A company operates a fleet of Amazon EC2 instances that host critical applications and handle sensitive data. The EC2 instances must have up-to-date security patches to protect against vulnerabilities and ensure compliance with industry standards and regulations. The company needs an automated solution to monitor and enforce security patch compliance across the EC2 fleet.
Which solution will meet these requirements?
A. Configure AWS Systems Manager Patch Manager and AWS Config with defined patch baselines and compliance rules that run Systems Manager Automation documents.
B. Access each EC2 instance by using SSH keys. Check for and apply security updates by using package managers. Verify the installations.
C. Configure Auto Scaling groups that have scaling policies based on Amazon CloudWatch metrics. Configure Auto Scaling launch templates that launch new instances by using the latest AMIs that contain new security patches.
D. Use AWS CloudFormation to recreate EC2 instances with the latest AMI every time a new patch becomes available. Use AWS CloudTrail logs to monitor patch compliance and to send alerts for non-compliant instances.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager Patch Manager is the managed service designed to automate patching of EC2 instances using patch baselines and maintenance windows. AWS Config can evaluate compliance and, together with Systems Manager Automation, automatically remediate noncompliant instances. The other options are manual, incomplete, or use services that do not provide patch compliance management.
Question 23
A company has implemented a new microservices-based application on an Amazon Elastic Container Service (Amazon ECS) cluster. After each deployment, the company wants to validate the critical user journeys and API endpoints before routing traffic to the new application version.
The company must implement an automated solution to detect issues in the new deployment and to initiate a rollback if necessary.
Which solution will meet these requirements with the LEAST operational overhead?
A. Set up Amazon CloudWatch Application Insights for the ECS cluster. Create an Amazon EventBridge rule to invoke an AWS Lambda function to analyze the task states. Program the Lambda function to use the ECS UpdateService API call to initiate a rollback if a specific percentage of tasks fail.
B. Set up Amazon CloudWatch Application Insights for the ECS cluster. Configure Application Insights to monitor key performance indicators of the microservices in the critical user journeys and API calls. Create CloudWatch alarms based on the insights. Use Amazon EventBridge to invoke an AWS Step Functions workflow to evaluate the alarms. Configure the workflow to initiate a rollback if necessary by using the alarms' built-in integration with Amazon ECS.
C. Create CloudWatch Synthetics canaries that simulate critical user journeys and API calls. Implement AWS X-Ray tracing for all the microservices Configure X-Ray to send traces to CloudWatch. Create CloudWatch alarms based on error rates and latency metrics. Create an AWS Lambda function to analyze the traces and to initiate a rollback if necessary by using the alarms' built-in integration with Amazon ECS.
D. Create CloudWatch Synthetics canaries that simulate critical user journeys and API calls. Configure the canaries to run against the new deployment. Create CloudWatch alarms that are invoked when canaries fail. Use the alarms’ built-in integration with Amazon ECS to initiate a rollback if the alarms are invoked before traffic is routed to the new deployment.
Show Answer
Correct Answer: D
Explanation: CloudWatch Synthetics canaries are designed to actively validate critical user journeys and API endpoints after deployment. Their results can feed CloudWatch alarms, and with Amazon ECS deployments using CodeDeploy deployment circuit/rollback integration, alarm failures can automatically trigger rollback. This avoids custom Lambda or Step Functions logic and provides the least operational overhead.
Question 24
A company produces builds for an open source project every day. The company hosts the open source project in a public code repository that the company supports. The company manually invokes a pipeline in AWS CodePipeline to build artifacts for the project. The company wants to make the build artifacts publicly available on a website that the company hosts in an Amazon S3 bucket.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS CodeBuild project. Set the public repository as the source. Use a webhook to rebuild when the company pushes a code change. Configure the artifacts section of the project to use the S3 bucket as the destination. Set up an appropriate path to store build outputs in the bucket. Disable artifact encryption.
B. Create an AWS CodeBuild project. Set the public repository as the source. Configure the artifacts section of the project to use the S3 bucket as the destination. Ensure that artifact encryption is enabled in the artifacts configuration. Configure an Amazon EventBridge rule to initiate the CodeBuild project on a daily schedule.
C. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Update the pipeline to run in response to pull requests to the public repository.
D. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Create an Amazon EventBridge rule to initiate the pipeline on a daily schedule.
Show Answer
Correct Answer: D
Explanation: The existing solution already uses AWS CodePipeline. To reduce operational overhead, extend the existing pipeline with an S3 deploy stage to publish the build artifacts to the S3 website bucket, and use an Amazon EventBridge scheduled rule to start the pipeline once per day. This satisfies the daily build requirement without creating a separate build system. A uses webhooks (code-change driven, not daily), B creates a separate CodeBuild workflow unnecessarily, and C triggers on pull requests rather than a daily schedule.
Question 25
A company uses AWS Organizations, AWS Control Tower, AWS Config, and Terraform to manage its AWS accounts and resources. The company must ensure that users deploy only AWS Lambda functions that are connected to a VPC in member AWS accounts.
