A company uses an AWS CodeCommit repository to store its source code and corresponding unit tests. The company has configured an AWS CodePipeline pipeline that includes an AWS CodeBuild project that runs when code is merged to the main branch of the repository.
The company wants the CodeBuild project to run the unit tests. If the unit tests pass, the CodeBuild project must tag the most recent commit.
How should the company configure the CodeBuild project to meet these requirements?
A. Configure the CodeBuild project to use native Git to done the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use native Git to create a tag and to push the Git tag to the repository if the code passes the unit tests.
B. Configure the CodeBuild projed to use native Git to done the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new repository tag in the repository if the code passes the unit tests.
C. Configure the CodeBuild project to use AWS CLI commands to copy the code from the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new Git tag in the repository if the code passes the unit tests.
D. Configure the CodeBuild project to use AWS CLI commands to copy the code from the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new repository tag in the repository if the code passes the unit tests.
Show Answer
Correct Answer: A
Explanation: Git tags are Git objects, not AWS resource tags. To tag the most recent commit after successful unit tests, CodeBuild should use native Git support to clone the CodeCommit repository, run the tests, then execute `git tag` and `git push origin <tag>` to push the tag back to CodeCommit. The AWS CLI does not provide a command to create Git tags in a repository, and 'repository tags' refer to AWS resource tags, not Git commit tags.
Question 210
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs an automated process across all AWS accounts to isolate any compromised Amazon EC2 instances when the instances receive a specific tag.
Which combination of steps will meet these requirements? (Choose two.)
A. Use AWS CloudFormation StackSets to deploy the CloudFormation stacks in all AWS accounts.
B. Create an SCP that has a Deny statement for the ec2:* action with a condition of "aws:RequestTag/isolation": false.
C. Attach the SCP to the root of the organization.
D. Create an AWS CloudFormation template that creates an EC2 instance role that has no IAM policies attached. Configure the template to have a security group that has an explicit Deny rule on all traffic. Use the CloudFormation template to create an AWS Lambda function that attaches the IAM role to instances. Configure the Lambda function to add a network ACL. Set up an Amazon EventBridge rule to invoke the Lambda function when a specific tag is applied to a compromised EC2 instance.
E. Create an AWS CloudFormation template that creates an EC2 instance role that has no IAM policies attached. Configure the template to have a security group that has no inbound rules or outbound rules. Use the CloudFormation template to create an AWS Lambda function that attaches the IAM role to instances. Configure the Lambda function to replace any existing security groups with the new security group. Set up an Amazon EventBridge rule to invoke the Lambda function when a specific tag is applied to a compromised EC2 instance.
Show Answer
Correct Answer: A, E
Explanation: Deploy the automation consistently across all AWS accounts by using CloudFormation StackSets. The isolation workflow should be event-driven: an EventBridge rule detects when the specified tag is applied, invokes a Lambda function, and replaces the instance's security groups with an isolation security group that has no inbound or outbound rules. Option D is invalid because security groups do not support explicit deny rules, and network ACL changes are not the appropriate isolation mechanism here. SCPs in B and C restrict API actions, not network connectivity, so they do not isolate a compromised EC2 instance.
Question 211
A company deploys an application in two AWS Regions. The application currently uses an Amazon S3 bucket in the primary Region to store data.
A DevOps engineer needs to ensure that the application is highly available in both Regions. The DevOps engineer has created a new S3 bucket in the secondary Region. All existing and new objects must be in both S3 buckets. The application must fail over between the Regions with no data loss.
Which combination of steps will meet these requirements with the MOST operational efficiency? (Choose three.)
A. Create a new IAM role that allows the Amazon S3 and S3 Batch Operations service principals to assume the role that has the necessary permissions for S3 replication.
B. Create a new IAM role that allows the AWS Batch service principal to assume the role that has the necessary permissions for S3 replication.
C. Create an S3 Cross-Region Replication (CRR) rule on the source S3 bucket. Configure the rule to use the IAM role for Amazon S3 to replicate to the target S3 bucket.
