A company manages multiple AWS accounts by using AWS Organizations with OUs for the different business divisions. The company is updating their corporate network to use new IP address ranges. The company has 10 Amazon S3 buckets in different AWS accounts. The S3 buckets store reports for the different divisions. The S3 bucket configurations allow only private corporate network IP addresses to access the S3 buckets.
A DevOps engineer needs to change the range of IP addresses that have permission to access the contents of the S3 buckets. The DevOps engineer also needs to revoke the permissions of two OUs in the company.
Which solution will meet these requirements?
A. Create a new SCP that has two statements, one that allows access to the new range of IP addresses for all the S3 buckets and one that denies access to the old range of IP addresses for all the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
B. Create a new SCP that has a statement that allows only the new range of IP addresses to access the S3 buckets. Create another SCP that denies access to the S3 buckets. Attach the second SCP to the two OUs.
C. On all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Create a new SCP that denies access to the S3 buckets. Attach the SCP to the two OUs.
D. On all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
Show Answer
Correct Answer: C
Explanation: S3 access based on source IP addresses must be enforced with S3 resource-based (bucket) policies, not SCPs or permissions boundaries. Updating each bucket policy to allow only the new corporate IP ranges satisfies the IP requirement. Revoking access for entire organizational units is best accomplished with an SCP that explicitly denies S3 access and is attached to the two OUs. SCPs can restrict what accounts in an OU are allowed to do, regardless of bucket policies, meeting both requirements.
Question 178
A company has started using AWS across several teams. Each team has multiple accounts and unique security profiles. The company manages the accounts in an organization in AWS Organizations. Each account has its own configuration and security controls.
The company's DevOps team wants to use preventive and detective controls to govern all accounts. The DevOps team needs to ensure the security of accounts now and in the future as the company creates new accounts in the organization.
Which solution will meet these requirements?
A. Use Organizations to create OUs that have appropriate SCPs attached for each team. Place team accounts in the appropriate OUs to apply security controls. Create any new team accounts in the appropriate OUs.
B. Create an AWS Control Tower landing zone. Configure OUs and appropriate controls in AWS Control Tower for the existing teams. Configure trusted access for AWS Control Tower. Enroll the existing accounts in the appropriate OUs that match the appropriate security policies for each team. Use AWS Control Tower to provision any new accounts.
C. Create AWS CloudFormation stack sets in the organization's management account. Configure a stack set that deploys AWS Config with configuration rules and remediation actions for all controls to each account in the organization. Update the stack sets to deploy to new accounts as the accounts are created.
D. Configure AWS Config to manage the AWS Config rules across all AWS accounts in the organization. Deploy conformance packs that provide AWS Config rules and remediation actions across the organization.
Show Answer
Correct Answer: B
Explanation: AWS Control Tower provides built-in preventive (SCP-based) and detective (AWS Config–based) controls, called guardrails, that are applied consistently across OUs. It supports enrolling existing accounts, enforcing governance now, and automatically applying the same controls to all newly created accounts in the organization, which directly meets the requirement for ongoing governance at scale.
Question 179
A company has an application that runs on AWS Lambda and sends logs to Amazon CloudWatch Logs. An Amazon Kinesis data stream is subscribed to the log groups in CloudWatch Logs. A single consumer Lambda function processes the logs from the data stream and stores the logs in an Amazon S3 bucket.
The company’s DevOps team has noticed high latency during the processing and ingestion of some logs.
Which combination of steps will reduce the latency? (Choose three.)
A. Create a data stream consumer with enhanced fan-out. Set the Lambda function that processes the logs as the consumer.
B. Increase the ParallelizationFactor setting in the Lambda event source mapping.
C. Configure reserved concurrency for the Lambda function that processes the logs.
D. Increase the batch size in the Kinesis data stream.
E. Turn off the ReportBatchItemFailures setting in the Lambda event source mapping.
F. Increase the number of shards in the Kinesis data stream.
Show Answer
Correct Answer: A, B, F
Explanation: Latency in Kinesis-to-Lambda processing is typically caused by limited stream throughput and insufficient parallel processing. Enhanced fan-out (A) gives the Lambda consumer dedicated read throughput per shard, reducing read contention and lag. Increasing the ParallelizationFactor (B) allows multiple concurrent Lambda invocations per shard, improving processing concurrency. Increasing the number of shards (F) increases total stream throughput and parallelism, reducing iterator age and end-to-end latency. Reserved concurrency, batch size changes, or disabling ReportBatchItemFailures do not directly reduce ingestion latency.
Question 180
A cloud team uses AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On) to manage a company's AWS accounts. The company recently established a research team. The research team requires the ability to fully manage the resources in its account. The research team must not be able to create IAM users.
The cloud team creates a Research Administrator permission set in IAM Identity Center for the research team. The permission set has the AdministratorAccess AWS managed policy attached. The cloud team must ensure that no one on the research team can create IAM users.
Which solution will meet these requirements?
A. Create an IAM policy that denies the iam:CreateUser action. Attach the IAM policy to the Research Administrator permission set.
