A company has a web application that is hosted on Amazon EC2 instances. The company is deploying the application into multiple AWS Regions.
The application consists of dynamic content such as WebSocket-based real-time product updates. The company uses Amazon Route 53 to manage all DNS records.
Which solution will provide multi-Region access to the application with the LEAST latency?
A. Deploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Create a Route 53 A record with a latency-based routing policy. Add IP addresses of the ALBs as the value of the record.
B. Deploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Deploy an Amazon CloudFront distribution with an origin group that contains the ALBs as origins. Create a Route 53 alias record that points to the CloudFront distribution's DNS address.
C. Deploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Create a Route 53 A record with a multivalue answer routing policy. Add IP addresses of the NLBs as the value of the record.
D. Deploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Deploy an AWS Global Accelerator standard accelerator with an endpoint group for each NLB. Create a Route 53 alias record that points to the accelerator's DNS address.
Show Answer
Correct Answer: D
Explanation: AWS Global Accelerator provides the lowest latency for multi-Region, real-time applications by routing user traffic onto the AWS global network at the nearest edge location and directing it to the optimal Regional endpoint. It is well-suited for TCP/WebSocket traffic and integrates natively with Network Load Balancers. Route 53 aliasing to the accelerator gives a single stable DNS name with optimal performance.
Question 11
A company runs an application on an Amazon Elastic Container Service (Amazon ECS) service by using the AWS Fargate launch type. The application consumes messages from an Amazon Simple Queue Service (Amazon SQS) queue. The application can take several minutes to process each message from the queue. When the application processes a message, the application reads a file from an Amazon S3 bucket and processes the data in the file. The application writes the processed output to a second S3 bucket. The company uses Amazon CloudWatch Logs to monitor processing errors and to ensure that the application processes messages successfully.
The SQS queue typically receives a low volume of messages. However, occasionally the queue receives higher volumes of messages. A DevOps engineer needs to implement a solution to reduce the processing time of message bursts.
Which solution will meet this requirement in the MOST cost-effective way?
A. Register the ECS service as a scalable target in AWS Application Auto Scaling. Configure a target tracking scaling policy to scale the service in response to the queue size.
B. Increase the maximum number of messages that Amazon SQS requests to batch messages together. Use long polling to minimize the number of API calls to Amazon SQS during periods of low traffic.
C. Send messages to an Amazon EventBridge event bus instead of the SQS queue. Replace the ECS service with an EventBridge rule that launches ECS tasks in response to matching events.
D. Create an Auto Scaling group of EC2 instances. Create a capacity provider in the ECS cluster by using the Auto Scaling group. Change the ECS service to use the EC2 launch type.
Show Answer
Correct Answer: A
Explanation: Scaling the ECS service on AWS Fargate based on SQS queue depth directly increases concurrent message processing during bursts while scaling back down during low volume, which minimizes cost. Target tracking with Application Auto Scaling is purpose-built for this pattern. The other options either do not reduce processing time (batching/long polling), add unnecessary architectural complexity, or introduce EC2 management overhead that is less cost-effective than Fargate for sporadic bursts.
Question 12
A company uses Amazon API Gateway and AWS Lambda functions to implement an API. The company uses a pipeline in AWS CodePipeline to build and deploy the API. The pipeline contains a source stage, build stage, and deployment stage.
The company deploys the API without performing smoke tests. Soon after the deployment, the company observes multiple issues with the API. A security audit finds security vulnerabilities in the production code.
The company wants to prevent these issues from happening in the future.
Which combination of steps will meet this requirement? (Choose two.)
A. Create a smoke test script that returns an error code if the API code fails the test. Add an action in the deployment stage to run the smoke test script after deployment. Configure the deployment stage for automatic rollback.
B. Create a smoke test script that returns an error code if the API code fails the test. Add an action in the deployment stage to run the smoke test script after deployment. Configure the deployment stage to fail if the smoke test script returns an error code.
C. Add an action in the build stage that uses Amazon Inspector to scan the Lambda function code after the code is built. Configure the build stage to fail if the scan returns any security findings.
D. Add an action in the build stage to run an Amazon CodeGuru code scan after the code is built. Configure the build stage to fail if the scan returns any security findings.
E. Add an action in the deployment stage to run an Amazon CodeGuru code scan after deployment. Configure the deployment stage to fail if the scan returns any security findings.
Show Answer
Correct Answer: B, D
Explanation: The company needs both functional validation after deployment and proactive security analysis before deployment.
B adds automated smoke tests in the deployment stage and fails the pipeline if the API is not functioning correctly, preventing broken deployments from being promoted.
D adds Amazon CodeGuru Reviewer in the build stage to analyze the code for security vulnerabilities and quality issues, failing the build before insecure code reaches production.
Together, these steps prevent both functional failures and security vulnerabilities from appearing in production.
Question 12
A global company uses Amazon S3 to host its product catalog website in the us-east-1 Region. The company must improve website performance for users across different geographical regions and must reduce the load on the origin server. The company must implement a highly available cross-Region solution that uses Amazon CloudFront.
