A company has an application that uses an Amazon API Gateway REST API, AWS Lambda functions, and an Amazon DynamoDB table. The application currently runs in a single AWS Region. The company wants to make the application highly available across two Regions. User traffic must be routed to the Region that provides the least latency.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a replica of the DynamoDB table in a second Region.
B. Create a global secondary index for the DynamoDB table.
C. Create copies of the REST API and the Lambda functions in a second Region.
D. Create health checks in Amazon Route 53. Create DNS records that include a failover routing policy.
E. Create health checks in Amazon Route 53. Create DNS records that include a latency routing policy.
F. Create DNS records in Amazon Route 53 that include a multivalue answer routing policy.
Show Answer
Correct Answer: A, C, E
Explanation: To achieve multi-Region high availability with lowest-latency routing, the application must be deployed active–active across Regions. DynamoDB needs a replica in the second Region (via DynamoDB global tables) so each Region can read and write data locally. API Gateway and Lambda functions must also be deployed in the second Region to serve requests there. Amazon Route 53 latency-based routing with health checks routes users to the Region with the lowest latency and avoids unhealthy endpoints. Other options (GSI, failover routing, multivalue routing) do not meet the lowest-latency active–active requirement.
Question 6
A company uses Amazon Elastic Kubernetes Services (Amazon EKS) to host containerized applications that are available in Amazon Elastic Container Registry (Amazon ECR).
The company currently launches EKS clusters in the company's development environment by using the AWS CLI aws eks create-cluster command. The company uses the aws eks create-addon command to install required add-ons. All installed add-ons are currently version compatible with the version of Kubernetes that the company uses. All clusters exclusively use managed node groups for compute capacity.
Some of the EKS clusters require a version upgrade. A DevOps engineer must ensure that upgrades continuously occur within the AWS standard support schedule.
Which solution will meet this requirement with the LEAST operational overhead?
A. Run the aws eks update-cluster-version command. Providing appropriate arguments such as cluster name and version number.
B. Enable EKS Auto Mode on all EKS clusters. Remove all existing managed node groups.
C. Run the eksctl command to upgrade the EKS clusters. Provide appropriate arguments such as cluster name and version number
D. Refactor the environment to create EKS clusters by using infrastructure as code (IaC). Upgrade the clusters by using code changes.
Show Answer
Correct Answer: B
Explanation: EKS Auto Mode automatically manages Kubernetes version upgrades for the control plane and worker nodes so that clusters remain within the AWS standard support window. Enabling Auto Mode removes the need for manually running upgrade commands or managing node groups, resulting in the least operational overhead compared to CLI-based upgrades, eksctl usage, or refactoring to IaC.
Question 7
A company wants to build a pipeline to update the standard AMI monthly. The AMI must be updated to use the most recent patches to ensure that launched Amazon EC2 instances are up to date. Each new AMI must be available to all AWS accounts in the company's organization in AWS Organizations.
The company needs to configure an automated pipeline to build the AMI.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an AWS CodePipeline pipeline that uses AWS CodeBuild. Create an AWS Lambda function to run the pipeline every month. Create an AWS CloudFormation template. Share the template with all AWS accounts in the organization.
B. Create an AMI pipeline by using EC2 Image Builder. Configure the pipeline to distribute the AMI to the AWS accounts in the organization. Configure the pipeline to run monthly.
C. Create an AWS CodePipeline pipeline that runs an AWS Lambda function to build the AMI. Configure the pipeline to share the AMI with the AWS accounts in the organization. Configure Amazon EventBridge Scheduler to invoke the pipeline every month.
D. Create an AWS Systems Manager Automation runbook. Configure the automation to run in all AWS accounts in the organization. Create an AWS Lambda function to run the automation every month.
Show Answer
Correct Answer: B
Explanation: EC2 Image Builder is a fully managed, purpose-built service for creating, patching, testing, and distributing AMIs. It supports scheduled pipelines (such as monthly), automatically applies the latest patches, and can distribute AMIs across multiple AWS accounts using AWS Organizations. This requires significantly less custom code and maintenance than building pipelines with CodePipeline, Lambda, or Systems Manager, making it the most operationally efficient solution.
Question 7
A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region disaster recover (DR) strategy for the S3 objects. The DevOps engineer enables two-way replication between the S3 buckets.
The company must be able to fail over to a second S3 bucket that is in a second AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes.
Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose three.)
A. Enable S3 Replication Time Control (S3 RTC) for each replication rule used in the configuration.
B. Create an S3 Multi-Region Access Point in an active-passive configuration.
C. Call the SubmitMultiRegionAccessPointRoutes operation in the Amazon S3 API when the company needs to fail over to the S3 bucket in the second Region.
D. Enable S3 Transfer Acceleration on both S3 buckets.
E. Configure a routing control in Amazon Route 53 Application Recovery Controller. Add both S3 buckets in an active-passive configuration.
F. Use an Amazon Route 53 Application Recovery Controller to shift traffic from the primary bucket to the failover bucket in the second Region.
