A company has set up AWS CodeArtifact repositories with public upstream repositories. The company's development team consumes open source dependencies from the repositories in the company's internal network.
The company's security team recently discovered a critical vulnerability in the most recent version of a package that the development team consumes. The security team has produced a patched version to fix the vulnerability. The company needs to prevent the vulnerable version from being downloaded. The company also needs to allow the security team to publish the patched version.
Which combination of steps will meet these requirements? (Choose two.)
A. Update the status of the affected CodeArtifact package version to unlisted.
B. Update the status of the affected CodeArtifact package version to deleted.
C. Update the status of the affected CodeArtifact package version to archived.
D. Update the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations.
E. Update the CodeArtifact package origin control settings to block direct publishing and to allow upstream operations.
Show Answer
Correct Answer: C, D
Explanation: The vulnerable package version must be prevented from being downloaded while still allowing internal control. Setting the package version status to **Archived** blocks downloads of that specific version, whereas Unlisted does not block downloads and Deleted is not a valid package version status. To allow the security team to publish a patched version and prevent pulling vulnerable versions from public repositories, the package origin control settings should allow direct publishing and block upstream operations.
Question 137
A company is migrating its on-premises Windows applications and Linux applications to AWS. The company will use automation to launch Amazon EC2 instances to mirror the on-premises configurations. The migrated applications require access to shared storage that uses SMB for Windows and NFS for Linux.
The company is also creating a pilot light disaster recovery (DR) environment in another AWS Region. The company will use automation to launch and configure the EC2 instances in the DR Region. The company needs to replicate the storage to the DR Region.
Which storage solution will meet these requirements?
A. Use Amazon S3 for the application storage. Create an S3 bucket in the primary Region and an S3 bucket in the DR Region. Configure S3 Cross-Region Replication (CRR) from the primary Region to the DR Region.
B. Use Amazon Elastic Block Store (Amazon EBS) for the application storage. Create a backup plan in AWS Backup that creates snapshots of the EBS volumes that are in the primary Region and replicates the snapshots to the DR Region.
C. Use a Volume Gateway in AWS Storage Gateway for the application storage. Configure Cross-Region Replication (CRR) of the Volume Gateway from the primary Region to the DR Region.
D. Use Amazon FSx for NetApp ONTAP for the application storage. Create an FSx for ONTAP instance in the DR Region. Configure NetApp SnapMirror replication from the primary Region to the DR Region.
Show Answer
Correct Answer: D
Explanation: The applications require shared file storage with SMB for Windows and NFS for Linux, plus automated cross-Region replication for a pilot light DR environment. Amazon FSx for NetApp ONTAP natively supports multi-protocol access (SMB and NFS) from the same file system and provides built-in, efficient cross-Region replication using NetApp SnapMirror. The other options do not meet the protocol requirements (S3, EBS) or do not provide appropriate multi-protocol file storage with cross-Region replication (Storage Gateway Volume Gateway).
Question 138
A company's application uses a fleet of Amazon EC2 On-Demand Instances to analyze and process data. The EC2 instances are in an Auto Scaling group. The Auto Scaling group is a target group for an Application Load Balancer (ALB). The application analyzes critical data that cannot tolerate interruption. The application also analyzes noncritical data that can withstand interruption.
The critical data analysis requires quick scalability in response to real-time application demand. The noncritical data analysis involves memory consumption. A DevOps engineer must implement a solution that reduces scale-out latency for the critical data. The solution also must process the noncritical data.
Which combination of steps will meet these requirements? (Choose two.)
A. For the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use Spot Instances.
B. For the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use On-Demand Instances.
C. For the critical data, modify the existing Auto Scaling group. Create a lifecycle hook to ensure that bootstrap scripts are completed successfully. Ensure that the application on the instances is ready to accept traffic before the instances are registered. Create a new version of the launch template that has detailed monitoring enabled.
