A company has an AWS CloudFormation stack that is deployed in a single AWS account. The company has configured the stack to send event notifications to an Amazon Simple Notification Service (Amazon SNS) topic.
A DevOps engineer must implement an automated solution that applies a tag to the specific CloudFormation stack instance only after a successful stack update occurs. The DevOps engineer has created an AWS Lambda function that applies and updates this tag for the specific stack instance.
Which solution will meet these requirements?
A. Run the AWS-UpdateCloudFormationStack AWS Systems ManagerAutomation runbook when Systems Manager detects an UPDATE_COMPLETE event for the instance status of the CloudFormation stack. Configure the runbook to invoke the Lambda function.
B. Create a custom AWS Config rule that produces a compliance change event if the CloudFormation stack has an UPDATE_COMPLETE instance status. Configure AWS Config to directly invoke the Lambda function to automatically remediate the change event.
C. Create an Amazon EventBridge rule that matches the UPDATE_COMPLETE event pattern for the instance status of the CloudFormation stack. Configure the rule to invoke the Lambda function.
D. Adjust the configuration of the CloudFormation stack to send notifications for only an UPDATE_COMPLETE instance status event to the SNS topic. Subscribe the Lambda function to the SNS topic.
Show Answer
Correct Answer: C
Explanation: Amazon EventBridge can match AWS CloudFormation stack status change events such as UPDATE_COMPLETE and invoke the Lambda function automatically. This provides an event-driven solution that triggers only after a successful stack update. Systems Manager Automation and AWS Config are not designed for this event flow, and CloudFormation SNS notifications cannot be filtered to publish only UPDATE_COMPLETE events at the source.
Question 215
A company manages multiple AWS accounts by using AWS Organizations with OUs for the different business divisions. The company is updating their corporate network to use new IP address ranges. The company has 10 Amazon S3 buckets in different AWS accounts. The S3 buckets store reports for the different divisions. The S3 bucket configurations allow only private corporate network IP addresses to access the S3 buckets.
A DevOps engineer needs to change the range of IP addresses that have permission to access the contents of the S3 buckets. The DevOps engineer also needs to revoke the permissions of two OUs in the company.
Which solution will meet these requirements?
A. Create a new SCP that has two statements, one that allows access to the new range of IP addresses for all the S3 buckets and one that denies access to the old range of IP addresses for all the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
B. Create a new SCP that has a statement that allows only the new range of IP addresses to access the S3 buckets. Create another SCP that denies access to the S3 buckets. Attach the second SCP to the two OUs.
C. On all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Create a new SCP that denies access to the S3 buckets. Attach the SCP to the two OUs.
D. On all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
Show Answer
Correct Answer: C
Explanation: S3 bucket access based on source IP is enforced with S3 resource-based bucket policies, not SCPs. SCPs do not grant access or filter requests by source IP; they define the maximum permissions for principals in member accounts. To update the allowed corporate IP range, modify each bucket policy to allow only the new IP ranges. To revoke S3 access for two OUs, attach an SCP that explicitly denies access to Amazon S3 for those OUs. Permissions boundaries apply only to specific IAM principals and are not the appropriate organization-wide control.
Question 216
A company has started using AWS across several teams. Each team has multiple accounts and unique security profiles. The company manages the accounts in an organization in AWS Organizations. Each account has its own configuration and security controls.
The company's DevOps team wants to use preventive and detective controls to govern all accounts. The DevOps team needs to ensure the security of accounts now and in the future as the company creates new accounts in the organization.
Which solution will meet these requirements?
A. Use Organizations to create OUs that have appropriate SCPs attached for each team. Place team accounts in the appropriate OUs to apply security controls. Create any new team accounts in the appropriate OUs.
B. Create an AWS Control Tower landing zone. Configure OUs and appropriate controls in AWS Control Tower for the existing teams. Configure trusted access for AWS Control Tower. Enroll the existing accounts in the appropriate OUs that match the appropriate security policies for each team. Use AWS Control Tower to provision any new accounts.
