A developer is using the AWS Serverless Application Model (AWS SAM) to create a prototype for an AWS Lambda function. The AWS SAM template contains an AWS::Serverless::Function resource that has the CodeUri property that points to an Amazon S3 location. The developer wants to identify the correct commands for deployment before creating a CI/CD pipeline.
The developer creates an archive of the Lambda function code named package.zip. The developer uploads the .zip file archive to the S3 location specified in the CodeUri property. The developer runs the sam deploy command and deploys the Lambda function. The developer updates the Lambda function code and uses the same steps to deploy the new version of the Lambda function. The sam deploy command fails and returns an error of no changes to deploy.
Which solutions will deploy the new version? (Choose two.)
A. Use the aws cloudformation update-stack command instead of the sam deploy command.
B. Use the aws cloudformation update-stack-instances command instead of the sam deploy command.
C. Update the CodeUri property to reference the local application code folder. Use the sam deploy command.
D. Update the CodeUri property to reference the local application code folder. Use the aws cloudformation create-change-set command and the aws cloudformation execute-change-set command.
E. Update the CodeUri property to reference the local application code folder. Use the aws cloudformation package command and the aws cloudformation deploy command.
Show Answer
Correct Answer: C, E
Explanation: The failure occurs because the template’s CodeUri points to a fixed S3 object. Updating the contents of the same S3 key does not change the CloudFormation template, so sam deploy detects no change.
C works because referencing a local code folder lets SAM package the code during sam deploy, upload a new artifact to S3, and update the template with a new S3 object, which CloudFormation recognizes as a change.
E works for the same reason using native CloudFormation commands: aws cloudformation package uploads the local code and rewrites the template with a new S3 URI, and aws cloudformation deploy applies the change.
The other options do not address the root cause or are unrelated to Lambda code deployment.
Question 147
A company wants to use AWS Systems Manager documents to bootstrap physical laptops for developers. The bootstrap code is stored in GitHub. A DevOps engineer has already created a Systems Manager activation, installed the Systems Manager agent with the registration code, and installed an activation ID on all the laptops.
Which set of steps should be taken next?
A. Configure the Systems Manager document to use the AWS-RunShellScript command to copy the files from GitHub to Amazon S3, then use the aws-downloadContent plugin with a sourceType of S3.
B. Configure the Systems Manager document to use the aws-configurePackage plugin with an install action and point to the Git repository.
C. Configure the Systems Manager document to use the aws-downloadContent plugin with a sourceType of GitHub and sourceInfo with the repository details.
D. Configure the Systems Manager document to use the aws:softwareInventory plugin and run the script from the Git repository.
Show Answer
Correct Answer: C
Explanation: After registering the laptops with Systems Manager, the next step is to fetch and run the bootstrap code. The aws:downloadContent plugin is designed to download scripts and files from remote sources, including GitHub. By setting sourceType to GitHub and providing repository details in sourceInfo, the Systems Manager document can directly retrieve the bootstrap code from GitHub and execute it on the managed laptops. Other options either use the wrong plugin or add unnecessary steps.
Question 148
A company's development team uses AWS CloudFormation to deploy its application resources. The team must use CloudFormation for all changes to the environment. The team cannot use the AWS Management Console or the AWS CLI to make manual changes directly.
The team uses a developer IAM role to access the environment. The role is configured with the AdministratorAccess managed IAM policy. The company has created a new CloudFormationDeployment IAM role that has the following policy attached:
The company wants to ensure that only CloudFormation can use the new role. The development team cannot make any manual changes to the deployed resources.
Which combination of steps will meet these requirements? (Choose three.)
A. Remove the AdministratorAccess policy. Assign the ReadOnlyAccess managed IAM policy to the developer role. Instruct the developers to use the CloudFormationDeployment role as a CloudFormation service role when the developers deploy new stacks.
B. Update the trust policy of the CloudFormationDeployment role to allow the developer IAM role to assume the CloudFormationDeployment role.
C. Configure the developer IAM role to be able to get and pass the CloudFormationDeployment role if iam:PassedToService equals . Configure the CloudFormationDeployment role to allow all cloudformation actions for all resources.
D. Update the trust policy of the CloudFormationDeployment role to allow the cloudformation.amazonaws.com AWS principal to perform the iam:AssumeRole action.
E. Remove the AdministratorAccess policy. Assign the ReadOnlyAccess managed IAM policy to the developer role. Instruct the developers to assume the CloudFormationDeployment role when the developers deploy new stacks.
F. Add an IAM policy to the CloudFormationDeployment role to allow cloudformation:* on all resources. Add a policy that allows the iam:PassRole action for the ARN of the CloudFormationDeployment role if iam:PassedToService equals cloudformation.amazonaws.com.