B. Create an IAM policy that allows all actions except the iam:CreateUser action. Use the IAM policy to set the permissions boundary for the Research Administrator permission set.
C. Create an SCP that denies the iam:CreateUser action. Attach the SCP to the research team's AWS account.
D. Create an AWS Lambda function that deletes IAM users. Create an Amazon EventBridge rule that detects the IAM CreateUser event. Configure the rule to invoke the Lambda function.
Show Answer
Correct Answer: A
Explanation: The requirement is to restrict only the research team while still allowing them broad administrative access. Adding an explicit deny for iam:CreateUser to the Research Administrator permission set overrides the AdministratorAccess allow and prevents only those users from creating IAM users. An SCP would apply to the entire account and block all principals, which goes beyond the stated requirement.
Question 181
A company needs to implement failover for its application. The application includes an Amazon CloudFront distribution and a public Application Load Balancer (ALB) in an AWS Region. The company has configured the ALB as the default origin for the distribution.
After some recent application outages, the company wants a zero-second RTO. The company deploys the application to a secondary Region in a warm standby configuration. A DevOps engineer needs to automate the failover of the application to the secondary Region so that HTTP GET requests meet the desired RTO.
Which solution will meet these requirements?
A. Create a second CloudFront distribution that has the secondary ALB as the default origin. Create Amazon Route 53 alias records that have a failover policy and Evaluate Target Health set to Yes for both CloudFront distributions. Update the application to use the new record set.
B. Create a new origin on the distribution for the secondary ALCreate a new origin group. Set the original ALB as the primary origin. Configure the origin group to fail over for HTTP 5xx status codes. Update the default behavior to use the origin group.
C. Create Amazon Route 53 alias records that have a failover policy and Evaluate Target Health set to Yes for both ALBs. Set the TTL of both records to 0. Update the distribution's origin to use the new record set.
D. Create a CloudFront function that detects HTTP 5xx status codes. Configure the function to return a 307 Temporary Redirect error response to the secondary ALB if the function detects 5xx status codes. Update the distribution's default behavior to send origin responses to the function.
Show Answer
Correct Answer: B
Explanation: CloudFront supports origin failover using origin groups. By creating a secondary origin that points to the warm-standby ALB and configuring an origin group to fail over on HTTP 5xx errors, CloudFront can automatically route individual GET requests to the secondary Region with no DNS propagation delay. This provides effectively zero-second RTO at the edge and requires only updating the distribution’s default behavior to use the origin group.
Question 182
A company deploys an application to two AWS Regions. The application creates and stores objects in an Amazon S3 bucket that is in the same Region as the application. Both deployments of the application need to have access to all the objects and their metadata from both Regions. The company has configured two-way replication between the S3 buckets and has enabled S3 Replication metrics on each S3 bucket.
A DevOps engineer needs to implement a solution that retries the replication process if an object fails to replicate.
Which solution will meet these requirements?
A. Create an Amazon EventBridge rule that listens to S3 event notifications for failed replication events. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket. Configure the EventBridge rule to invoke the Lambda function to handle the object that failed to replicate.
B. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure S3 event notifications to send failed replication notifications to the SQS queue. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket. Configure the Lambda function to poll the queue for notifications to process.
C. Create an Amazon EventBridge rule that listens to S3 event notifications for failed replications. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket.
D. Create an AWS Lambda function that will use S3 batch operations to retry the replication on the existing object for a failed replication. Configure S3 event notifications to send failed replication notifications to the Lambda function.
Show Answer
Correct Answer: D
Explanation: Amazon S3 Batch Replication (a feature of S3 Batch Operations) is specifically designed to retry replication for objects that previously failed replication, as well as objects that existed before replication was enabled. Using Batch Replication avoids custom download/PutObject logic and ensures metadata, versions, and replication semantics are handled correctly by S3. Event-driven Lambda approaches (A, B, C) manually re-upload objects and are not the recommended or reliable way to retry S3 replication failures.
Question 183
A DevOps engineer is building an application that uses an AWS Lambda function to query an Amazon Aurora MySQL DB cluster. The Lambda function performs only read queries. Amazon EventBridge events invoke the Lambda function.
As more events invoke the Lambda function each second, the database's latency increases and the database's throughput decreases. The DevOps engineer needs to improve the performance of the application.
Which combination of steps will meet these requirements? (Choose three.)
A. Use Amazon RDS Proxy to create a proxy. Connect the proxy to the Aurora cluster reader endpoint. Set a maximum connections percentage on the proxy.
B. Implement database connection pooling inside the Lambda code. Set a maximum number of connections on the database connection pool.
C. Implement the database connection opening outside the Lambda event handler code.
D. Implement the database connection opening and closing inside the Lambda event handler code.
E. Connect to the proxy endpoint from the Lambda function.
F. Connect to the Aurora cluster endpoint from the Lambda function.
Show Answer
Correct Answer: A, C, E
Explanation: Using Amazon RDS Proxy reduces connection management overhead and protects the database from connection storms. Connecting the proxy to the Aurora reader endpoint is appropriate because the workload is read-only, and setting a maximum connections percentage helps control database load. Opening the database connection outside the Lambda event handler allows connection reuse across warm invocations, improving latency and throughput. The Lambda function should connect to the RDS Proxy endpoint (not directly to Aurora) to benefit from connection pooling and scaling improvements.