C. Create AWS CloudFormation stack sets in the organization's management account. Configure a stack set that deploys AWS Config with configuration rules and remediation actions for all controls to each account in the organization. Update the stack sets to deploy to new accounts as the accounts are created.
D. Configure AWS Config to manage the AWS Config rules across all AWS accounts in the organization. Deploy conformance packs that provide AWS Config rules and remediation actions across the organization.
Show Answer
Correct Answer: B
Explanation: AWS Control Tower is designed to provide organization-wide governance with both preventive and detective controls. It supports existing AWS Organizations, allows enrolling existing accounts into OUs with appropriate controls, and provisions new accounts so governance is automatically applied in the future. SCPs alone provide only preventive controls, while AWS Config and conformance packs provide detective/compliance capabilities but not the full preventive governance and account lifecycle management required.
Question 217
A company has an application that runs on AWS Lambda and sends logs to Amazon CloudWatch Logs. An Amazon Kinesis data stream is subscribed to the log groups in CloudWatch Logs. A single consumer Lambda function processes the logs from the data stream and stores the logs in an Amazon S3 bucket.
The company’s DevOps team has noticed high latency during the processing and ingestion of some logs.
Which combination of steps will reduce the latency? (Choose three.)
A. Create a data stream consumer with enhanced fan-out. Set the Lambda function that processes the logs as the consumer.
B. Increase the ParallelizationFactor setting in the Lambda event source mapping.
C. Configure reserved concurrency for the Lambda function that processes the logs.
D. Increase the batch size in the Kinesis data stream.
E. Turn off the ReportBatchItemFailures setting in the Lambda event source mapping.
F. Increase the number of shards in the Kinesis data stream.
Show Answer
Correct Answer: A, B, F
Explanation: Enhanced fan-out gives the Lambda consumer dedicated read throughput from Kinesis, reducing read latency. Increasing the ParallelizationFactor allows Lambda to process multiple batches concurrently per shard, improving throughput and reducing backlog. Increasing the number of shards increases the stream's read/write capacity and enables greater parallel processing. Reserved concurrency only guarantees available concurrency and does not increase shard-level parallelism by itself. Increasing batch size can increase per-record latency because Lambda waits to accumulate larger batches. Disabling ReportBatchItemFailures does not reduce ingestion latency and can worsen retries.
Question 218
A cloud team uses AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On) to manage a company's AWS accounts. The company recently established a research team. The research team requires the ability to fully manage the resources in its account. The research team must not be able to create IAM users.
The cloud team creates a Research Administrator permission set in IAM Identity Center for the research team. The permission set has the AdministratorAccess AWS managed policy attached. The cloud team must ensure that no one on the research team can create IAM users.
Which solution will meet these requirements?
A. Create an IAM policy that denies the iam:CreateUser action. Attach the IAM policy to the Research Administrator permission set.
B. Create an IAM policy that allows all actions except the iam:CreateUser action. Use the IAM policy to set the permissions boundary for the Research Administrator permission set.
C. Create an SCP that denies the iam:CreateUser action. Attach the SCP to the research team's AWS account.
D. Create an AWS Lambda function that deletes IAM users. Create an Amazon EventBridge rule that detects the IAM CreateUser event. Configure the rule to invoke the Lambda function.
Show Answer
Correct Answer: A
Explanation: IAM Identity Center permission sets create IAM roles. Adding an explicit deny for iam:CreateUser to the Research Administrator permission set overrides the attached AdministratorAccess for those roles only, preventing the research team from creating IAM users while still allowing full administration otherwise. An SCP attached to the account would deny iam:CreateUser for all principals in that account, not just the research team. Permissions boundaries do not work as an 'allow everything except' mechanism in this way, and an event-driven cleanup does not prevent user creation.