Show Answer
Correct Answer: A, D, F
Explanation: The requirements are to prevent developers from making manual changes and ensure only CloudFormation can use the deployment role.
A is required because removing AdministratorAccess and limiting developers to ReadOnlyAccess prevents direct manual changes, while using a CloudFormation service role enforces infrastructure changes through CloudFormation.
D is required because the CloudFormationDeployment role must trust the CloudFormation service principal (cloudformation.amazonaws.com), ensuring that only CloudFormation can assume the role.
F is required because CloudFormation needs permissions to manage resources and must be able to use the role. Allowing cloudformation:* on resources enables stack operations, and restricting iam:PassRole with iam:PassedToService = cloudformation.amazonaws.com ensures the role can only be passed to CloudFormation, not assumed or misused manually.
Question 149
A company is developing a web application's infrastructure using AWS CloudFormation. The database engineering team maintains the database resources in a CloudFormation template, and the software development team maintains the web application resources in a separate CloudFormation template. As the scope of the application grows, the software development team needs to use resources maintained by the database engineering team. However, both teams have their own review and lifecycle management processes that they want to keep. Both teams also require resource-level change-set reviews. The software development team would like to deploy changes to this template using their CI/CD pipeline.
Which solution will meet these requirements?
A. Create a stack export from the database CloudFormation template and import those references into the web application CloudFormation template.
B. Create a CloudFormation nested stack to make cross-stack resource references and parameters available in both stacks.
C. Create a CloudFormation stack set to make cross-stack resource references and parameters available in both stacks.
D. Create input parameters in the web application CloudFormation template and pass resource names and IDs from the database stack.
Show Answer
Correct Answer: A
Explanation: Using CloudFormation stack exports with Fn::ImportValue allows the database team to expose specific resource attributes while retaining independent stacks, lifecycles, and review processes. The web application stack can consume these values without coupling the stacks into one, still supporting resource-level change sets and automated CI/CD deployments. Nested stacks would tie lifecycles together, stack sets target multi-account/Region use cases, and manually passing parameters is error-prone and undermines automation.
Question 150
A company has an application that stores data that includes personally identifiable information (PII) in an Amazon S3 bucket. All data is encrypted with AWS Key Management Service (AWS KMS) customer managed keys. All AWS resources are deployed from an AWS CloudFormation template.
A DevOps engineer needs to set up a development environment for the application in a different AWS account. The data in the development environment's S3 bucket needs to be updated once a week from the production environment's S3 bucket.
The company must not move PII from the production environment without anonymizing the PII first. The data in each environment must be encrypted with different KMS customer managed keys.
Which combination of steps should the DevOps engineer take to meet these requirements? (Choose two.)
A. Activate Amazon Macie on the S3 bucket in the production account. Create an AWS Step Functions state machine to initiate a discovery job and redact all PII before copying files to the S3 bucket in the development account. Give the state machine tasks decrypt permissions on the KMS key in the production account. Give the state machine tasks encrypt permissions on the KMS key in the development account.
B. Set up S3 replication between the production S3 bucket and the development S3 bucket. Activate Amazon Macie on the development S3 bucket. Create an AWS Step Functions state machine to initiate a discovery job and redact all PII as the files are copied to the development S3 bucket. Give the state machine tasks encrypt and decrypt permissions on the KMS key in the development account.
C. Set up an S3 Batch Operations job to copy files from the production S3 bucket to the development S3 bucket. In the development account, configure an AWS Lambda function to redact ail PII. Configure S3 Object Lambda to use the Lambda function for S3 GET requests. Give the Lambda function's IAM role encrypt and decrypt permissions on the KMS key in the development account.
D. Create a development environment from the CloudFormation template in the development account. Schedule an Amazon EventBridge rule to start the AWS Step Functions state machine once a week.
E. Create a development environment from the CloudFormation template in the development account. Schedule a cron job on an Amazon EC2 instance to run once a week to start the S3 Batch Operations job.
Show Answer
Correct Answer: A, D
Explanation: The solution must anonymize PII before any data leaves the production environment, use different KMS customer managed keys per account, and automate a weekly update.
Option A satisfies the core data-handling requirements: Amazon Macie can discover PII in the production S3 bucket, and AWS Step Functions can orchestrate redaction before copying objects cross-account. Granting decrypt permissions on the production KMS key and encrypt permissions on the development KMS key ensures proper encryption separation.
Option D addresses environment setup and automation: deploying the development environment from CloudFormation maintains consistency, and using Amazon EventBridge to trigger the Step Functions workflow weekly fulfills the scheduled update requirement.
