A company builds container images and stores them on Amazon Elastic Container Registry (Amazon ECR) in the company's primary AWS Region.
A DevOps engineer wants to replicate all the company's ECR repository images to a secondary Region. The DevOps engineer creates a new ECR repository in the secondary Region and configures permission on the new repository to allow replication.
Which solution will meet these requirements with the MOST operational efficiency?
A. Pull the existing primary ECR images and then push the images to the secondary ECR repository. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.
B. Pull the existing primary ECR images and then push the images to the secondary ECR repository. Configure permission on the primary ECR registry to allow access from the secondary Region.
C. Configure permission on the primary ECR registry to allow access from the secondary Region. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.
D. Configure an AWS Lambda function to automatically save the ECR images to an Amazon S3 bucket. Configure cross-Region replication for the S3 bucket. Configure a second Lambda function to push the images to ECR repositories in the replication destination Region when images are replicated to the S3 bucket.
Show Answer
Correct Answer: A
Explanation: Amazon ECR cross-Region replication only applies to images pushed after replication is configured; it does not retroactively copy existing images. To satisfy the requirement to replicate all existing images and automate future replication with minimal ongoing operational effort, perform a one-time pull/push of existing images to the secondary repository, then configure a replication rule on the primary registry for future image pushes. Options B and C do not replicate existing images, and D is unnecessarily complex.
Question 33
A company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations.
A DevOps team is responsible for the application deployment process across the environments. The deployment process uses an AWS CodePipeline pipeline in a Shared Services account. The DevOps team members are in the same user group. The team members have administrative access to all accounts through AWS IAM Identity Center.
A recent deployment problem in the development environment required the DevOps team to perform manual steps. The deployment to the production environment then resulted in an incident that caused the pipeline to fail, which blocked new deployments for several hours.
A DevOps engineer needs to ensure that only the pipeline can perform deployments in the production environment. The DevOps engineer must have access to the environment in case of an emergency.
Which solution will meet these requirements with the MOST operational efficiency?
A. Update the DevOps group to have the ReadOnlyAccess permission set for the production accounts. Configure the DevOps engineer user with a new permission set that has AdministratorAccess permissions and that allows the user to assume the pipeline role. Add an SCP that denies modification of resources by any entity other than the pipeline role.
B. Create an SCP that denies all write actions for the DevOps team members on the production OU. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the pipeline role.
C. Update the DevOps group to be able to assume the pipeline role for the production accounts. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the DevOps engineer.
D. Create an SCP that denies all write actions for the DevOps team members on the production OU. Use a specific tag to tag the resources that CodePipeline provisions. Add an SCP that denies modification of tagged resources by any entity other than the DevOps engineer.
Show Answer
Correct Answer: A
Explanation: The goal is to prevent manual production deployments while preserving an emergency path. Giving the DevOps group read-only access in production removes routine write capability. An SCP that allows only the pipeline role to modify resources enforces that deployments occur only through the pipeline. For emergencies, the designated DevOps engineer has AdministratorAccess plus permission to assume the pipeline role, so actions are performed as the authorized pipeline principal and are not blocked by the SCP. The other options either rely on a separate admin identity that would still be blocked by the SCP, allow broader manual deployment capability, or depend on resource tagging that does not comprehensively protect the environment.
Question 34
A company is experiencing failures in its AWS CodeDeploy deployments for a critical application. The application is deployed on Amazon EC2 instances. A DevOps engineer must analyze the failed deployments to identify the root cause of the failures.
Which solution will provide the appropriate information to troubleshoot the deployment issues?
A. Configure VPC Flow Logs to monitor network traffic. Use Amazon Inspector to detect non-network deployment issues. Use Amazon Detective to analyze the findings.
B. Enable detailed monitoring on the EC2 instances. Use AWS Systems Manager Run Command to run troubleshooting scripts on all the EC2 instances simultaneously. Analyze the results in AWS CloudTrail logs.