Question 219
A company needs to implement failover for its application. The application includes an Amazon CloudFront distribution and a public Application Load Balancer (ALB) in an AWS Region. The company has configured the ALB as the default origin for the distribution.
After some recent application outages, the company wants a zero-second RTO. The company deploys the application to a secondary Region in a warm standby configuration. A DevOps engineer needs to automate the failover of the application to the secondary Region so that HTTP GET requests meet the desired RTO.
Which solution will meet these requirements?
A. Create a second CloudFront distribution that has the secondary ALB as the default origin. Create Amazon Route 53 alias records that have a failover policy and Evaluate Target Health set to Yes for both CloudFront distributions. Update the application to use the new record set.
B. Create a new origin on the distribution for the secondary ALCreate a new origin group. Set the original ALB as the primary origin. Configure the origin group to fail over for HTTP 5xx status codes. Update the default behavior to use the origin group.
C. Create Amazon Route 53 alias records that have a failover policy and Evaluate Target Health set to Yes for both ALBs. Set the TTL of both records to 0. Update the distribution's origin to use the new record set.
D. Create a CloudFront function that detects HTTP 5xx status codes. Configure the function to return a 307 Temporary Redirect error response to the secondary ALB if the function detects 5xx status codes. Update the distribution's default behavior to send origin responses to the function.
Show Answer
Correct Answer: B
Explanation: CloudFront origin failover (origin groups) is designed for this scenario. Configure the existing primary ALB and the secondary Region ALB as an origin group, with the primary as the main origin and the secondary as the failover origin. Set failover on HTTP 5xx responses (and optionally other supported conditions). CloudFront performs per-request origin failover without DNS propagation delays, enabling effectively immediate failover for eligible HTTP methods such as GET, matching the zero-second RTO requirement. The other options rely on Route 53 DNS failover, which is subject to DNS caching, or use unsupported CloudFront Function behavior for origin-response failover.
Question 220
A company deploys an application to two AWS Regions. The application creates and stores objects in an Amazon S3 bucket that is in the same Region as the application. Both deployments of the application need to have access to all the objects and their metadata from both Regions. The company has configured two-way replication between the S3 buckets and has enabled S3 Replication metrics on each S3 bucket.
A DevOps engineer needs to implement a solution that retries the replication process if an object fails to replicate.
Which solution will meet these requirements?
A. Create an Amazon EventBridge rule that listens to S3 event notifications for failed replication events. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket. Configure the EventBridge rule to invoke the Lambda function to handle the object that failed to replicate.
B. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure S3 event notifications to send failed replication notifications to the SQS queue. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket. Configure the Lambda function to poll the queue for notifications to process.
C. Create an Amazon EventBridge rule that listens to S3 event notifications for failed replications. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket.
D. Create an AWS Lambda function that will use S3 batch operations to retry the replication on the existing object for a failed replication. Configure S3 event notifications to send failed replication notifications to the Lambda function.
Show Answer
Correct Answer: D
Explanation: Amazon S3 Batch Replication (via S3 Batch Operations) is the AWS-supported mechanism to retry replication for objects that failed replication. It is specifically designed to replicate existing objects, previously replicated objects, and objects whose replication failed. The event notification can trigger a Lambda function to initiate the appropriate batch replication retry workflow. The alternatives that manually download and re-upload objects bypass native replication behavior and metadata handling.
Question 221
A DevOps engineer is building an application that uses an AWS Lambda function to query an Amazon Aurora MySQL DB cluster. The Lambda function performs only read queries. Amazon EventBridge events invoke the Lambda function.
As more events invoke the Lambda function each second, the database's latency increases and the database's throughput decreases. The DevOps engineer needs to improve the performance of the application.
Which combination of steps will meet these requirements? (Choose three.)
A. Use Amazon RDS Proxy to create a proxy. Connect the proxy to the Aurora cluster reader endpoint. Set a maximum connections percentage on the proxy.