D. For the noncritical data, create a second Auto Scaling group that uses a launch template. Configure the launch template to install the unified Amazon CloudWatch agent and to configure the CloudWatch agent with a custom memory utilization metric. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.
E. For the noncritical data, create a second Auto Scaling group. Choose the predefined memory utilization metric type for the target tracking scaling policy. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.
Show Answer
Correct Answer: B, D
Explanation: Critical data cannot tolerate interruption and requires fast scale-out. Using an Auto Scaling warm pool with On-Demand Instances keeps pre-initialized capacity available, significantly reducing scale-out latency without interruption risk, which makes option B correct. For noncritical data, interruptions are acceptable and the workload is memory-intensive, so using a separate Auto Scaling group with Spot Instances and scaling based on a custom memory utilization metric collected by the CloudWatch agent is appropriate. This is exactly what option D provides. Option E is incorrect because EC2 Auto Scaling does not offer a predefined memory utilization metric.
Question 139
A company recently migrated its application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that uses Amazon EC2 instances. The company configured the application to automatically scale based on CPU utilization.
The application produces memory errors when it experiences heavy loads. The application also does not scale out enough to handle the increased load. The company needs to collect and analyze memory metrics for the application over time.
Which combination of steps will meet these requirements? (Choose three.)
A. Attach the CloudWatchAgentServerPolicy managed IAM policy to the IAM instance profile that the cluster uses.
B. Attach the CloudWatchAgentServerPolicy managed IAM policy to a service account role for the cluster.
C. Collect performance metrics by deploying the unified Amazon CloudWatch agent to the existing EC2 instances in the cluster. Add the agent to the AMI for any new EC2 instances that are added to the cluster.
D. Collect performance logs by deploying the AWS Distro for OpenTelemetry collector as a DaemonSet.
E. Analyze the pod_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the Service dimension.
F. Analyze the node_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the ClusterName dimension.
Show Answer
Correct Answer: A, C, E
Explanation: The application runs on an EKS cluster backed by EC2 instances and needs memory metrics over time to understand scaling and memory errors.
• The CloudWatch agent runs on EC2 instances, so it requires permissions at the instance level to publish metrics. Attaching the CloudWatchAgentServerPolicy to the IAM instance profile satisfies this requirement (A). Using a service account role is not necessary when the agent is installed on the nodes themselves.
• Memory utilization is not available by default in CloudWatch for EC2. Deploying the unified Amazon CloudWatch agent on the existing and future worker nodes enables collection of memory metrics (C).
• To diagnose application-level memory pressure and scaling behavior, pod-level memory metrics are required. The pod_memory_utilization metric in the ContainerInsights namespace, analyzed using the Service dimension, provides the needed granularity (E).
Node-level metrics alone are insufficient, and OpenTelemetry is not required for system memory collection in this scenario.
Question 140
A company's video streaming platform usage has increased from 10,000 users each day to 50,000 users each day in multiple countries. The company deploys the streaming platform on Amazon Elastic Kubernetes Service (Amazon EKS). The EKS workload scales up to thousands of nodes during peak viewing time.
The company's users report occurrences of unauthorized logins. Users also report sudden interruptions and logouts from the platform.
The company wants additional security measures for the entire platform. The company also needs a summarized view of the resource behaviors and interactions across the company's entire AWS environment. The summarized view must show login attempts, API calls, and network traffic. The solution must permit network traffic analysis while minimizing the overhead of managing logs. The solution must also quickly investigate any potential malicious behavior that is associated with the EKS workload.
Which solution will meet these requirements?
A. Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
B. Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon Detective in the company's AWS account. Enable EKS audit logs from optional source packages in Detective.
C. Enable Amazon CloudWatch Container Insights. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
D. Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon CloudWatch Container Insights and VPC Flow Logs. Enable AWS CloudTrail logs.
