A company has deployed a new platform that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The new platform hosts web applications that users frequently update. The application developers build the Docker images for the applications and deploy the Docker images manually to the platform.
The platform usage has increased to more than 500 users every day. Frequent updates, building the updated Docker images for the applications, and deploying the Docker images on the platform manually have all become difficult to manage.
The company needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if Docker image scanning returns any HIGH or CRITICAL findings for operating system or programming language package vulnerabilities.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon S3 event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
B. Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
C. Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on basic scanning for the ECR repository. Create an Amazon EventBridge rule that monitors Amazon GuardDuty events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
D. Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on enhanced scanning for the ECR repository. Create an Amazon EventBridge rule that monitors ECR image scan events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
E. Create an AWS CodeBuild project that scans the Dockerfile. Configure the project to build the Docker images and store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository if the scan is successful. Configure an SNS topic to provide notification if the scan returns any vulnerabilities.
Show Answer
Correct Answer: B, D
Explanation: The company needs an automated CI/CD workflow and vulnerability notifications for container images. Option B correctly automates builds by using AWS CodeCommit with AWS CodePipeline triggered by Amazon EventBridge on commits, which is the appropriate native mechanism for reacting to repository changes. Option D correctly handles the security requirement by building images with AWS CodeBuild, storing them in Amazon ECR, enabling enhanced scanning, and using Amazon EventBridge to detect ECR image scan results and notify an SNS topic when HIGH or CRITICAL vulnerabilities are found. Other options either use incorrect triggers, incorrect services (GuardDuty), or unsupported scanning approaches.
Question 157
A company groups its AWS accounts in OUs in an organization in AWS Organizations. The company has deployed a set of Amazon API Gateway APIs in one of the Organizations accounts. The APIs are bound to the account's VPC and have no existing authentication mechanism. Only principals in a specific OU can have permissions to invoke the APIs.
The company applies the following policy to the API Gateway interface VPC endpoint:
The company also updates the API Gateway resource policies to deny invocations that do not come through the interface VPC endpoint. After the updates, the following error message appears during attempts to use the interface VPC endpoint URL to invoke an API: "User: anonymous is not authorized."
Which combination of steps will solve this problem? (Choose two.)
A. Enable IAM authentication on all API methods by setting AWS JAM as the authorization method.
B. Create a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token.
C. Create a request parameter-based AWS Lambda authorizer that passes the caller's identity in a combination of headers, query string parameters, stage variables, and $cortext variables.
D. Use Amazon Cognito user pools as the authorizer to control access to the API.
E. Verify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials.
Show Answer
Correct Answer: A, E
Explanation: The error occurs because requests coming through the interface VPC endpoint are treated as anonymous unless an authentication mechanism is enabled on the API. To restrict access to principals in a specific OU, the API must authenticate callers using IAM identities.
Enabling IAM authentication on API Gateway methods requires callers to be authenticated with AWS IAM (A). Once IAM authorization is enabled, clients must sign their requests using AWS Signature Version 4 with valid AWS credentials (E). This allows API Gateway to identify the calling principal and evaluate IAM and resource policies (including OU-based conditions), resolving the "User: anonymous is not authorized" error.
Question 158
A company has developed a static website hosted on an Amazon S3 bucket. The website is deployed using AWS CloudFormation. The CloudFormation template defines an S3 bucket and a custom resource that copies content into the bucket from a source location.
The company has decided that it needs to move the website to a new location, so the existing CloudFormation stack must be deleted and re-created. However, CloudFormation reports that the stack could not be deleted cleanly.
What is the MOST likely cause and how can the DevOps engineer mitigate this problem for this and future versions of the website?
A. Deletion has failed because the S3 bucket has an active website configuration. Modify the CloudFormation template to remove the WebsiteConfiguration property from the S3 bucket resource.
B. Deletion has failed because the S3 bucket is not empty. Modify the custom resource's AWS Lambda function code to recursively empty the bucket when RequestType is Delete.