D. Create a two-way replication rule on the source S3 bucket. Configure the rule to use the IAM role for Amazon S3 to replicate to the target S3 bucket.
E. Create an AWS Batch job that has an AWS Fargate orchestration type. Configure the job to use the IAM role for AWS Batch. Specify a Bash command to use the AWS CLI to synchronize the contents of the source S3 bucket and the target S3 bucket
F. Create an operation in S3 Batch Operations to replicate the contents of the source S3 bucket to the target S3 bucket. Configure the operation to use the IAM role for Amazon S3.
Show Answer
Correct Answer: A, D, F
Explanation: To keep both buckets synchronized before and after a regional failover, new objects must replicate in both directions and existing objects must be backfilled. Create the required S3 replication IAM role that can be assumed by Amazon S3 and S3 Batch Operations (A), configure bidirectional (two-way) replication for ongoing object replication (D), and use S3 Batch Operations to replicate existing objects (F). AWS Batch and CLI synchronization are unnecessary and less operationally efficient.
Question 212
A company operates sensitive workloads across the AWS accounts that are in the company's organization in AWS Organizations. The company uses an IP address range to delegate IP addresses for Amazon VPC CIDR blocks and all non-cloud hardware.
The company needs a solution that prevents principals that are outside the company’s IP address range from performing AWS actions in the organization's accounts.
Which solution will meet these requirements?
A. Configure AWS Firewall Manager for the organization. Create an AWS Network Firewall policy that allows only source traffic from the company's IP address range. Set the policy scope to all accounts in the organization.
B. In Organizations, create an SCP that denies source IP addresses that are outside of the company’s IP address range. Attach the SCP to the organization's root.
C. Configure Amazon GuardDuty for the organization. Create a GuardDuty trusted IP address list for the company's IP range. Activate the trusted IP list for the organization.
D. In Organizations, create an SCP that allows source IP addresses that are inside of the company’s IP address range. Attach the SCP to the organization's root.
Show Answer
Correct Answer: B
Explanation: A Service Control Policy (SCP) can enforce organization-wide permission guardrails. An SCP with a Deny statement using the aws:SourceIp condition key to deny requests originating outside the company's IP address range, attached to the organization root, prevents principals in member accounts from performing AWS actions from unauthorized source IPs. Firewall Manager/Network Firewall controls network traffic rather than AWS API authorization, GuardDuty trusted IP lists only affect findings, and an Allow SCP does not effectively restrict access because SCPs define maximum permissions and typically require explicit deny guardrails for this use case.
Question 213
A company releases a new application in a new AWS account. The application includes an AWS Lambda function that processes messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The Lambda function stores the results in an Amazon S3 bucket for further downstream processing. The Lambda function needs to process the messages within a specific period of time after the messages are published. The Lambda function has a batch size of 10 messages and takes a few seconds to process a batch of messages.
As load increases on the application's first day of service, messages in the queue accumulate at a greater rate than the Lambda function can process the messages. Some messages miss the required processing timelines. The logs show that many messages in the queue have data that is not valid. The company needs to meet the timeline requirements for messages that have valid data.
Which solution will meet these requirements?
A. Increase the Lambda function's batch size. Change the SQS standard queue to an SQS FIFO queue. Request a Lambda concurrency increase in the AWS Region.
B. Reduce the Lambda function's batch size. Increase the SQS message throughput quota. Request a Lambda concurrency increase in the AWS Region.
C. Increase the Lambda function's batch size. Configure S3 Transfer Acceleration on the S3 bucket. Configure an SQS dead-letter queue.
D. Keep the Lambda function's batch size the same. Configure the Lambda function to report failed batch items. Configure an SQS dead-letter queue.
Show Answer
Correct Answer: D
Explanation: When Lambda processes SQS batches, a single invalid message can cause the entire batch to be retried unless partial batch responses are enabled. Configuring the function to report failed batch items allows successfully processed messages to be removed from the queue while only invalid messages are retried. Adding an SQS dead-letter queue prevents poison messages from repeatedly blocking progress and avoids the snowball anti-pattern. Increasing batch size or switching to FIFO does not address invalid messages causing repeated retries, and FIFO would reduce parallelism.