Show Answer
Correct Answer: B
Explanation: Amazon GuardDuty for EKS Audit Log Monitoring detects suspicious activity related to unauthorized access and anomalous behavior in EKS workloads. Amazon Detective provides a centralized, summarized behavior graph across the AWS environment, correlating GuardDuty findings with login attempts, API calls, and network traffic, and enables rapid investigation with minimal log-management overhead. Enabling EKS audit logs as a Detective data source completes visibility into Kubernetes activity.
Question 141
A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM).
The IAM team wants to implement AWS IAM Identity Center (AWS Single Sign-On). The IAM team must have only the minimum needed permissions to manage IAM Identity Center. The IAM team must not be able to gain unneeded access to the Organizations management account. The IAM team must be able to provision new IAM Identity Center permission sets and assignments for existing and new member accounts.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a new AWS account for the IAM team. In the new account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
B. Create a new AWS account for the IAM team. In the Organizations management account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
C. In IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSODirectoryAdministrator managed IAM policy to the group.
D. In IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group.
E. Assign the permission set to the Organizations management account. Allow the IAM team group to use the permission set.
F. Assign the permission set to the new AWS account. Allow the IAM team group to use the permission set.
Show Answer
Correct Answer: B, D, F
Explanation: IAM Identity Center must be enabled in the Organizations management account and then delegated to a separate member account to avoid granting the IAM team access to the management account (B). The IAM team needs permissions to create and manage permission sets and assignments with least privilege; the AWSSSOMemberAccountAdministrator policy provides this, whereas DirectoryAdministrator is broader and not required (D). Assigning the permission set to the delegated IAM team account—not the management account—lets the team administer Identity Center without gaining unneeded management account access (F).
Question 142
A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux.
The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present.
Which solution will meet these requirements?
A. Create an association in Systems Manager State Manager. Target all the managed nodes. Include the software in the association. Configure the association to use the Systems Manager document.
B. Set up AWS Config to record all the resources in the account. Create an AWS Config custom rule to determine if the software is installed on all the EC2 instances. Configure an automatic remediation action that uses the Systems Manager document for noncompliant EC2 instances.
C. Activate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances. Associate the findings with the Systems Manager document.
D. Create an Amazon EventBridge rule that uses AWS CloudTrail to detect the Runinstances API call. Configure inventory collection in Systems Manager Inventory to determine if the software is installed on the EC2 instances. Associate the Systems Manager inventory with the Systems Manager document.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager State Manager is designed to enforce a desired configuration state across EC2 instances. By creating a State Manager association that targets all managed nodes and uses an SSM document to install antivirus software, Systems Manager will automatically detect instances where the software is missing and install it. This continuously enforces compliance and directly satisfies the requirement to detect all instances and use a Systems Manager document for installation. Other options focus on compliance reporting, security scanning, or event-based detection and are not intended to enforce software installation across all instances.
Question 143
A company's DevOps team manages a set of AWS accounts that are in an organization in AWS Organizations.
The company needs a solution that ensures that all Amazon EC2 instances use approved AM Is that the DevOps team manages. The solution also must remediate the usage of AMIs that are not approved. The individual account administrators must not be able to remove the restriction to use approved AMIs.
Which solution will meet these requirements?
A. Use AWS CloudFormation StackSets to deploy an Amazon EventBridge rule to each account. Configure the rule to react to AWS CloudTrail events for Amazon EC2 and to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic.
B. Use AWS CloudFormation StackSets to deploy the approved-amis-by-id AWS Config managed rule to each account. Configure the rule with the list of approved AMIs. Configure the rule to run the AWS-StopEC2Instance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.
C. Create an AWS Lambda function that processes AWS CloudTrail events for Amazon EC2. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic. Deploy the Lambda function in each account in the organization. Create an Amazon EventBridge rule in each account. Configure the EventBridge rules to react to AWS CloudTrail events for Amazon EC2 and to invoke the Lambda function.
D. Enable AWS Config across the organization. Create a conformance pack that uses the approved-amis-by-id AWS Config managed rule with the list of approved AMIs. Deploy the conformance pack across the organization. Configure the rule to run the AWS-StopEC2lnstance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.