C. Use Amazon CloudWatch Logs to review application logs. Analyze CodeDeploy deployment logs in the /opt/codedeploy-agent/deployment-root/ directory on the EC2 instances. Use AWS X-Ray to trace requests through the application components.
D. Examine AWS Trusted Advisor checks for the CodeDeploy deployments. Use the AWS Health Dashboard to monitor application health. Analyze performance metrics in Amazon CloudWatch dashboards.
Show Answer
Correct Answer: C
Explanation: For AWS CodeDeploy failures on EC2, the primary troubleshooting sources are the CodeDeploy agent logs and deployment logs stored on the instance (commonly under /opt/codedeploy-agent/deployment-root/), along with application logs in CloudWatch Logs if configured. These logs show lifecycle hook execution, script output, and error details needed to identify deployment failures. AWS X-Ray can further help trace application behavior after deployment. The other options focus on unrelated services (VPC Flow Logs, Inspector, Detective, Trusted Advisor, Health Dashboard) or do not provide the deployment-specific diagnostics required.
Question 35
A DevOps engineer needs to design a cloud-based solution to standardize deployment artifacts for AWS Cloud deployments and on-premises deployments. There is currently no routing traffic between the on-premises data center and the AWS environment.
The solution must be able to consume downstream packages from public repositories and must be highly available. Data must be encrypted in transit and at rest. The solution must store the deployment artifacts in object storage and deploy the deployment artifacts into Amazon Elastic Container Service (Amazon ECS). The deployment artifacts must be encrypted in transit if the deployment artifacts travel across the public internet.
The DevOps engineer needs to deploy this solution in less than two weeks.
Which solution will meet these requirements?
B. Use an AWS Direct Connect connection and a VPN connection to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
C. Use two AWS VPN connections to connect the on-premises data center to AWS. Use AWS CodeArtifact to store the deployment artifacts.
D. Use parallel AWS Direct Connect connections to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
Show Answer
Correct Answer: C
Explanation: AWS CodeArtifact is a fully managed artifact repository that supports consuming packages from public repositories, encrypts data at rest and in transit, and stores package assets on Amazon S3. Two AWS Site-to-Site VPN connections can provide a highly available hybrid connection and can be deployed much faster than Direct Connect, satisfying the less-than-two-week timeline. Deploying third-party artifact software on EC2 and provisioning Direct Connect would take longer and add operational overhead.
Question 36
A company has an RPO of 24 hours and an RTO of 10 minutes for a critical web application that runs on Amazon EC2 instances. The company uses AWS Organizations to manage its AWS account. The company wants to set up AWS Backup for its AWS environment.
A DevOps engineer configures AWS Organizations for AWS Backup. The DevOps engineer creates a new centralized AWS account to store the backups. Each EC2 instance has four Amazon Elastic Block Store (Amazon EBS) volumes attached.
Which solution will meet this requirement MOST securely?
A. Create encrypted backup vaults and customer managed AWS KMS keys in both accounts. Configure AWS Backup to create full EC2 backups as AMIs. Copy the backups to the centralized vault.
B. Create encrypted vaults in both accounts by using the source account's AWS KMS key. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
C. Create backup vaults in both accounts. Use AWS managed keys for encryption. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
D. Create encrypted vaults in both accounts. Use a customer managed KMS key in the source account. Use an AWS managed key in the centralized account. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
Show Answer
Correct Answer: A
Explanation: Cross-account AWS Backup copies of encrypted EC2 backups are most securely implemented with customer managed KMS keys in both the source and destination accounts. Backing up the EC2 instance (including its attached EBS volumes) enables rapid recovery consistent with a very low RTO, and copying the backup into a centralized backup vault in a dedicated account aligns with AWS Organizations centralized backup practices. Options using AWS managed keys or the source account's key in the destination do not provide the same flexibility or security for cross-account encrypted backup management.
Question 37
A company has deployed a microservices-based application on Amazon Elastic Container Service (Amazon ECS). The application is experiencing performance issues. The company needs to identify which microservices are causing the issues.
Which solution will provide this information?