Question 214
A company has an AWS CloudFormation stack that is deployed in a single AWS account. The company has configured the stack to send event notifications to an Amazon Simple Notification Service (Amazon SNS) topic.
A DevOps engineer must implement an automated solution that applies a tag to the specific CloudFormation stack instance only after a successful stack update occurs. The DevOps engineer has created an AWS Lambda function that applies and updates this tag for the specific stack instance.
Which solution will meet these requirements?
A. Run the AWS-UpdateCloudFormationStack AWS Systems ManagerAutomation runbook when Systems Manager detects an UPDATE_COMPLETE event for the instance status of the CloudFormation stack. Configure the runbook to invoke the Lambda function.
B. Create a custom AWS Config rule that produces a compliance change event if the CloudFormation stack has an UPDATE_COMPLETE instance status. Configure AWS Config to directly invoke the Lambda function to automatically remediate the change event.
C. Create an Amazon EventBridge rule that matches the UPDATE_COMPLETE event pattern for the instance status of the CloudFormation stack. Configure the rule to invoke the Lambda function.
D. Adjust the configuration of the CloudFormation stack to send notifications for only an UPDATE_COMPLETE instance status event to the SNS topic. Subscribe the Lambda function to the SNS topic.
Show Answer
Correct Answer: C
Explanation: Amazon EventBridge can match AWS CloudFormation stack status change events such as UPDATE_COMPLETE and invoke the Lambda function automatically. This provides an event-driven solution that triggers only after a successful stack update. Systems Manager Automation and AWS Config are not designed for this event flow, and CloudFormation SNS notifications cannot be filtered to publish only UPDATE_COMPLETE events at the source.
Question 215
A company manages multiple AWS accounts by using AWS Organizations with OUs for the different business divisions. The company is updating their corporate network to use new IP address ranges. The company has 10 Amazon S3 buckets in different AWS accounts. The S3 buckets store reports for the different divisions. The S3 bucket configurations allow only private corporate network IP addresses to access the S3 buckets.
A DevOps engineer needs to change the range of IP addresses that have permission to access the contents of the S3 buckets. The DevOps engineer also needs to revoke the permissions of two OUs in the company.
Which solution will meet these requirements?
A. Create a new SCP that has two statements, one that allows access to the new range of IP addresses for all the S3 buckets and one that denies access to the old range of IP addresses for all the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
B. Create a new SCP that has a statement that allows only the new range of IP addresses to access the S3 buckets. Create another SCP that denies access to the S3 buckets. Attach the second SCP to the two OUs.
C. On all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Create a new SCP that denies access to the S3 buckets. Attach the SCP to the two OUs.
D. On all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
Show Answer
Correct Answer: C
Explanation: S3 bucket access based on source IP is enforced with S3 resource-based bucket policies, not SCPs. SCPs do not grant access or filter requests by source IP; they define the maximum permissions for principals in member accounts. To update the allowed corporate IP range, modify each bucket policy to allow only the new IP ranges. To revoke S3 access for two OUs, attach an SCP that explicitly denies access to Amazon S3 for those OUs. Permissions boundaries apply only to specific IAM principals and are not the appropriate organization-wide control.
Question 216
A company has started using AWS across several teams. Each team has multiple accounts and unique security profiles. The company manages the accounts in an organization in AWS Organizations. Each account has its own configuration and security controls.
The company's DevOps team wants to use preventive and detective controls to govern all accounts. The DevOps team needs to ensure the security of accounts now and in the future as the company creates new accounts in the organization.
Which solution will meet these requirements?
A. Use Organizations to create OUs that have appropriate SCPs attached for each team. Place team accounts in the appropriate OUs to apply security controls. Create any new team accounts in the appropriate OUs.