Which solution will meet these requirements with the LEAST operational effort?
A. Configure AWS Control Tower to use proactive controls (guardrails). Enable the optional controls (guardrails) implemented with AWS CloudFormation hooks for Lambda on all OUs.
B. Create a new SCP. Include a conditional statement that uses a StringEquals condition operator to check the lambd:Vpclds condition key against a list of VPC IDs. Configure the SCP to allow the lambda CreateFunction action and the lambda UpdateFunctionConfiguration action if the value of the condition key matches one of the VPC IDs.
C. Create a custom rule in AWS Config to detect Lambda functions that are not connected to a VPC when any Lambda function is created or updated.
D. Create a new SCP. Include a conditional statement that uses a Null condition operator to determine whether the lambda Vpclds condition key is absent. Configure the SCP to deny the lambda CreateFunction action and the lambda UpdateFunctionConfiguration action if the condition key is absent.
Show Answer
Correct Answer: D
Explanation: An SCP provides preventive enforcement across all API callers, including Terraform. Using a Deny statement with the Null condition on the lambda:VpcIds condition key blocks CreateFunction and UpdateFunctionConfiguration requests that omit VPC configuration, ensuring Lambda functions cannot be deployed without VPC attachment. Control Tower proactive controls are CloudFormation-hook based and are not the best fit for Terraform workflows. AWS Config custom rules are detective rather than preventive. Restricting to specific VPC IDs is more restrictive than the stated requirement and requires ongoing maintenance.
Question 26
A DevOps engineer is planning to use the AWS Cloud Development Kit (AWS CDK) to manage infrastructure as code (IaC) for a microservices-based application. The DevOps engineer must create reusable components for common infrastructure patterns and must apply the same cost allocation tags across different microservices.
Which solution will meet these requirements?
A. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the custom CDK construct library to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment-specific configurations
B. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the custom CDK construct library to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.
C. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the Service Catalog products to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment-specific configurations.
D. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the Service Catalog products to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.
Show Answer
Correct Answer: B
Explanation: A custom AWS CDK construct library is the correct mechanism for creating reusable infrastructure patterns. The AWS CDK Tags class is used to apply tags recursively (via Aspects) across constructs, making it appropriate for consistent cost allocation tagging across the app. Modeling each microservice as its own higher-level construct and deploying each as a separate stack aligns with microservices' independent lifecycle and environment-specific deployment best practices.
Question 27
A company has an application that streams logs to an Amazon CloudWatch Logs log group. The logs must be available for the team to search in CloudWatch for at least 30 days. Logs must be accessible with low latency for at least 90 days. After 180 days, log retrieval is rare and latency is not important.
A DevOps engineer creates an Amazon S3 bucket to store the logs. Log availability metrics and data protection are important to the company.
Which solution will meet these requirements in the MOST cost-effective way?
A. Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Kinesis Data Streams to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon Glacier Flexible Retrieval after 180 days.
B. Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 90 days and to Amazon S3 Glacier Flexible Retrieval after 180 days.
C. Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Kinesis Data Streams to send log events to the S3 bucket by writing files. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Instant Retrieval after 180 days.
D. Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Deep Archive after 180 days.
Show Answer
Correct Answer: D
Explanation: CloudWatch Logs exports to S3 in near real time are implemented with subscription filters, not CloudWatch metric streams (metric streams export metrics, not log events). Amazon Data Firehose is the managed destination for delivering log events to S3. Keeping CloudWatch Logs for 30 days satisfies the searchable requirement. Moving S3 objects to Standard-IA after 90 days provides lower-cost, low-latency access. After 180 days, because retrieval is rare and latency is unimportant, Glacier Deep Archive is the most cost-effective archival class. One Zone-IA does not meet stronger data protection goals, and the CloudWatch Logs Infrequent Access class does not support subscription filters.
Question 28
A company has an organization in AWS Organizations. The organization has all features enabled and has AWS CloudTrail trusted access configured for the management account. An Amazon Simple Notification Service (Amazon SNS) topic is configured for notifications.
The company needs all AWS events in all AWS Regions in the organization to be recorded and retained in an audit account. The company needs near real-time notifications of any failed login attempts.
A DevOps engineer has created an organization trail in the management account to log events for all Regions.
Which solution will meet these requirements with the LEAST operational effort?
A. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account. In the audit account, create an Amazon EventBridge rule that reacts to failed login events in CloudTrail. Configure the EventBridge rule to notify the SNS topic.
B. Configure the trail to publish logs to a new Amazon S3 bucket in the management account. Configure an Amazon Athena table to read from the new S3 bucket. Create an AWS Lambda function that queries the Athena table for failed login events and publishes the findings to the SNS topic. Create an Amazon EventBridge scheduled rule to invoke the Lambda function every 5 minutes.
C. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account and a new Amazon CloudWatch log group in the management account. Create a CloudWatch Logs metric filter on the log group to create a custom metric for failed logins. Configure a CloudWatch alarm that uses the custom metric and notifies the SNS topic.