A. Configure AWS X-Ray for each ECS task. Create an X-Ray group for each microservice. Implement custom X-Ray subsegments in each microservice to capture detailed timing information. Use an X-Ray service map to visualize and identify slow microservices and requests.
B. Configure AWS X-Ray for each ECS task. Use an X-Ray service map to visualize the application's architecture and request flow. Filter the X-Ray traces by response time and error rate. Identify the microservices that have high latency or high error rates. Analyze individual traces to identify slow microservices and requests.
C. Configure Amazon CloudWatch Container Insights for each ECS task. Analyze Container Insights metrics to identify slow microservices. Use CloudWatch Logs Insights to filter the Container Insights log data by response time and error rate. Analyze the log data to identify slow requests.
D. Configure Amazon CloudWatch Container Insights for each ECS task. Use the CloudWatch automatic dashboard for Amazon ECS to identify slow microservices. Use CloudWatch Logs Insights to analyze the Container Insights performance logs for each ECS task to identify slow requests.
Show Answer
Correct Answer: B
Explanation: AWS X-Ray is the AWS service designed for distributed tracing across microservices. Enabling X-Ray for ECS tasks and using the X-Ray service map provides visibility into request paths, latency, and errors across services. Filtering traces by response time and error rate and drilling into individual traces identifies which microservices are responsible for performance issues. Container Insights focuses on infrastructure and container metrics rather than end-to-end request tracing, and custom subsegments are not required simply to identify slow microservices.
Question 38
A company has developed a web application that conducts seasonal sales on public holidays. The web application is deployed on AWS and uses AWS services for storage, database, computing, and encryption. During seasonal sales, the company expects high network traffic from a large number of users. The company must receive insights regarding any unexpected behavior during the sale.
A DevOps team wants to review the insights upon detecting anomalous behaviors during the sale. The DevOps team wants to receive recommended actions to resolve the anomalous behaviors. The recommendations must be provided on the provisioned infrastructure to address the issues that might occur in the future.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Enable Amazon DevOps Guru in the AWS account. Determine the coverage for DevOps Guru for all supported AWS resources in the account. Use the DevOps Guru dashboard to find the analysis, recommendations, and related metrics.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon DevOps Guru to send notifications about important events to the company when anomalies are identified.
C. Create an Amazon S3 bucket. Store Amazon CloudWatch logs, AWS CloudTrail data, and AWS Config data in the S3 bucket. Use Amazon Athena to generate insights on the data. Create a dashboard by using Amazon QuickSight.
D. Configure email message reports for an Amazon QuickSight dashboard. Schedule and send the email reports to the company.
E. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon Athena to send query results about important events to the company when anomalies are identified.
Show Answer
Correct Answer: A, B
Explanation: Amazon DevOps Guru is designed to automatically detect operational anomalies across supported AWS resources, provide insights, root-cause analysis, and remediation recommendations with minimal operational overhead. Configuring Amazon SNS notifications allows the DevOps team to receive alerts when anomalies are detected. The alternatives require building and maintaining custom analytics pipelines and dashboards, which increases operational overhead and do not provide built-in remediation recommendations.
Question 39
A company is developing an ecommerce application that has a backend that runs on Amazon EC2 instances. The application has a static frontend website that is hosted in an Amazon S3 bucket.
The company uses a GitHub repository for version control and must automate builds and deployments whenever code is pushed to the main branch. The company must deploy changes to the frontend and backend independently of each other.
Which solution will meet these requirements?
A. Create a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages that use AWS CodeDeploy as the action provider to deploy the frontend and backend, respectively.
B. Create a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages. For the backend stage, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend stage, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket.
C. Create two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. Configure a deployment stage that uses AWS CodeDeploy as the action provider for each pipeline to deploy the frontend and the backend.
D. Create two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. For the backend pipeline, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend pipeline, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket.
Show Answer
Correct Answer: D
Explanation: Use separate CodePipeline pipelines so the frontend and backend can be built and deployed independently. The backend running on EC2 should be deployed with AWS CodeDeploy. A static website hosted in Amazon S3 should use the native Amazon S3 deploy action in CodePipeline rather than CodeDeploy. This satisfies automated builds and deployments from the GitHub repository while allowing independent release of each component.
