanation: IAM Identity Center must be enabled in the Organizations management account before delegated administration can be configured. A separate member account should be registered as the delegated administrator so the IAM team can manage IAM Identity Center without unnecessary access to the management account. The AWSSSOMemberAccountAdministrator managed policy provides the needed capabilities to manage permission sets and account assignments with less privilege than the directory administrator policy for this use case. The permission set should be assigned in the delegated administrator account, not the management account.
Question 180
A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux.
The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present.
Which solution will meet these requirements?
A. Create an association in Systems Manager State Manager. Target all the managed nodes. Include the software in the association. Configure the association to use the Systems Manager document.
B. Set up AWS Config to record all the resources in the account. Create an AWS Config custom rule to determine if the software is installed on all the EC2 instances. Configure an automatic remediation action that uses the Systems Manager document for noncompliant EC2 instances.
C. Activate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances. Associate the findings with the Systems Manager document.
D. Create an Amazon EventBridge rule that uses AWS CloudTrail to detect the Runinstances API call. Configure inventory collection in Systems Manager Inventory to determine if the software is installed on the EC2 instances. Associate the Systems Manager inventory with the Systems Manager document.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager State Manager is designed to maintain a desired state across managed nodes. By creating a State Manager association that targets all managed nodes and runs an SSM document, Systems Manager will detect newly managed EC2 instances, check the desired state on its schedule, and install the antivirus software only if it is missing. AWS Config cannot natively determine installed software without custom logic, Inspector is not used to enforce software installation, and EventBridge plus Inventory does not provide a direct association mechanism to execute an SSM document based on missing software.
Question 181
A company's DevOps team manages a set of AWS accounts that are in an organization in AWS Organizations.
The company needs a solution that ensures that all Amazon EC2 instances use approved AM Is that the DevOps team manages. The solution also must remediate the usage of AMIs that are not approved. The individual account administrators must not be able to remove the restriction to use approved AMIs.
Which solution will meet these requirements?
A. Use AWS CloudFormation StackSets to deploy an Amazon EventBridge rule to each account. Configure the rule to react to AWS CloudTrail events for Amazon EC2 and to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic.
B. Use AWS CloudFormation StackSets to deploy the approved-amis-by-id AWS Config managed rule to each account. Configure the rule with the list of approved AMIs. Configure the rule to run the AWS-StopEC2Instance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.
C. Create an AWS Lambda function that processes AWS CloudTrail events for Amazon EC2. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic. Deploy the Lambda function in each account in the organization. Create an Amazon EventBridge rule in each account. Configure the EventBridge rules to react to AWS CloudTrail events for Amazon EC2 and to invoke the Lambda function.
D. Enable AWS Config across the organization. Create a conformance pack that uses the approved-amis-by-id AWS Config managed rule with the list of approved AMIs. Deploy the conformance pack across the organization. Configure the rule to run the AWS-StopEC2lnstance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.
Show Answer
Correct Answer: D
Explanation: AWS Config organization-wide with a conformance pack centrally enforces the approved-amis-by-id managed rule across AWS Organizations. The rule can automatically remediate noncompliant EC2 instances by invoking the AWS-StopEC2Instance Systems Manager Automation runbook. Deploying as an organization conformance pack prevents individual member account administrators from simply removing the control, unlike StackSets deployed into individual accounts. Notifications alone do not satisfy remediation.
Question 182
A company gives its employees limited rights to AWS. DevOps engineers have the ability to assume an administrator role. For tracking purposes, the security team wants to receive a near-real-time notification when the administrator role is assumed.
How should this be accomplished?
A. Configure AWS Config to publish logs to an Amazon S3 bucket. Use Amazon Athena to query the logs and send a notification to the security team when the administrator role is assumed.
B. Configure Amazon GuardDuty to monitor when the administrator role is assumed and send a notification to the security team.
C. Create an Amazon EventBridge event rule using an AWS Management Console sign-in events event pattern that publishes a message to an Amazon SNS topic if the administrator role is assumed.
D. Create an Amazon EventBridge events rule using an AWS API call that uses an AWS CloudTrail event pattern to invoke an AWS Lambda function that publishes a message to an Amazon SNS topic if the administrator role is assumed.
Show Answer
Correct Answer: D
Explanation: Assuming an IAM role generates an AWS STS AssumeRole API call that is recorded by AWS CloudTrail. An Amazon EventBridge rule can match the CloudTrail AssumeRole event and trigger a workflow in near real time. Invoking a Lambda function that publishes to an SNS topic satisfies the notification requirement. AWS Config is not intended for near-real-time API activity monitoring, GuardDuty is for threat detection rather than general role-assumption alerts, and console sign-in events do not capture AssumeRole API calls made via the console, CLI, or SDK.
Question 183
A company needs a strategy for failover and disaster recovery of its data and application. The application uses a MySQL database and Amazon EC2 instances. The company requires a maximum RPO of 2 hours and a maximum RTO of 10 minutes for its data and application at all times.
Which combination of deployment strategies will meet these requirements? (Choose two.)
A. Create an Amazon Aurora Single-AZ cluster in multiple AWS Regions as the data store. Use Aurora's automatic recovery capabilities in the event of a disaster.
B. Create an Amazon Aurora global database in two AWS Regions as the data store. In the event of a failure, promote the secondary Region to the primary for the application. Update the application to use the Aurora cluster endpoint in the secondary Region.
C. Create an Amazon Aurora cluster in multiple AWS Regions as the data store. Use a Network Load Balancer to balance the database traffic in different Regions.
D. Set up the application in two AWS Regions. Use Amazon Route 53 failover routing that points to Application Load Balancers in both Regions. Use health checks and Auto Scaling groups in each Region.
E. Set up the application in two AWS Regions. Configure AWS Global Accelerator to point to Application Load Balancers (ALBs) in both Regions. Add both ALBs to a single endpoint group. Use health checks and Auto Scaling groups in each Region.
Show Answer
Correct Answer: B, D
Explanation: Aurora Global Database provides cross-Region replication with very low replication lag and fast cross-Region promotion, satisfying the data RPO/RTO requirements. Deploying the application stack in two Regions behind Route 53 failover routing with health checks, ALBs, and Auto Scaling provides regional application failover within the required RTO. The other options are invalid or less appropriate: Aurora Single-AZ is not a cross-Region DR solution, 'Aurora cluster in multiple Regions' with an NLB is not a valid architecture, and Global Accelerator is not required to meet the stated 10-minute RTO.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.