B. Implement database connection pooling inside the Lambda code. Set a maximum number of connections on the database connection pool.
C. Implement the database connection opening outside the Lambda event handler code.
D. Implement the database connection opening and closing inside the Lambda event handler code.
E. Connect to the proxy endpoint from the Lambda function.
F. Connect to the Aurora cluster endpoint from the Lambda function.
Show Answer
Correct Answer: A, C, E
Explanation: Use Amazon RDS Proxy in front of the Aurora reader endpoint to pool and manage database connections and protect the database from connection storms. The Lambda function should connect to the RDS Proxy endpoint rather than directly to Aurora. In Lambda, initialize the database connection outside the handler so execution environment reuse can reuse existing connections across warm invocations, reducing connection setup overhead. Implementing custom pooling inside Lambda is not recommended compared with RDS Proxy, and opening/closing a connection on every invocation adds overhead.
Question 222
A company has a fleet of Amazon EC2 instances that run Linux in a single AWS account. The company is using an AWS Systems Manager Automation task across the EC2 instances.
During the most recent patch cycle, several EC2 instances went into an error state because of insufficient available disk space. A DevOps engineer needs to ensure that the EC2 instances have sufficient available disk space during the patching process in the future.
Which combination of steps will meet these requirements? (Choose two.)
A. Ensure that the Amazon CloudWatch agent is installed on all EC2 instances.
B. Create a cron job that is installed on each EC2 instance to periodically delete temporary files.
C. Create an Amazon CloudWatch log group for the EC2 instances. Configure a cron job that is installed on each EC2 instance to write the available disk space to a CloudWatch log stream for the relevant EC2 instance.
D. Create an Amazon CloudWatch alarm to monitor available disk space on all EC2 instances. Add the alarm as a safety control to the Systems Manager Automation task.
E. Create an AWS Lambda function to periodically check for sufficient available disk space on all EC2 instances by evaluating each EC2 instance's respective Amazon CloudWatch log stream.
Show Answer
Correct Answer: A, D
Explanation: Install the Amazon CloudWatch agent so each Linux EC2 instance publishes disk space metrics to CloudWatch. Then create CloudWatch alarms on available disk space and use those alarms as Systems Manager Automation safety controls so patching is blocked when disk space is insufficient. Cron jobs and Lambda-based log parsing are unnecessary because CloudWatch agent natively publishes disk metrics.
Question 223
A company uses AWS Control Tower and AWS CloudFormation to manage its AWS accounts and to create AWS resources. The company requires all Amazon S3 buckets to be encrypted with AWS Key Management Service (AWS KMS) when the S3 buckets are created in a CloudFormation stack.
Which solution will meet this requirement?
A. Use AWS Organizations. Attach an SCP that denies the s3:PutObject permission if the request does not include an x-amz-server-side-encryption header that requests server-side encryption with AWS KMS keys (SSE-KMS).
B. Use AWS Control Tower with a multi-account environment. Configure and enable proactive AWS Control Tower controls on all OUs with CloudFormation hooks.
C. Use AWS Control Tower with a multi-account environment. Configure and enable detective AWS Control Tower controls on all OUs with CloudFormation hooks.
D. Use AWS Organizations. Create an AWS Config organizational rule to check whether a KMS encryption key is enabled for all S3 buckets. Deploy the rule. Create and apply an SCP to prevent users from stopping and deleting AWS Config across all AWS accounts,
Show Answer
Correct Answer: B
Explanation: AWS Control Tower proactive controls with CloudFormation hooks evaluate CloudFormation templates before resources are created and prevent noncompliant deployments. There is a built-in proactive control requiring S3 buckets to use AWS KMS server-side encryption. SCPs on s3:PutObject do not enforce bucket default encryption at creation, detective controls only identify drift after creation, and AWS Config is reactive rather than preventing noncompliant stack creation.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.