C. Deletion has failed because the custom resource does not define a deletion policy. Add a DeletionPolicy property to the custom resource definition with a value of RemoveOnDeletion.
D. Deletion has failed because the S3 bucket is not empty. Modify the S3 bucket resource in the CloudFormation template to add a DeletionPolicy property with a value of Empty.
Show Answer
Correct Answer: B
Explanation: CloudFormation cannot delete an S3 bucket that contains objects. The custom resource copies website files into the bucket, so on stack deletion the bucket remains non-empty and deletion fails. The correct mitigation is to handle the Delete lifecycle event in the custom resource (typically a Lambda-backed custom resource) to recursively empty the bucket before CloudFormation attempts to delete it, which also future-proofs subsequent versions.
Question 159
A company has an event-driven JavaScript application. The application uses decoupled AWS managed services that publish, consume, and route events. During application testing, events are not delivered to the target that is specified by an Amazon EventBridge rule.
A DevOps team must provide application testers with additional functionality to view, troubleshoot, and prevent the loss of events without redeployment of the application.
Which combination of steps should the DevOps team take to meet these requirements? (Choose three.)
A. Launch AWS Device Farm with a standard test environment and project to run a specific build of the application.
B. Create an Amazon S3 bucket. Enable AWS CloudTrail. Create a CloudTrail trail that specifies the S3 bucket as the storage location.
C. Configure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue.
D. Configure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) FIFO queue as a dead-letter queue.
E. Create a log group in Amazon CloudWatch Logs Specify the log group as an additional target of the EventBridge rule.
F. Update the application code base to use the AWS X-Ray SDK tracing feature to instrument the code with support for the X-Amzn-Trace-Id header.
Show Answer
Correct Answer: B, C, E
Explanation: The requirement is to view, troubleshoot, and prevent loss of events without redeploying the application. Configuring an EventBridge dead-letter queue with an SQS standard queue (C) captures undelivered events for inspection and retry. Adding a CloudWatch Logs log group as an additional EventBridge target (E) provides visibility into events and rule matching for troubleshooting. Enabling CloudTrail and storing logs in S3 (B) allows auditing of EventBridge and related AWS API activity to help diagnose delivery issues. Options involving code changes (F) require redeployment, and FIFO queues (D) are not supported as EventBridge DLQs.
Question 160
A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and run the containerized workloads. The company has also provisioned a shared services account for shared workloads in the organization.
The company must follow strict compliance regulations. All container images must receive security scanning before they are deployed to any environment. Images can be consumed by downstream deployment mechanisms after the images pass a scan with no critical vulnerabilities. Pre-scan and post-scan images must be isolated from one another so that a deployment can never use pre-scan images.
A DevOps engineer needs to create a strategy to centralize this process.
Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose two.)
A. Create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account: one repository for each pre-scan image and one repository for each post-scan image. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization write access to the pre-scan repositories and read access to the post-scan repositories.
B. Create pre-scan Amazon Elastic Container Registry (Amazon ECR) repositories in each account that publishes container images. Create repositories for post-scan images in the shared services account. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization read access to the post-scan repositories.
C. Configure image replication for each image from the image's pre-scan repository to the image's post-scan repository.
D. Create a pipeline in AWS CodePipeline for each pre-scan repository. Create a source stage that runs when new images are pushed to the pre-scan repositories. Create a stage that uses AWS CodeBuild as the action provider. Write a buildspec.yaml definition that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.
E. Create an AWS Lambda function. Create an Amazon EventBridge rule that reacts to image scanning completed events and invokes the Lambda function. Write function code that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.
Show Answer
Correct Answer: A, E
Explanation: To minimize administrative overhead while enforcing strict separation of pre-scan and post-scan images, repositories should be centralized and automation should be event-driven.
Option A centralizes both pre-scan and post-scan Amazon ECR repositories in the shared services account. This simplifies governance, access control, and compliance enforcement across the organization by using resource-based policies, and it guarantees isolation between pre-scan and post-scan images.