D. Configure the trail to publish logs to a new Amazon CloudWatch log group in the audit account. Create an Amazon Kinesis data stream in the audit account. Configure a subscription filter on the log group to send the logs to the data stream. Use Amazon Managed Service for Apache Flink to filter the data stream for failed logins. Publish the results to the SNS topic.
Show Answer
Correct Answer: C
Explanation: An organization trail can centrally log management events from all accounts and all Regions. Configuring the organization trail to deliver to both an S3 bucket in the audit account (for centralized retention) and a CloudWatch Logs log group enables near real-time detection. A CloudWatch Logs metric filter can match failed AWS Management Console sign-in events (such as ConsoleLogin failures), a CloudWatch alarm can trigger immediately, and the alarm can notify the SNS topic. This is simpler and more operationally efficient than scheduled Athena queries or Kinesis/Flink processing, and avoids EventBridge regional deployment considerations.
Question 29
A company runs a microservices application on Amazon Elastic Kubernetes Service (Amazon EKS). Users recently reported significant delays while accessing an account summary feature, particularly during peak business hours.
A DevOps engineer used Amazon CloudWatch metrics and logs to troubleshoot the issue. The logs indicated normal CPU and memory utilization on the EKS nodes. The DevOps engineer was not able to identify where the delays occurred within the microservices architecture.
The DevOps engineer needs to increase the observability of the application to pinpoint where the delays are occurring.
Which solution will meet these requirements?
A. Deploy the AWS X-Ray daemon as a DaemonSet in the EKS cluster. Use the X-Ray SDK to instrument the application code. Redeploy the application
B. Enable CloudWatch Container Insights for the EKS cluster. Use the Container Insights data to diagnose the delays.
C. Create alarms based on the existing CloudWatch metrics. Set up an Amazon Simple Notification Service (Amazon SNS) topic to send email alerts.
D. Increase the timeout settings in the application code for network operations to allow more time for operations to finish.
Show Answer
Correct Answer: A
Explanation: The application needs distributed tracing to identify where request latency occurs across multiple microservices. Deploying the AWS X-Ray daemon on the EKS cluster and instrumenting the application with the X-Ray SDK provides end-to-end traces that reveal latency at each service and downstream call. Container Insights focuses on infrastructure and container metrics rather than request tracing, CloudWatch alarms only notify on metrics, and increasing timeouts does not diagnose the root cause.
Question 30
A company uses a trunk-based development branching strategy. The company has two AWS CodePipeline pipelines that are integrated with a Git provider. The pull_request pipeline has a branch filter that matches the feature branches. The main_branch pipeline has a branch filter that matches the main branch.
When pull requests are merged into the main branch, the pull requests are deployed by using the main_branch pipeline.
The company's developers need test results for all submitted pull requests as quickly as possible from the pull_request pipeline. The company wants to ensure that the main_branch pipeline’s test results finish and that each deployment is complete before the next pipeline execution.
Which solution will meet these requirements?
A. Configure the pull_request pipeline to use PARALLEL mode. Configure the main_branch pipeline to use QUEUED mode.
B. Configure the pull_request pipeline to use SUPERSEDED mode. Configure the main_branch pipeline to use QUEUED mode.
C. Configure the pull_request pipeline to use PARALLEL mode. Configure the main_branch pipeline to use SUPERSEDED mode
D. Configure the pull_request pipeline to use QUEUED mode. Configure the main_branch pipeline to use SUPERSEDED mode.
Show Answer
Correct Answer: A
Explanation: Use PARALLEL execution mode for the pull_request pipeline so multiple pull request validations can run concurrently, providing the fastest possible test feedback. Use QUEUED execution mode for the main_branch pipeline so executions are processed in order, ensuring each test run and deployment completes before the next execution begins.
Question 31
A DevOps engineer successfully creates an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that includes managed node groups. When the DevOps engineer tries to add node groups to the cluster, the cluster returns an error that states, "NodeCreationFailure: Instances failed to join the Kubernetes cluster."
The DevOps engineer confirms that the EC2 worker nodes are running and that the EKS cluster is in an active state.
How should the DevOps engineer troubleshoot this issue?
A. Ensure that the EKS cluster's VPC subnets do not overlap with the 172.17.0.0/16 CIDR range.
B. Use kubectl to update the kubeconfig file to use the credentials that created the cluster.
C. Run the AWSSupport-TroubleshootEKSWorkerNode runbook.
D. Create an AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for the cluster.
Show Answer
Correct Answer: C
Explanation: The managed node group error 'NodeCreationFailure: Instances failed to join the Kubernetes cluster' is a generic worker-node join failure. AWS recommends using the AWSSupport-TroubleshootEKSWorkerNode Systems Manager Automation runbook to diagnose common causes such as IAM, networking, bootstrap configuration, DNS, and cluster connectivity. The other options address specific scenarios but are not the recommended troubleshooting step for this error.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.