Other options either replicate data before anonymization, redact data only after it reaches development, or add unnecessary operational complexity.
Question 151
A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host its machine learning (ML) application. As the ML model and the container image size grow, the time that new pods take to start up has increased to several minutes.
A DevOps engineer needs to reduce the startup time to seconds. The solution must also reduce the startup time to seconds when the pod runs on nodes that were recently added to the cluster.
The DevOps engineer creates an Amazon EventBridge rule that invokes an automation in AWS Systems Manager. The automation prefetches the container images from an Amazon Elastic Container Registry (Amazon ECR) repository when new images are pushed to the repository. The DevOps engineer also configures tags to be applied to the cluster and the node groups.
What should the DevOps engineer do next to meet the requirements?
A. Create an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's control plane nodes. Create a Systems Manager State Manager association that uses the control plane nodes' tags to prefetch corresponding container images.
B. Create an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's nodes. Create a Systems Manager State Manager association that uses the nodes' machine size to prefetch corresponding container images.
C. Create an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's nodes. Create a Systems Manager State Manager association that uses the nodes' tags to prefetch corresponding container images.
D. Create an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's control plane nodes. Create a Systems Manager State Manager association that uses the nodes' tags to prefetch corresponding container images.
Show Answer
Correct Answer: C
Explanation: To reduce pod startup time, container images must be prefetched onto the worker nodes that actually run pods, not the EKS control plane. AWS Systems Manager can run commands on EC2-based EKS worker nodes to pull images from Amazon ECR ahead of time. Using tags on the nodes (and node groups) allows the State Manager association to dynamically target current and newly added nodes, ensuring images are prefetched even when nodes are recently added. Using machine size is not appropriate for targeting, and the control plane is AWS-managed and cannot be used for running application-level prefetch operations.
Question 152
A company's application has an API that retrieves workload metrics. The company needs to audit, analyze, and visualize these metrics from the application to detect issues at scale.
Which combination of steps will meet these requirements? (Choose three.)
A. Configure an Amazon EventBridge schedule to invoke an AWS Lambda function that calls the API to retrieve workload metrics. Store the workload metric data in an Amazon S3 bucket.
B. Configure an Amazon EventBridge schedule to invoke an AWS Lambda function that calls the API to retrieve workload metrics. Store the workload metric data in an Amazon DynamoDB table that has a DynamoDB stream enabled.
C. Create an AWS Glue crawler to catalog the workload metric data in the Amazon S3 bucket. Create views in Amazon Athena for the cataloged data.
D. Connect an AWS Glue crawler to the Amazon DynamoDB stream to catalog the workload metric data. Create views in Amazon Athena for the cataloged data.
E. Create Amazon QuickSight datasets from the Amazon Athena views. Create a QuickSight analysis to visualize the workload metric data as a dashboard.
F. Create an Amazon CloudWatch dashboard that has custom widgets that invoke AWS Lambda functions. Configure the Lambda functions to query the workload metrics data from the Amazon Athena views.
Show Answer
Correct Answer: A, C, E
Explanation: The requirements are to collect metrics from an API, audit and analyze them at scale, and visualize them. Option A provides a scalable, scheduled ingestion pattern using EventBridge and Lambda, with durable, low-cost storage in Amazon S3 suitable for large volumes of metrics. Option C enables analysis by cataloging the S3 data with AWS Glue and querying it using Amazon Athena, which is well suited for ad hoc analysis and auditing at scale. Option E completes the solution by using Amazon QuickSight to build datasets from Athena views and create dashboards for visualization. The DynamoDB-based options are less appropriate because they are not optimized for large-scale analytical querying and visualization.
Question 153
A DevOps engineer is setting up an Amazon Elastic Container Service (Amazon ECS) blue/green deployment for an application by using AWS CodeDeploy and AWS CloudFormation. During the deployment window, the application must be highly available and CodeDeploy must shift 10% of traffic to a new version of the application every minute until all traffic is shifted.
Which configuration should the DevOps engineer add in the CloudFormation template to meet these requirements?
A. Add an AppSpec file with the CodeDeployDefault.ECSLinearl OPercentEveryl Minutes deployment configuration.
B. Add the AWS::CodeDeployBlueGreen transform and the AWS::CodeDeploy::BlueGreen hook parameter with the CodeDeployDefault.ECSLinear10PercentEvery1Minutes deployment configuration.
C. Add an AppSpec file with the ECSCanary10Percent5Minutes deployment configuration.
D. Add the AWS::CodeDeployBlueGreen transform and the AWS::CodeDepioy::BlueGreen hook parameter with the ECSCanary10Percent5Minutes deployment configuration.