B. Create an AWS Control Tower landing zone. Configure OUs and appropriate controls in AWS Control Tower for the existing teams. Configure trusted access for AWS Control Tower. Enroll the existing accounts in the appropriate OUs that match the appropriate security policies for each team. Use AWS Control Tower to provision any new accounts.
C. Create AWS CloudFormation stack sets in the organization's management account. Configure a stack set that deploys AWS Config with configuration rules and remediation actions for all controls to each account in the organization. Update the stack sets to deploy to new accounts as the accounts are created.
D. Configure AWS Config to manage the AWS Config rules across all AWS accounts in the organization. Deploy conformance packs that provide AWS Config rules and remediation actions across the organization.
Show Answer
Correct Answer: B
Explanation: AWS Control Tower is designed to provide organization-wide governance with both preventive and detective controls. It supports existing AWS Organizations, allows enrolling existing accounts into OUs with appropriate controls, and provisions new accounts so governance is automatically applied in the future. SCPs alone provide only preventive controls, while AWS Config and conformance packs provide detective/compliance capabilities but not the full preventive governance and account lifecycle management required.
Question 217
A company has an application that runs on AWS Lambda and sends logs to Amazon CloudWatch Logs. An Amazon Kinesis data stream is subscribed to the log groups in CloudWatch Logs. A single consumer Lambda function processes the logs from the data stream and stores the logs in an Amazon S3 bucket.
The company’s DevOps team has noticed high latency during the processing and ingestion of some logs.
Which combination of steps will reduce the latency? (Choose three.)
A. Create a data stream consumer with enhanced fan-out. Set the Lambda function that processes the logs as the consumer.
B. Increase the ParallelizationFactor setting in the Lambda event source mapping.
C. Configure reserved concurrency for the Lambda function that processes the logs.
D. Increase the batch size in the Kinesis data stream.
E. Turn off the ReportBatchItemFailures setting in the Lambda event source mapping.
F. Increase the number of shards in the Kinesis data stream.
Show Answer
Correct Answer: A, B, F
Explanation: Enhanced fan-out gives the Lambda consumer dedicated read throughput from Kinesis, reducing read latency. Increasing the ParallelizationFactor allows Lambda to process multiple batches concurrently per shard, improving throughput and reducing backlog. Increasing the number of shards increases the stream's read/write capacity and enables greater parallel processing. Reserved concurrency only guarantees available concurrency and does not increase shard-level parallelism by itself. Increasing batch size can increase per-record latency because Lambda waits to accumulate larger batches. Disabling ReportBatchItemFailures does not reduce ingestion latency and can worsen retries.
Question 218
A cloud team uses AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On) to manage a company's AWS accounts. The company recently established a research team. The research team requires the ability to fully manage the resources in its account. The research team must not be able to create IAM users.
The cloud team creates a Research Administrator permission set in IAM Identity Center for the research team. The permission set has the AdministratorAccess AWS managed policy attached. The cloud team must ensure that no one on the research team can create IAM users.
Which solution will meet these requirements?
A. Create an IAM policy that denies the iam:CreateUser action. Attach the IAM policy to the Research Administrator permission set.
B. Create an IAM policy that allows all actions except the iam:CreateUser action. Use the IAM policy to set the permissions boundary for the Research Administrator permission set.
C. Create an SCP that denies the iam:CreateUser action. Attach the SCP to the research team's AWS account.
D. Create an AWS Lambda function that deletes IAM users. Create an Amazon EventBridge rule that detects the IAM CreateUser event. Configure the rule to invoke the Lambda function.
Show Answer
Correct Answer: A
Explanation: IAM Identity Center permission sets create IAM roles. Adding an explicit deny for iam:CreateUser to the Research Administrator permission set overrides the attached AdministratorAccess for those roles only, preventing the research team from creating IAM users while still allowing full administration otherwise. An SCP attached to the account would deny iam:CreateUser for all principals in that account, not just the research team. Permissions boundaries do not work as an 'allow everything except' mechanism in this way, and an event-driven cleanup does not prevent user creation.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.