A company has deployed a new platform that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The new platform hosts web applications that users frequently update. The application developers build the Docker images for the applications and deploy the Docker images manually to the platform.
The platform usage has increased to more than 500 users every day. Frequent updates, building the updated Docker images for the applications, and deploying the Docker images on the platform manually have all become difficult to manage.
The company needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if Docker image scanning returns any HIGH or CRITICAL findings for operating system or programming language package vulnerabilities.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon S3 event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
B. Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
C. Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on basic scanning for the ECR repository. Create an Amazon EventBridge rule that monitors Amazon GuardDuty events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
D. Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on enhanced scanning for the ECR repository. Create an Amazon EventBridge rule that monitors ECR image scan events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
E. Create an AWS CodeBuild project that scans the Dockerfile. Configure the project to build the Docker images and store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository if the scan is successful. Configure an SNS topic to provide notification if the scan returns any vulnerabilities.
Show Answer
Correct Answer: B, D
Explanation: B automates the CI/CD workflow correctly by storing source in CodeCommit and triggering CodePipeline from CodeCommit events via Amazon EventBridge, which then invokes CodeBuild. A is incorrect because CodeCommit changes do not generate Amazon S3 events. D is correct because CodeBuild builds and pushes images to Amazon ECR, enhanced scanning detects both operating system and programming language package vulnerabilities, and Amazon EventBridge can match ECR image scan events and send SNS notifications when HIGH or CRITICAL findings are present via the finding severity counts. C is incorrect because it references GuardDuty events rather than ECR image scan events and basic scanning does not provide the required enhanced vulnerability coverage. E scans the Dockerfile rather than the built container image and does not satisfy the image vulnerability scanning requirement.
Question 195
A company groups its AWS accounts in OUs in an organization in AWS Organizations. The company has deployed a set of Amazon API Gateway APIs in one of the Organizations accounts. The APIs are bound to the account's VPC and have no existing authentication mechanism. Only principals in a specific OU can have permissions to invoke the APIs.
The company applies the following policy to the API Gateway interface VPC endpoint:
The company also updates the API Gateway resource policies to deny invocations that do not come through the interface VPC endpoint. After the updates, the following error message appears during attempts to use the interface VPC endpoint URL to invoke an API: "User: anonymous is not authorized."
Which combination of steps will solve this problem? (Choose two.)
A. Enable IAM authentication on all API methods by setting AWS JAM as the authorization method.
B. Create a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token.
C. Create a request parameter-based AWS Lambda authorizer that passes the caller's identity in a combination of headers, query string parameters, stage variables, and $cortext variables.
D. Use Amazon Cognito user pools as the authorizer to control access to the API.
E. Verify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials.
Show Answer
Correct Answer: A, E
Explanation: The VPC endpoint policy evaluates the caller's IAM principal. The error 'User: anonymous is not authorized' indicates requests are reaching API Gateway without an authenticated AWS identity. Configure API Gateway methods to use AWS IAM authorization, then have clients sign requests with Signature Version 4 (SigV4) using AWS credentials. This allows API Gateway and the VPC endpoint policy to identify the principal and enforce access based on IAM permissions and organization conditions. Lambda authorizers or Cognito are unnecessary for this IAM-based access control scenario.
Question 196
A company has developed a static website hosted on an Amazon S3 bucket. The website is deployed using AWS CloudFormation. The CloudFormation template defines an S3 bucket and a custom resource that copies content into the bucket from a source location.
The company has decided that it needs to move the website to a new location, so the existing CloudFormation stack must be deleted and re-created. However, CloudFormation reports that the stack could not be deleted cleanly.
What is the MOST likely cause and how can the DevOps engineer mitigate this problem for this and future versions of the website?
A. Deletion has failed because the S3 bucket has an active website configuration. Modify the CloudFormation template to remove the WebsiteConfiguration property from the S3 bucket resource.
B. Deletion has failed because the S3 bucket is not empty. Modify the custom resource's AWS Lambda function code to recursively empty the bucket when RequestType is Delete.