Show Answer
Correct Answer: A, B, C
Explanation: S3 Replication Time Control (A) is required to guarantee replication within 15 minutes. S3 Multi-Region Access Points (B) provide an operationally efficient way to access and fail over between buckets in different Regions without application changes. The SubmitMultiRegionAccessPointRoutes API (C) is the correct mechanism to control routing and perform failover between the Regions. Other options do not directly provide the required replication SLA or add unnecessary operational complexity.
Question 8
A company uses Amazon RDS for Microsoft SQL Server as its primary database for applications. The company needs to ensure high availability within and across AWS Regions.
An Amazon Route 53 CNAME record is configured for the database endpoint. The applications connect to the database endpoint. The company must redirect application traffic to a standby database during a failover event. The company must maintain an RPO of less than 1 minute and an RTO of less than 10 minutes.
Which solution will meet these requirements?
A. Deploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment that uses cross-Region read replicas. Use automation to promote the read replica to a standalone instance and to update the Route 53 record.
B. Deploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment. Set up automated snapshots to be copied to another Region every 5 minutes. Use AWS Lambda to restore the latest snapshot in the secondary Region during failover.
C. Deploy an Amazon RDS for SQL Server Single-AZ DB instance. Use AWS Database Migration Service (AWS DMS) to replicate data continuously to an RDS DB instance in another Region. Use Amazon CloudWatch alarms to notify the company about failover events.
D. Deploy an Amazon RDS for SQL Server Single-AZ DB instance. Configure AWS Backup to create cross-Region backups every 30 seconds. Use automation to restore the latest backup and to update the Route 53 record during failover.
Show Answer
Correct Answer: A
Explanation: Option A meets both intra-Region and cross-Region high availability requirements. An RDS for SQL Server Multi-AZ deployment provides automatic failover within a Region. Cross-Region read replicas provide near-real-time replication, enabling an RPO of less than 1 minute. Promoting the replica and updating the Route 53 CNAME can be automated to achieve an RTO under 10 minutes. The other options rely on snapshots, backups, or Single-AZ deployments, which cannot meet the required RPO/RTO or intra-Region HA requirements.
Question 8
A company's applications run on Amazon EC2 instances and use AWS Lambda functions in multiple AWS accounts. All EC2 instances have the Amazon CloudWatch agent installed. All accounts belong to the same organization in AWS Organizations. The company has created a dedicated central log account.
All logs that the applications produce must be sent to a central location. The logs must be encrypted with keys that the company manages.
Which solution meets these requirements with the LEAST operational overhead?
A. In the central log account, enable logs as the data source in CloudWatch. Add the organization ID to the source account list. Create a CloudFormation StackSet by using the template provided by CloudWatch to enable central monitoring in all the organization's accounts.
B. Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in the central log account. Set the S3 bucket as the destination of the Firehose stream. Create a log subscription in the central log account. Set the Firehose stream as a target of the subscription. Store the subscription log ARN in AWS Systems Manager Parameter Store for each project to use to send logs to the S3 bucket.
C. Create an Amazon S3 bucket in each account. Create an Amazon OpenSearch Service cluster in the central log account. Create an Amazon Simple Queue Service (Amazon SQS) queue in the central log account. Create an S3 trigger that sends events to the SQS queue each time a new file is uploaded to the S3 bucket. Create a Lambda function that processes each file and sends each file to the OpenSearch Service cluster.
D. Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in each account. Set the S3 bucket as the destination of the Firehose streams. Create a log subscription in each account with the Firehose streams as a target.
Show Answer
Correct Answer: D
Explanation: The requirement is to send all logs to a central location with customer‑managed encryption and the least operational overhead. CloudWatch cross‑account observability (Option A) only provides centralized visibility, not centralized storage; logs remain in the source accounts and can be lost if deleted. Options B and C introduce unnecessary complexity and manual coordination. Option D uses native CloudWatch Logs subscription filters with Amazon Data Firehose to stream logs from each account directly into a single S3 bucket in the central log account, where SSE‑KMS can be enforced with customer‑managed keys. This is the standard, scalable log‑aggregation pattern with minimal operational overhead that truly centralizes log data.
Question 9
A company has a workflow that generates a file for each of the company's products and stores the files in a production environment Amazon S3 bucket. The company's users can access the S3 bucket.
Each file contains a product ID. Product IDs for products that have not been publicly announced are prefixed with a specific UUID. Product IDs are 12 characters long. IDs for products that have not been publicly announces begin with the letter P.
The company does not want information about products that have not been publicly announced to be available in the production environment S3 bucket.
Which solution will meet these requirements?
A. Create a new staging S3 bucket. Generate all files in the new staging bucket. Create an Amazon Macie custom data identifier to identify product IDs in the new bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.
B. Create an Amazon Macie custom data identifier to identify product IDs in the production bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Remove all files that have a Macie finding from the production S3 bucket.
C. Create a new staging S3 bucket. Generate all files in the new staging bucket. Launch an Amazon Macie sensitive data discovery job with a managed data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.
D. Create an Amazon Macie sensitive data discovery job with a managed data identifier. Remove all files that have a Macie finding from the production S3 bucket.