Which solution will meet these requirements with the LEAST operational effort?
A. Set up multiple CloudFront distributions. Point each distribution to another S3 bucket in a different Region. Use Amazon Route 53 latency-based routing to direct users to the nearest distribution. Enable S3 replication between the S3 bucket in us-east-1 and the S3 bucket in the different Region.
B. Enable CloudFront with Origin Shield in us-east-1. Configure global edge locations. Set up cache behaviors with optimal TTLs for static content and dynamic content. Configure origin failover to an S3 bucket in a different Region. Enable S3 replication between the S3 bucket in us-east-1 and the S3 bucket in the different Region.
C. Enable CloudFront with Origin Shield in us-east-1. Configure Amazon ElastiCache clusters in multiple Regions to serve as a distributed caching layer between CloudFront and the S3 origin. Set up a replication script to synchronize the S3 bucket in us-east-1 to an S3 bucket in a different Region. Use Amazon EventBridge to schedule the script to run once a day.
D. Enable CloudFront with Origin Shield in the eu-west-1 Region. Configure Regional edge caches. Implement AWS Global Accelerator to route requests to the nearest Regional edge location. Enable S3 replication between the S3 bucket in us-east-1 and an S3 bucket in a different Region.
Show Answer
Correct Answer: B
Explanation: A single global CloudFront distribution already provides worldwide edge locations to improve performance and reduce origin load. Enabling Origin Shield adds a centralized caching layer that further protects the S3 origin and improves cache hit ratios. Using S3 cross-Region replication with CloudFront origin failover provides high availability across Regions. This design avoids multiple distributions, custom routing, extra services, or scripts, resulting in the least operational effort.
Question 13
A DevOps engineer is creating a CI/CD pipeline to build container images. The engineer needs to store container images in Amazon Elastic Container Registry (Amazon ECR) and scan the images for common vulnerabilities. The CI/CD pipeline must be resilient to outages in upstream source container image repositories.
Which solution will meet these requirements?
A. Create an ECR private repository in the private registry to store the container images and scan images when images are pushed to the repository. Configure a replication rule in the private registry to replicate images from upstream repositories.
B. Create an ECR public repository in the public registry to cache images from upstream source repositories. Create an ECR private repository to store images. Configure the private repository to scan images when images are pushed to the repository.
C. Create an ECR public repository in the public registry. Configure a pull through cache rule for the repository. Create an ECR private repository to store images. Configure the ECR private registry to perform basic scanning.
D. Create an ECR private repository in the private registry to store the container images. Enable basic scanning for the private registry, and create a pull through cache rule.
Show Answer
Correct Answer: D
Explanation: The requirement to be resilient to outages in upstream image repositories is met by using an ECR pull-through cache rule, which caches images from public registries locally in Amazon ECR. Storing images in an ECR private repository satisfies the storage requirement, and enabling basic scanning provides vulnerability scanning for images. Other options either misuse replication or public repositories, or separate caching and scanning in unsupported ways.
Question 13
A company has a stateless web application that is deployed on Amazon EC2 instances. The EC2 instances are in a target group behind an Application Load Balancer (ALB). Amazon Route 53 manages the application domain.
The company updates the application UI and develops a beta version of the application. The company wants to test the beta version on 10% of its traffic.
Which solution will meet these requirements with the LEAST number of configuration changes?
A. Deploy the beta version to new EC2 instances in a new target group. Associate the new target group with a new ALB. Update the existing Route 53 record to use a weighted routing policy. Add a new Route 53 record that points to the new ALB with the same routing policy. Assign a weight of 90 to the existing record. Assign a weight of 10 to the new record.
B. Deploy the beta version to new EC2 instances in a new target group. Associate the new target group with the same ALB listener rule. Assign a weight of 90 to the existing target group. Assign a weight of 10 to the new target group.
C. Refactor the application to implement a feature flag for the beta version by using AWS AppConfig. Use the feature flag to enable the beta version for 10% of the EC2 instances.
D. Containerize and deploy the application on Amazon Elastic Container Service (Amazon ECS). Use AWS CodeDeploy to deploy the beta version by using the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.
Show Answer
Correct Answer: B
Explanation: An Application Load Balancer supports weighted target groups within a single listener rule. By deploying the beta version to a new target group and assigning weights of 90/10 between the existing and beta target groups, the company can shift 10% of traffic to the beta with minimal changes. This avoids creating a new ALB, changing Route 53 records, refactoring the application, or migrating to containers, making it the least-configuration-change solution.
Question 14
A company is implementing a standardized security baseline across its AWS accounts. The accounts are in an organization in AWS Organizations.
The company must deploy consistent IAM roles and policies across all existing and future accounts in the organization.
Which solution will meet these requirements with the MOST operational efficiency?
A. Enable AWS Control Tower in the management account. Configure AWS Control Tower Account Factory customization to deploy the required IAM roles and policies to all accounts.
B. Activate trusted access for AWS CloudFormation StackSets in Organizations. In the management account, create a stack set that has service-managed permissions to deploy the required IAM roles and policies to all accounts. Enable automatic deployment for the stack set.