C. Deletion has failed because the custom resource does not define a deletion policy. Add a DeletionPolicy property to the custom resource definition with a value of RemoveOnDeletion.
D. Deletion has failed because the S3 bucket is not empty. Modify the S3 bucket resource in the CloudFormation template to add a DeletionPolicy property with a value of Empty.
Show Answer
Correct Answer: B
Explanation: CloudFormation cannot delete an Amazon S3 bucket unless it is empty. In this scenario, the custom resource copies website content into the bucket, leaving objects behind. During stack deletion, the bucket deletion fails because it still contains objects. The standard mitigation is to implement Delete handling in the custom resource (typically a Lambda-backed custom resource) so that on RequestType=Delete it recursively removes all objects (and versions if versioning is enabled) before CloudFormation deletes the bucket. The other options reference nonexistent or incorrect CloudFormation properties or misunderstand S3 website configuration.
Question 197
A company has an event-driven JavaScript application. The application uses decoupled AWS managed services that publish, consume, and route events. During application testing, events are not delivered to the target that is specified by an Amazon EventBridge rule.
A DevOps team must provide application testers with additional functionality to view, troubleshoot, and prevent the loss of events without redeployment of the application.
Which combination of steps should the DevOps team take to meet these requirements? (Choose three.)
A. Launch AWS Device Farm with a standard test environment and project to run a specific build of the application.
B. Create an Amazon S3 bucket. Enable AWS CloudTrail. Create a CloudTrail trail that specifies the S3 bucket as the storage location.
C. Configure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue.
D. Configure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) FIFO queue as a dead-letter queue.
E. Create a log group in Amazon CloudWatch Logs Specify the log group as an additional target of the EventBridge rule.
F. Update the application code base to use the AWS X-Ray SDK tracing feature to instrument the code with support for the X-Amzn-Trace-Id header.
Show Answer
Correct Answer: B, C, E
Explanation: Enable CloudTrail to record EventBridge API activity for auditing and troubleshooting. Configure an SQS standard queue as the EventBridge rule's dead-letter queue so failed event deliveries are retained instead of lost. Add a CloudWatch Logs log group as an additional EventBridge target so testers can inspect events without changing application code. X-Ray requires application instrumentation and redeployment, Device Farm is unrelated, and SQS FIFO is not the appropriate DLQ choice for EventBridge.
Question 198
A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and run the containerized workloads. The company has also provisioned a shared services account for shared workloads in the organization.
The company must follow strict compliance regulations. All container images must receive security scanning before they are deployed to any environment. Images can be consumed by downstream deployment mechanisms after the images pass a scan with no critical vulnerabilities. Pre-scan and post-scan images must be isolated from one another so that a deployment can never use pre-scan images.
A DevOps engineer needs to create a strategy to centralize this process.
Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose two.)
A. Create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account: one repository for each pre-scan image and one repository for each post-scan image. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization write access to the pre-scan repositories and read access to the post-scan repositories.
B. Create pre-scan Amazon Elastic Container Registry (Amazon ECR) repositories in each account that publishes container images. Create repositories for post-scan images in the shared services account. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization read access to the post-scan repositories.
C. Configure image replication for each image from the image's pre-scan repository to the image's post-scan repository.
D. Create a pipeline in AWS CodePipeline for each pre-scan repository. Create a source stage that runs when new images are pushed to the pre-scan repositories. Create a stage that uses AWS CodeBuild as the action provider. Write a buildspec.yaml definition that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.
E. Create an AWS Lambda function. Create an Amazon EventBridge rule that reacts to image scanning completed events and invokes the Lambda function. Write function code that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.
Show Answer
Correct Answer: A, E
Explanation: Centralizing both pre-scan and post-scan Amazon ECR repositories in the shared services account minimizes administration while cleanly isolating unscanned and approved images. Configure scan-on-push for the pre-scan repositories and grant organization-wide write access only to pre-scan repositories and read access to post-scan repositories. Use Amazon EventBridge to react to ECR image scan completion events and invoke a single AWS Lambda function that checks the scan findings and promotes only images with no critical vulnerabilities into the post-scan repositories. Image replication cannot conditionally replicate based on scan results, and creating a CodePipeline per repository adds more operational overhead than an event-driven Lambda approach.