Show Answer
Correct Answer: B
Explanation: The requirement is a linear traffic shift of 10% every minute for an ECS blue/green deployment managed by CodeDeploy and defined in CloudFormation. For ECS blue/green deployments created via CloudFormation, this behavior is configured by using the AWS::CodeDeployBlueGreen transform and the AWS::CodeDeploy::BlueGreen hook, not by supplying an AppSpec file directly. The correct predefined deployment configuration that shifts 10% of traffic every 1 minute is CodeDeployDefault.ECSLinear10PercentEvery1Minutes, which ensures high availability during the deployment.
Question 154
A company uses an organization in AWS Organizations to manage its AWS accounts. The company's DevOps team has developed an AWS Lambda function that calls the Organizations API to create new AWS accounts.
The Lambda function runs in the organization's management account. The DevOps team needs to move the Lambda function from the management account to a dedicated AWS account. The DevOps team must ensure that the Lambda function has the ability to create new AWS accounts only in Organizations before the team deploys the Lambda function to the new account.
Which solution will meet these requirements?
A. In the management account, create a new IAM role that has the necessary permission to create new accounts in Organizations. Allow the role to be assumed by the Lambda execution role in the new AWS account. Update the Lambda function code to assume the role when the Lambda function creates new AWS accounts. Update the Lambda execution role to ensure that it has permission to assume the new role.
B. In the management account, turn on delegated administration for Organizations. Create a new delegation policy that grants the new AWS account permission to create new AWS accounts in Organizations. Ensure that the Lambda execution role has the organizations:CreateAccount permission.
C. In the management account, create a new IAM role that has the necessary permission to create new accounts in Organizations. Allow the role to be assumed by the Lambda service principal. Update the Lambda function code to assume the role when the Lambda function creates new AWS accounts. Update the Lambda execution role to ensure that it has permission to assume the new role.
D. In the management account, enable AWS Control Tower. Turn on delegated administration for AWS Control Tower. Create a resource policy that allows the new AWS account to create new AWS accounts in AWS Control Tower. Update the Lambda function code to use the AWS Control Tower API in the new AWS account. Ensure that the Lambda execution role has the controltower:CreateManagedAccount permission.
Show Answer
Correct Answer: A
Explanation: Only the AWS Organizations management account can create new member accounts. After moving the Lambda function to another AWS account, it must still act with management-account privileges. The correct pattern is to create an IAM role in the management account with organizations:CreateAccount permission and allow the Lambda execution role in the new account to assume it via STS. The Lambda function then assumes this role when creating accounts. Delegated administration does not allow account creation, Lambda cannot directly assume a role via the service principal, and AWS Control Tower is unnecessary and uses different APIs.
Question 155
A company uses containers for its applications. The company learns that some container images are missing required security configurations.
A DevOps engineer needs to implement a solution to create a standard base image. The solution must publish the base image weekly to the us-west-2 Region, us-east-2 Region, and eu-central-1 Region.
Which solution will meet these requirements?
A. Create an EC2 Image Builder pipeline that uses a container recipe to build the image. Configure the pipeline to distribute the image to an Amazon Elastic Container Registry (Amazon ECR) repository in us-west-2. Configure ECR replication from us-west-2 to us-east-2 and from us-east-2 to eu-central-1. Configure the pipeline to run weekly.
B. Create an AWS CodePipeline pipeline that uses an AWS CodeBuild project to build the image. Use AWS CodeDeploy to publish the image to an Amazon Elastic Container Registry (Amazon ECR) repository in us-west-2. Configure ECR replication from us-west-2 to us-east-2 and from us-east-2 to eu-central-1. Configure the pipeline to run weekly.
C. Create an EC2 Image Builder pipeline that uses a container recipe to build the image. Configure the pipeline to distribute the image to Amazon Elastic Container Registry (Amazon ECR) repositories in all three Regions. Configure the pipeline to run weekly.
D. Create an AWS CodePipeline pipeline that uses an AWS CodeBuild project to build the image. Use AWS CodeDeploy to publish the image to Amazon Elastic Container Registry (Amazon ECR) repositories in all three Regions. Configure the pipeline to run weekly.
Show Answer
Correct Answer: C
Explanation: EC2 Image Builder natively supports building container images from container recipes and distributing them directly to Amazon ECR repositories in multiple Regions on a schedule. This meets all requirements: creating a standardized, secured base image; publishing weekly; and distributing to us-west-2, us-east-2, and eu-central-1 without added complexity. Using ECR replication (options A and B) is unnecessary and can be limiting, and CodePipeline/CodeDeploy (options B and D) are less specialized for container image creation and multi-Region distribution than EC2 Image Builder.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.