Option E uses an Amazon EventBridge rule and a single AWS Lambda function to react to ECR image scan completion events and promote only images with no critical vulnerabilities to the post-scan repositories. This event-driven approach avoids managing multiple pipelines and provides the least operational and administrative overhead while ensuring that only approved images are consumable by downstream deployments.
Question 161
A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to deploy its web applications on containers. The web applications contain confidential data that cannot be decrypted without specific credentials.
A DevOps engineer has stored the credentials in AWS Secrets Manager. The secrets are encrypted by an AWS Key Management Service (AWS KMS) customer managed key. A Kubernetes service account for a third-party tool makes the secrets available to the applications. The service account assumes an IAM role that the company created to access the secrets.
The service account receives an Access Denied (403 Forbidden) error while trying to retrieve the secrets from Secrets Manager.
What is the root cause of this issue?
A. The IAM role that is attached to the EKS cluster does not have access to retrieve the secrets from Secrets Manager.
B. The key policy for the customer managed key does not allow the Kubernetes service account IAM role to use the key.
C. The key policy for the customer managed key does not allow the EKS cluster IAM role to use the key.
D. The IAM role that is assumed by the Kubernetes service account does not have permission to access the EKS cluster.
Show Answer
Correct Answer: B
Explanation: The Kubernetes service account accesses Secrets Manager by assuming its own IAM role (IRSA). Even if that role has Secrets Manager permissions, Secrets Manager must decrypt the secret using the customer managed KMS key. If the KMS key policy does not allow the service account’s IAM role to use the key (e.g., kms:Decrypt), the request fails with Access Denied. The EKS cluster role is not used for this access.
Question 162
A company is migrating its product development teams from an on-premises data center to a hybrid environment. The new environment will add four AWS Regions and will give the developers the ability to use the Region that is geographically closest to them.
All the development teams use a shared set of Linux applications. The on-premises data center stores the applications on a NetApp ONTAP storage device. The storage volume is mounted read-only on the development on-premises VMs. The company updates the applications on the shared volume once a week.
A DevOps engineer needs to replicate the data to all the new Regions. The DevOps engineer must ensure that the data is always up to date with deduplication. The data also must not be dependent on the availability of the on-premises storage device.
Which solution will meet these requirements?
A. Create an Amazon S3 File Gateway in the on-premises data center. Create S3 buckets in each Region. Set up a cron job to copy the data from the storage device to the S3 File Gateway. Set up S3 Cross-Region Replication (CRR) to the S3 buckets in each Region.
B. Create an Amazon FSx File Gateway in one Region. Create file servers in Amazon FSx for Windows File Server in each Region. Set up a cron job to copy the data from the storage device to the FSx File Gateway.
C. Create Multi-AZ Amazon FSx for NetApp ONTAP instances and volumes in each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and the FSx for ONTAP instances.
D. Create an Amazon Elastic File System (Amazon EFS) file system in each Region. Deploy an AWS DataSync agent in the on-premises data center. Configure a schedule for DataSync to copy the data to Amazon EFS daily.
Show Answer
Correct Answer: C
Explanation: The on-premises storage is NetApp ONTAP and the requirements include continuous replication, deduplication, and independence from the availability of the on-premises device. Amazon FSx for NetApp ONTAP natively supports NetApp features such as SnapMirror, deduplication, compression, and efficient block-level replication. Creating FSx for ONTAP in each Region and configuring scheduled SnapMirror replication from the on-premises ONTAP system ensures data stays up to date, is efficiently deduplicated, and remains available in AWS even if the on-premises system becomes unavailable. Other options either rely on manual copy jobs, lack NetApp-native replication, or do not provide deduplication in a comparable manner.
Question 163
A DevOps team has created a Custom Lambda rule in AWS Config. The rule monitors Amazon Elastic Container Repository (Amazon ECR) policy statements for ecr:* actions. When a noncompliant repository is detected, Amazon EventBridge uses Amazon Simple Notification Service (Amazon SNS) to route the notification to a security team.