Show Answer
Correct Answer: A
Explanation: The requirement is to prevent any information about unannounced products from being available in the production S3 bucket. Using a staging bucket and Amazon Macie with a custom data identifier allows detection of product IDs that match the specific UUID/format for unannounced products before promotion to production. Only files without Macie findings are copied to production, ensuring sensitive files never reach the production environment. The other options either rely on managed identifiers that won’t match custom product IDs or allow sensitive data to exist in production before removal.
Question 9
A DevOps engineer needs to implement a CI/CD pipeline in an AWS account. The pipeline must consume sensitive database credentials that are stored in an AWS Systems Manager Parameter Store parameter. The Parameter Store parameter is in a separate central account. The DevOps engineer needs to create and integrate the parameter with the CI/CD account.
Which combination of steps will meet these requirements? (Choose three.)
A. Use an advanced tier Parameter Store parameter to store the database credentials in the central AWS account.
B. Create an IAM role in the AWS account that hosts the CI/CD pipeline. Add the full ARN of the parameter to the IAM policy that is associated with the IAM role.
C. Use a standard tier Parameter Store parameter to store the database credentials in the central AWS account.
D. Use an AWS KMS managed key to encrypt the parameter. Grant decrypt permissions for the KMS key to the AWS account that hosts the CI/CD pipeline.
E. Use a customer managed AWS KMS key to encrypt the parameter. Grant decrypt permissions for the customer managed key to the AWS account that hosts the CI/CD pipeline.
F. Create an AWS Resource Access Manager (AWS RAM) resource share in the central AWS account. Share the parameter with the account that hosts the CI/CD pipeline.
Show Answer
Correct Answer: A, E, F
Explanation: Cross-account consumption of AWS Systems Manager Parameter Store parameters requires features that are only available with Advanced tier parameters. Advanced tier parameters can be shared across AWS accounts using AWS Resource Access Manager (AWS RAM). Because the parameter contains sensitive credentials (SecureString), it must be encrypted with a customer managed AWS KMS key so that a cross-account key policy can grant decrypt permissions to the CI/CD account. AWS-managed KMS keys cannot be shared across accounts, and standard tier parameters cannot be shared via RAM. Therefore, the correct combination is Advanced tier (A), customer managed KMS key with cross-account decrypt permissions (E), and sharing the parameter via AWS RAM (F).
Question 10
A company is migrating its web application to AWS. The application uses WebSocket connections for real-time updates and requires sticky sessions.
A DevOps engineer must implement a highly available architecture for the application. The application must be accessible to users worldwide with the least possible latency.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy an Application Load Balancer (ALB). Deploy another ALB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the ALBs. Integrate the ALBs with Amazon Route 53 latency-based routing.
B. Deploy a Network Load Balancer (NLB). Deploy another NLB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the NLBs. Integrate the NLBs with Amazon Route 53 geolocation routing.
C. Deploy a Network Load Balancer (NLB) with cross-zone load balancing enabled. Configure the NLB with IP-based targets in multiple Availability Zones. Use Amazon CloudFront for global content delivery. Implement sticky sessions by using source IP address preservation on the NLB.
D. Deploy an Application Load Balancer (ALB) for HTTP traffic. Deploy a Network Load Balancer (NLB) in each of the company’s AWS Regions for WebSocket connections. Enable sticky sessions on the ALB. Configure the ALB to forward requests to the NLB.
Show Answer
Correct Answer: A
Explanation: Application Load Balancers natively support WebSocket connections and cookie-based sticky sessions, meeting the application requirements without extra components. Using ALBs in multiple Regions with Route 53 latency-based routing directs users to the closest Region for the lowest latency, while cross-zone load balancing provides high availability across Availability Zones. This design is fully managed and simpler than alternatives, resulting in the least operational overhead.
Question 10
A company is using the AWS Cloud Development Kit (AWS CDK) to develop a microservices-based application. The company needs to create reusable infrastructure components for three environments: development, staging, and production. The components must include networking resources, database resources, and serverless compute resources.
The company must implement a solution that provides consistent infrastructure across environments while offering the option for environment-specific customizations. The solution also must minimize code duplication.
Which solution will meet these requirements with the LEAST development overhead?
A. Create custom Level 1 (L1) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create a single set of deployment stacks that takes the environment name as an argument upon instantiation. Deploy CDK applications for each environment.
B. Create custom Level 1 (L1) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create separate deployment stacks for each environment. Use the CDK context command to determine which stacks to run when deploying to each environment.
C. Create custom Level 3 (L3) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create a single set of deployment stacks that takes the environment name as an argument upon instantiation. Deploy CDK applications for each environment.
D. Create custom Level 3 (L3) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create separate deployment stacks for each environment. Use the CDK context command to determine which stacks to run when deploying to each environment.
Show Answer
Correct Answer: C
Explanation: Level 3 (L3) constructs are intended to encapsulate reusable, opinionated infrastructure patterns built from L2 constructs, which fits the requirement for reusable networking, database, and serverless components. Using a single set of stacks parameterized by environment provides consistent infrastructure with environment-specific customization while minimizing code duplication and development overhead.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.