Show Answer
Correct Answer: D
Explanation: The requirement is to enforce use of approved AMIs across all accounts, automatically remediate noncompliant instances, and prevent individual account administrators from removing the restriction. Organization-wide AWS Config with a conformance pack meets this need: the approved-amis-by-id managed rule detects noncompliant EC2 instances, and automatic remediation can stop instances via the AWS-StopEC2Instance SSM Automation runbook. Deploying the conformance pack at the organization level ensures centralized control that account administrators cannot bypass. Options A and C only provide notification without remediation, and option B uses StackSets, which account administrators could modify or remove.
Question 144
A company gives its employees limited rights to AWS. DevOps engineers have the ability to assume an administrator role. For tracking purposes, the security team wants to receive a near-real-time notification when the administrator role is assumed.
How should this be accomplished?
A. Configure AWS Config to publish logs to an Amazon S3 bucket. Use Amazon Athena to query the logs and send a notification to the security team when the administrator role is assumed.
B. Configure Amazon GuardDuty to monitor when the administrator role is assumed and send a notification to the security team.
C. Create an Amazon EventBridge event rule using an AWS Management Console sign-in events event pattern that publishes a message to an Amazon SNS topic if the administrator role is assumed.
D. Create an Amazon EventBridge events rule using an AWS API call that uses an AWS CloudTrail event pattern to invoke an AWS Lambda function that publishes a message to an Amazon SNS topic if the administrator role is assumed.
Show Answer
Correct Answer: D
Explanation: Assuming an IAM role generates an AWS STS AssumeRole API call that is recorded by AWS CloudTrail. Creating an Amazon EventBridge rule that matches the relevant CloudTrail event pattern enables near-real-time detection. The rule can trigger a Lambda function (or directly an SNS topic) to notify the security team. Other options are not near-real-time or do not monitor role assumption events.
Question 145
A company needs a strategy for failover and disaster recovery of its data and application. The application uses a MySQL database and Amazon EC2 instances. The company requires a maximum RPO of 2 hours and a maximum RTO of 10 minutes for its data and application at all times.
Which combination of deployment strategies will meet these requirements? (Choose two.)
A. Create an Amazon Aurora Single-AZ cluster in multiple AWS Regions as the data store. Use Aurora's automatic recovery capabilities in the event of a disaster.
B. Create an Amazon Aurora global database in two AWS Regions as the data store. In the event of a failure, promote the secondary Region to the primary for the application. Update the application to use the Aurora cluster endpoint in the secondary Region.
C. Create an Amazon Aurora cluster in multiple AWS Regions as the data store. Use a Network Load Balancer to balance the database traffic in different Regions.
D. Set up the application in two AWS Regions. Use Amazon Route 53 failover routing that points to Application Load Balancers in both Regions. Use health checks and Auto Scaling groups in each Region.
E. Set up the application in two AWS Regions. Configure AWS Global Accelerator to point to Application Load Balancers (ALBs) in both Regions. Add both ALBs to a single endpoint group. Use health checks and Auto Scaling groups in each Region.
Show Answer
Correct Answer: B, D
Explanation: The requirements call for multi-Region disaster recovery with a maximum RPO of 2 hours and a maximum RTO of 10 minutes for both data and application.
For the database layer, Amazon Aurora Global Database (B) is designed specifically for cross-Region disaster recovery. It provides near-real-time replication from the primary Region to secondary Regions with typical RPO well under the 2-hour requirement, and Region-level failover with promotion times usually measured in minutes, satisfying the 10-minute RTO.
For the application layer, deploying the application in two Regions with Route 53 failover routing (D) ensures traffic is automatically redirected to the healthy Region using health checks. Combined with ALBs and Auto Scaling groups in each Region, this approach supports fast application recovery well within the required RTO.
Other options either misuse Aurora (A, C) or provide optimization rather than necessity (E), since Route 53 failover already meets the stated RTO requirement.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.