Question 199
A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to deploy its web applications on containers. The web applications contain confidential data that cannot be decrypted without specific credentials.
A DevOps engineer has stored the credentials in AWS Secrets Manager. The secrets are encrypted by an AWS Key Management Service (AWS KMS) customer managed key. A Kubernetes service account for a third-party tool makes the secrets available to the applications. The service account assumes an IAM role that the company created to access the secrets.
The service account receives an Access Denied (403 Forbidden) error while trying to retrieve the secrets from Secrets Manager.
What is the root cause of this issue?
A. The IAM role that is attached to the EKS cluster does not have access to retrieve the secrets from Secrets Manager.
B. The key policy for the customer managed key does not allow the Kubernetes service account IAM role to use the key.
C. The key policy for the customer managed key does not allow the EKS cluster IAM role to use the key.
D. The IAM role that is assumed by the Kubernetes service account does not have permission to access the EKS cluster.
Show Answer
Correct Answer: B
Explanation: In Amazon EKS with IAM Roles for Service Accounts (IRSA), the Kubernetes service account assumes its own IAM role to call Secrets Manager. If the secret is encrypted with a customer managed KMS key, that IAM role must also be allowed to use the KMS key (for example, kms:Decrypt via the key policy and/or IAM policy as applicable). The EKS cluster IAM role is not used for decrypting the secret on behalf of the pod, so permissions on the cluster role are not the root cause.
Question 200
A company is migrating its product development teams from an on-premises data center to a hybrid environment. The new environment will add four AWS Regions and will give the developers the ability to use the Region that is geographically closest to them.
All the development teams use a shared set of Linux applications. The on-premises data center stores the applications on a NetApp ONTAP storage device. The storage volume is mounted read-only on the development on-premises VMs. The company updates the applications on the shared volume once a week.
A DevOps engineer needs to replicate the data to all the new Regions. The DevOps engineer must ensure that the data is always up to date with deduplication. The data also must not be dependent on the availability of the on-premises storage device.
Which solution will meet these requirements?
A. Create an Amazon S3 File Gateway in the on-premises data center. Create S3 buckets in each Region. Set up a cron job to copy the data from the storage device to the S3 File Gateway. Set up S3 Cross-Region Replication (CRR) to the S3 buckets in each Region.
B. Create an Amazon FSx File Gateway in one Region. Create file servers in Amazon FSx for Windows File Server in each Region. Set up a cron job to copy the data from the storage device to the FSx File Gateway.
C. Create Multi-AZ Amazon FSx for NetApp ONTAP instances and volumes in each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and the FSx for ONTAP instances.
D. Create an Amazon Elastic File System (Amazon EFS) file system in each Region. Deploy an AWS DataSync agent in the on-premises data center. Configure a schedule for DataSync to copy the data to Amazon EFS daily.
Show Answer
Correct Answer: C
Explanation: Amazon FSx for NetApp ONTAP natively supports NetApp SnapMirror from on-premises ONTAP systems, providing efficient block-level incremental replication that preserves ONTAP storage efficiencies such as deduplication. Deploying Multi-AZ FSx for ONTAP in each required AWS Region and configuring scheduled SnapMirror replication keeps each regional copy current while ensuring AWS-hosted copies remain available even if the on-premises storage becomes unavailable. The other options either change the storage platform, do not preserve ONTAP-native replication/deduplication, or do not satisfy the replication and independence requirements.
Question 201
A DevOps team has created a Custom Lambda rule in AWS Config. The rule monitors Amazon Elastic Container Repository (Amazon ECR) policy statements for ecr:* actions. When a noncompliant repository is detected, Amazon EventBridge uses Amazon Simple Notification Service (Amazon SNS) to route the notification to a security team.