Question 184
A company has a fleet of Amazon EC2 instances that run Linux in a single AWS account. The company is using an AWS Systems Manager Automation task across the EC2 instances.
During the most recent patch cycle, several EC2 instances went into an error state because of insufficient available disk space. A DevOps engineer needs to ensure that the EC2 instances have sufficient available disk space during the patching process in the future.
Which combination of steps will meet these requirements? (Choose two.)
A. Ensure that the Amazon CloudWatch agent is installed on all EC2 instances.
B. Create a cron job that is installed on each EC2 instance to periodically delete temporary files.
C. Create an Amazon CloudWatch log group for the EC2 instances. Configure a cron job that is installed on each EC2 instance to write the available disk space to a CloudWatch log stream for the relevant EC2 instance.
D. Create an Amazon CloudWatch alarm to monitor available disk space on all EC2 instances. Add the alarm as a safety control to the Systems Manager Automation task.
E. Create an AWS Lambda function to periodically check for sufficient available disk space on all EC2 instances by evaluating each EC2 instance's respective Amazon CloudWatch log stream.
Show Answer
Correct Answer: A, D
Explanation: The patching failures occurred due to insufficient disk space, so the solution must both measure disk usage and prevent Automation from running when disk space is low. Installing the Amazon CloudWatch agent enables collection of OS-level metrics such as disk usage that are not available by default. Creating a CloudWatch alarm on available disk space and using it as a safety control in the Systems Manager Automation task ensures the patching process is blocked if disk space falls below a defined threshold. Other options rely on manual cleanup or log analysis and do not directly integrate with Automation safety controls.
Question 185
A company uses AWS Control Tower and AWS CloudFormation to manage its AWS accounts and to create AWS resources. The company requires all Amazon S3 buckets to be encrypted with AWS Key Management Service (AWS KMS) when the S3 buckets are created in a CloudFormation stack.
Which solution will meet this requirement?
A. Use AWS Organizations. Attach an SCP that denies the s3:PutObject permission if the request does not include an x-amz-server-side-encryption header that requests server-side encryption with AWS KMS keys (SSE-KMS).
B. Use AWS Control Tower with a multi-account environment. Configure and enable proactive AWS Control Tower controls on all OUs with CloudFormation hooks.
C. Use AWS Control Tower with a multi-account environment. Configure and enable detective AWS Control Tower controls on all OUs with CloudFormation hooks.
D. Use AWS Organizations. Create an AWS Config organizational rule to check whether a KMS encryption key is enabled for all S3 buckets. Deploy the rule. Create and apply an SCP to prevent users from stopping and deleting AWS Config across all AWS accounts,
Show Answer
Correct Answer: B
Explanation: The requirement is to enforce AWS KMS encryption at creation time when S3 buckets are created through CloudFormation across multiple accounts managed by AWS Control Tower. Proactive AWS Control Tower controls use CloudFormation hooks to prevent noncompliant resources from being created, making them ideal for enforcing mandatory SSE-KMS during stack operations. Detective controls only detect after creation, and AWS Config rules are also post-creation. SCPs targeting s3:PutObject do not reliably enforce bucket-level encryption at bucket creation via CloudFormation.
Question 186
A company is launching an application that stores raw data in an Amazon S3 bucket. Three applications need to access the data to generate reports. The data must be redacted differently for each application before the applications can access the data.
Which solution will meet these requirements?
A. Create an S3 bucket for each application. Configure S3 Same-Region Replication (SRR) from the raw data's S3 bucket to each application's S3 bucket. Configure each application to consume data from its own S3 bucket.
B. Create an Amazon Kinesis data stream. Create an AWS Lambda function that is invoked by object creation events in the raw data’s S3 bucket. Program the Lambda function to redact data for each application. Publish the data on the Kinesis data stream. Configure each application to consume data from the Kinesis data stream.
C. For each application, create an S3 access point that uses the raw data's S3 bucket as the destination. Create an AWS Lambda function that is invoked by object creation events in the raw data's S3 bucket. Program the Lambda function to redact data for each application. Store the data in each application's S3 access point. Configure each application to consume data from its own S3 access point.
D. Create an S3 access point that uses the raw data’s S3 bucket as the destination. For each application, create an S3 Object Lambda access point that uses the S3 access point. Configure the AWS Lambda function for each S3 Object Lambda access point to redact data when objects are retrieved. Configure each application to consume data from its own S3 Object Lambda access point
Show Answer
Correct Answer: D
Explanation: The requirement is to store a single set of raw data in S3 while presenting differently redacted views of that data to multiple applications. Amazon S3 Object Lambda access points allow you to invoke a Lambda function on GET requests to dynamically transform or redact objects at retrieval time. By creating one base S3 access point to the raw bucket and separate S3 Object Lambda access points for each application, each application can apply its own redaction logic without duplicating data or pre-processing it. This directly matches the need for different redactions per application with a single source of truth.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.