When the custom AWS Config rule is evaluated, the AWS Lambda function fails to run.
Which solution will resolve the issue?
A. Modify the Lambda function's resource policy to grant AWS Config permission to invoke the function.
B. Modify the SNS topic policy to include configuration changes for EventBridge to publish to the SNS topic.
C. Modify the Lambda function's execution role to include configuration changes for custom AWS Config rules.
D. Modify all the ECR repository policies to grant AWS Config access to the necessary ECR API actions.
Show Answer
Correct Answer: A
Explanation: Custom AWS Config rules that use Lambda require AWS Config to have permission to invoke the Lambda function. If the function fails to run during rule evaluation, the most common cause is a missing resource-based policy on the Lambda function allowing the principal config.amazonaws.com to call lambda:InvokeFunction. Updating the Lambda execution role, SNS policy, or ECR policies would not fix an invocation failure from AWS Config.
Question 164
A company deploys an application on on-premises devices in the company’s on-premises data center. The company uses an AWS Direct Connect connection between the data center and the company's AWS account. During initial setup of the on-premises devices and during application updates, the application needs to retrieve configuration files from an Amazon Elastic File System (Amazon EFS) file system.
All traffic from the on-premises devices to Amazon EFS must remain private and encrypted. The on-premises devices must follow the principle of least privilege for AWS access. The company's DevOps team needs the ability to revoke access from a single device without affecting the access of the other devices.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an IAM user that has an access key and a secret key for each device. Attach the AmazonElasticFileSystemFullAccess policy to all IAM users. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
B. Generate certificates for each on-premises device in AWS Private Certificate Authority. Create a trust anchor in IAM Roles Anywhere that references an AWS Private CA. Create an IAM role that trust IAM Roles Anywhere. Attach the AmazonElasticFileSystemClientReadWriteAccess to the role. Create an IAM Roles Anywhere profile for the IAM role. Configure the AWS CLI on the on-premises devices to use the aws_signing_helper command to obtain credentials.
C. Create an IAM user that has an access key and a secret key for all devices. Attach the AmazonElasticFileSystemClientReadWriteAccess policy to the IAM user. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
D. Use the amazon-efs-utils package to mount the EFS file system.
E. Use the native Linux NFS client to mount the EFS file system.
Show Answer
Correct Answer: B, D
Explanation: Option B uses IAM Roles Anywhere with per-device certificates issued by AWS Private CA, enabling least-privilege access through an IAM role, private and encrypted access, and the ability to revoke access for a single device by revoking its certificate. Option D uses amazon-efs-utils, which supports mounting EFS with TLS encryption in transit and IAM authorization over Direct Connect. Together, they ensure private, encrypted connectivity, fine-grained and revocable device access, and secure EFS mounting.
Question 166
A company uses AWS Organizations to manage its AWS accounts. A DevOps engineer must ensure that all users who access the AWS Management Console are authenticated through the company’s corporate identity provider (IdP).
Which combination of steps will meet these requirements? (Choose two.)
A. Use Amazon GuardDuty with a delegated administrator account Use GuardDuty to enforce denial of IAM user logins.
B. Use AWS IAM Identity Center to configure identity federation with SAML 2.0.
C. Create a permissions boundary in AWS IAM Identity Center to deny password logins for IAM users.
D. Create IAM groups in the Organizations management account to apply consistent permissions for all IAM users.
E. Create an SCP in Organizations to deny password creation for IAM users.
Show Answer
Correct Answer: B, E
Explanation: To require all AWS Management Console access to authenticate through the corporate IdP across AWS Organizations, you must both enable federation and prevent IAM user console passwords.
• **B** configures AWS IAM Identity Center with SAML 2.0 federation so users authenticate via the corporate IdP when accessing the console.
• **E** uses an Organizations SCP to deny `iam:CreateLoginProfile` and `iam:UpdateLoginProfile`, preventing IAM users from having console passwords and thereby enforcing federated access only.
Other options do not control authentication methods (A, D) or cannot deny console password usage (C).
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.