When the custom AWS Config rule is evaluated, the AWS Lambda function fails to run.
Which solution will resolve the issue?
A. Modify the Lambda function's resource policy to grant AWS Config permission to invoke the function.
B. Modify the SNS topic policy to include configuration changes for EventBridge to publish to the SNS topic.
C. Modify the Lambda function's execution role to include configuration changes for custom AWS Config rules.
D. Modify all the ECR repository policies to grant AWS Config access to the necessary ECR API actions.
Show Answer
Correct Answer: A
Explanation: AWS Config custom Lambda rules require a resource-based policy on the Lambda function that allows the AWS Config service principal (config.amazonaws.com) to invoke the function. If this permission is missing, AWS Config cannot invoke the function, so the rule evaluation fails before the function executes. SNS topic policies, the Lambda execution role, or ECR repository policies do not resolve an invocation permission failure.
Question 202
A company deploys an application on on-premises devices in the company’s on-premises data center. The company uses an AWS Direct Connect connection between the data center and the company's AWS account. During initial setup of the on-premises devices and during application updates, the application needs to retrieve configuration files from an Amazon Elastic File System (Amazon EFS) file system.
All traffic from the on-premises devices to Amazon EFS must remain private and encrypted. The on-premises devices must follow the principle of least privilege for AWS access. The company's DevOps team needs the ability to revoke access from a single device without affecting the access of the other devices.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an IAM user that has an access key and a secret key for each device. Attach the AmazonElasticFileSystemFullAccess policy to all IAM users. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
B. Generate certificates for each on-premises device in AWS Private Certificate Authority. Create a trust anchor in IAM Roles Anywhere that references an AWS Private CA. Create an IAM role that trust IAM Roles Anywhere. Attach the AmazonElasticFileSystemClientReadWriteAccess to the role. Create an IAM Roles Anywhere profile for the IAM role. Configure the AWS CLI on the on-premises devices to use the aws_signing_helper command to obtain credentials.
C. Create an IAM user that has an access key and a secret key for all devices. Attach the AmazonElasticFileSystemClientReadWriteAccess policy to the IAM user. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
D. Use the amazon-efs-utils package to mount the EFS file system.
E. Use the native Linux NFS client to mount the EFS file system.
Show Answer
Correct Answer: B, D
Explanation: Use IAM Roles Anywhere with per-device certificates to provide temporary least-privilege credentials that can be revoked per device by revoking its certificate or trust, avoiding long-lived IAM user keys. Mount EFS using amazon-efs-utils, which supports IAM authorization and encrypts data in transit with TLS. Native NFS alone does not provide the required encrypted transport, and IAM users with static keys are less secure and do not meet the revocation/least-privilege requirements as well.
Question 203
A DevOps engineer is building the infrastructure for an application. The application needs to run on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that includes Amazon EC2 instances. The EC2 instances need to use an Amazon Elastic File System (Amazon EFS) file system as a storage backend. The Amazon EFS Container Storage Interface (CSI) driver is installed on the EKS cluster.
When the DevOps engineer starts the application, the EC2 instances do not mount the EFS file system.
Which solutions will fix the problem? (Choose three.)
A. Switch the EKS nodes from Amazon EC2 to AWS Fargate.
B. Add an inbound rule to the EFS file system’s security group to allow NFS traffic from the EKS cluster.
C. Create an IAM role that allows the Amazon EFS CSI driver to interact with the file system
D. Set up AWS DataSync to configure file transfer between the EFS file system and the EKS nodes.
E. Create a mount target for the EFS file system in the subnet of the EKS nodes.
F. Disable encryption or the EFS file system.
Show Answer
Correct Answer: B, C, E
Explanation: The EFS mount requires network connectivity over NFS (port 2049), appropriate IAM permissions for the Amazon EFS CSI driver (typically via IAM role for service account or equivalent), and EFS mount targets in the VPC subnets/AZs where the EKS worker nodes access the file system. Switching to Fargate does not address the issue, DataSync is unrelated to mounting, and EFS encryption does not prevent mounting.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.