Question 40
A company wants to proactively monitor and respond to AWS service issues that might affect an application. The company must correlate AWS Health events with application performance metrics and must set up automated alerts. The solution must give the company the ability to archive events, test the application's latency in different scenarios, and create custom metrics.
Which solution will meet these requirements?
A. Use AWS CloudTrail to log all AWS Health events. Use Amazon Athena to query the logs and to correlate the logs with application metrics stored in Amazon Timestream for LiveAnalytics. Set up AWS Chatbot for real-time notifications.
B. Use Amazon EventBridge to route AWS Health events to Amazon CloudWatch Logs. Create a metric filter for AWS Health events. Create custom metrics in CloudWatch that are based on application performance data. Set up CloudWatch alarms that correlate AWS Health events with the custom metrics.
C. Configure the AWS Health Dashboard to send notifications to Amazon Simple Notification Service (Amazon SNS). Use AWS Lambda to correlate the notifications with metrics and to update custom metrics in Amazon CloudWatch. Set up CloudWatch alarms for the custom metrics. Use AWS Systems Manager for automated remediation.
D. Configure AWS X-Ray to trace AWS Health events and application performance. Use Amazon QuickSight to visualize the correlations between events and metrics. Use Amazon GuardDuty to detect anomalies in the application's behavior and to provide alerts.
Show Answer
Correct Answer: B
Explanation: Amazon EventBridge natively receives AWS Health events and can route them to CloudWatch Logs for archival. CloudWatch Logs metric filters can generate metrics from Health events, while application performance can be published as custom CloudWatch metrics. CloudWatch alarms can then alert based on these metrics, enabling correlation of AWS Health events with application performance. This best matches the requirements for automated alerts, event archiving, and custom metrics. The other options misuse services or lack direct AWS Health event integration.
Question 41
A company uses a CI/CD pipeline to deploy its workload in the ap-southeast-2 Region. The company receives images through a Network Load Balancer (NLB) and processes the images in AWS Fargate tasks on an Amazon Elastic Container Service (Amazon ECS) cluster.
An Amazon Elastic Container Registry (Amazon ECR) repository stores the images as Docker images. The company uses Amazon Route 53 to configure DNS. The company saves the images in an Amazon S3 bucket and saves the metadata from the images in an Amazon DynamoDB table.
The company wants to expand the workload to a second Region. A DevOps engineer needs to build a highly available and resilient design to expand the workload to the eu-west-2 Region.
Which combination of steps will meet these requirements with the FEWEST configuration changes? (Choose three.)
A. Configure ECR replication to eu-west-2 on the repository. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a latency routing policy in Route 53 for the two workloads.
B. Configure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in ap-southeast-2.
C. Configure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in the same Region that the tasks run in.
D. Configure a new S3 bucket in eu-west-2. Configure data replication between the S3 bucket in ap-southeast-2 and the S3 bucket in eu-west-2. Configure the Fargate tasks to use the S3 bucket in the same Region that the tasks run in to perform S3 PUT operations and GET operations.
E. Configure an S3 Multi-Region Access Point for the S3 bucket in ap-southeast-2 and a new S3 bucket in eu-west-2. Configure two-way replication on the S3 buckets. Configure the workloads to use the Multi-Region Access Point for S3 PUT operations and GET operations.
F. Configure the CI/CD pipeline to deploy ECR images to both Regions. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a failover routing policy in Route 53 for the two workloads.
Show Answer
Correct Answer: A, C, E
Explanation: Use ECR cross-Region replication to minimize CI/CD changes and deploy identical images in both Regions, with regional ECS/Fargate behind regional NLBs and Route 53 latency-based routing. Use DynamoDB Global Tables with each Region accessing its local replica for resilience and low latency. For S3, S3 Multi-Region Access Points with bidirectional replication provide a single global endpoint with automatic routing to the nearest bucket and minimal application changes.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.