C. In each member account, create IAM roles that have permissions to create and manage resources. In the management account, create an AWS CloudFormation stack set that has self-managed permissions to deploy the required IAM roles and policies to all accounts. Enable automatic deployment for the stack set.
D. In the management account, create an AWS CodePipeline pipeline. Configure the pipeline to use AWS CloudFormation to automate the deployment of the required IAM roles and policies. Set up cross-account IAM roles to allow CodePipeline to deploy resources in the member accounts.
Show Answer
Correct Answer: B
Explanation: AWS CloudFormation StackSets with service-managed permissions integrate directly with AWS Organizations, allowing centralized deployment of IAM roles and policies from the management account. Enabling automatic deployment ensures the baseline is applied to all existing accounts and any new accounts added to the organization without managing cross-account roles, providing the highest operational efficiency.
Question 14
A company frequently creates Docker images of an application. The company stores the images in Amazon Elastic Container Registry (Amazon ECR). The company creates both tagged images and untagged images.
The company wants to implement a solution to automatically delete images that have not been updated for a long time and are not frequently used. The solution must retain at least a specified number of images.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon S3 Lifecycle policies on the ECR repository to automatically delete images based on image age or the absence of tags on the image.
B. Use Amazon ECR lifecycle policies to delete images based on age or the number of images that need to be to retained in the repository.
C. Configure an AWS Lambda function to run a schedule to delete images based on age or the number of images that need to be retained in the repository.
D. Use AWS Systems Manager to run a script by using the aws:executeScript action to automatically delete images based on image age or the absence of tags on the image.
Show Answer
Correct Answer: B
Explanation: Amazon ECR lifecycle policies are a native, fully managed feature that can automatically expire images based on age, tag status, or a retention count. This directly satisfies the requirement to delete old or infrequently used images while retaining a minimum number of images, with minimal operational overhead. The other options require custom scripting or additional services, increasing maintenance and complexity.
Question 15
A company is implementing a CI/CD pipeline for an application by using AWS CodePipeline and AWS CodeBuild. The company needs a solution to run unit tests and automatically generate code coverage reports before any code is deployed to production. The CI/CD pipeline execution must fail if the code coverage is less than 80%.
Which solution will meet these requirements?
A. Create an AWS Lambda function to run unit tests and generate code coverage reports. Add a Lambda invoke action to a stage in the CodePipeline pipeline. Create an Amazon EventBridge scheduled rule to run hourly to monitor the Lambda function's output. Configure the rule to fail the pipeline if coverage is less than 80%.
B. Create an AWS Step Functions workflow to run unit tests and generate code coverage reports. Add a Step Functions test action to a stage in the CodePipeline pipeline to invoke the workflow. Configure the workflow to fail if the code coverage is less than 80%.
C. Create a CodeBuild project with a buildspec.yml file that includes commands to run unit tests and generate code coverage reports. Add a CodeBuild test action to a stage in the CodePipeline pipeline. Configure the CodeBuild test action to use the source artifacts from the source action as input. Modify the buildspec.yml file to fail the build if coverage is less than 80%.
D. Create a CodeBuild project with Jenkins installed. Configure Jenkins to run unit tests and generate code coverage reports. Add a Jenkins test action to a stage in the CodePipeline pipeline. Configure the Jenkins test action to output the coverage report as an output artifact. Configure an approval action to fail the pipeline if code coverage is less than 80%.
Show Answer
Correct Answer: C
Explanation: AWS CodeBuild is purpose-built to run builds and tests as part of CodePipeline. By defining unit test execution and code coverage generation in buildspec.yml, the build can explicitly fail when coverage is below 80%. When the CodeBuild test action fails, CodePipeline automatically stops and prevents deployment to production, fully meeting the requirements without additional services.
Question 15
A company is developing a web application that runs on Amazon EC2 Linux instances. The application requires monitoring of custom performance metrics. The company must collect metrics for API response times and database query latency across multiple instances.
Which solution will generate the custom metrics with the LEAST operational overhead?
A. Install the Amazon CloudWatch agent on the instances. Configure the agent to collect the custom metrics. Instrument the application to send the metrics to the agent.
B. Use Amazon Managed Service for Prometheus to scrape the custom metrics from the application. Use the Amazon CloudWatch agent to forward the metrics to CloudWatch.
C. Create a custom AWS Lambda function that polls the application endpoints and database at regular intervals. Program the Lambda function to calculate the custom metrics and to send the metrics to Amazon CloudWatch by using PutMetricData API calls.
D. Implement custom logging in the application code to record the custom metrics. Use Amazon CloudWatch Logs Insights to extract and analyze the metrics.
Show Answer
Correct Answer: A
Explanation: Installing and using the Amazon CloudWatch agent to collect custom application metrics (for example via StatsD or embedded metrics) is the most native and lowest-overhead approach. It requires minimal additional infrastructure, scales automatically across EC2 instances, and avoids extra services, custom polling code, or log parsing. The other options add operational complexity (Prometheus stack, Lambda polling) or inefficient metric extraction from logs.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.