A company is developing a microservices-based application on AWS. The application consists of AWS Lambda functions and Amazon Elastic Container Service (Amazon ECS) services that need to be deployed frequently.
A DevOps engineer needs to implement a consistent deployment solution across all components of the application. The solution must automate the deployments, minimize downtime during updates, and manage configuration data for the application.
Which solution will meet these requirements with the LEAST development effort?
A. Use AWS CloudFormation to define and provision the Lambda functions and ECS services. Implement stack updates with resource replacement for all components. Use AWS Secrets Manager to manage the configuration data.
B. Use AWS CodeDeploy to manage deployments for the Lambda functions and ECS services. Implement canary deployments for the Lambda functions. Implement blue/green deployments for the ECS services. Use AWS Systems Manager Parameter Store to manage the configuration data.
C. Use AWS Step Functions to orchestrate deployments for the Lambda functions and ECS services. Use canary deployments for the Lambda functions and ECS services in a different AWS Region. Use AWS Systems Manager Parameter Store to manage the configuration data.
D. Use AWS Systems Manager to manage deployments for the Lambda functions and ECS services. Implement all-at-once deployments for the Lambda functions. Implement rolling updates for the ECS services. Use AWS Secrets Manager to manage the configuration data.
Show Answer
Correct Answer: B
Explanation: AWS CodeDeploy natively supports automated deployments for both AWS Lambda and Amazon ECS with minimal setup. It provides canary deployments for Lambda and blue/green deployments for ECS, which minimize downtime and risk during updates. Using AWS Systems Manager Parameter Store for configuration data is well suited for application configuration. This combination delivers a consistent, automated deployment solution with the least development effort.
Question 16
A company is developing a mobile app that requires extensive automated testing across multiple device types. The company is using AWS CodePipeline for its CI/CD pipeline.
The company must implement a scalable testing solution that can handle increased test loads as the app grows.
Which solution will meet these requirements with the LEAST management overhead?
A. Integrate AWS Device Farm with the pipeline to run the tests and scale as needed.
B. Deploy a fleet of Amazon EC2 instances with various mobile device emulators and auto scaling to run the tests. Create a custom AWS Lambda function to invoke EC2 test runs.
C. Implement a containerized testing solution that uses Amazon Elastic Container Service (Amazon ECS) with auto scaling. Configure the pipeline to invoke an AWS Lambda function to start the test runs on the ECS cluster.
D. Use AWS Lambda functions with custom runtime emulators to run the tests. Integrate the Lambda functions with the pipeline.
Show Answer
Correct Answer: A
Explanation: AWS Device Farm is a fully managed service purpose-built for automated testing of mobile apps on a wide range of real devices. It integrates directly with AWS CodePipeline, automatically scales to handle increased test loads, and requires minimal infrastructure management. The other options rely on managing EC2 instances, containers, or custom runtimes, which introduce significantly more operational overhead.
Question 17
A company is running its ecommerce website on AWS. The website is currently hosted on a single Amazon EC2 instance in one Availability Zone. A MySQL database runs on the same EC2 instance.
The company needs to eliminate single points of failure in the architecture to improve the website's availability and resilience.
Which solution will meet these requirements with the LEAST configuration changes to the website?
A. Deploy the application by using AWS Fargate containers. Migrate the database to Amazon DynamoDB. Use Amazon API Gateway to route requests.
B. Deploy the application on EC2 instances across multiple Availability Zones. Put the EC2 instances into an Auto Scaling group behind an Application Load Balancer. Migrate the database to Amazon Aurora Multi-AZ. Use Amazon CloudFront for content delivery.
C. Use AWS Elastic Beanstalk to deploy the application across multiple AWS Regions. Migrate the database to Amazon Redshift. Use Amazon ElastiCache for session management.
D. Migrate the application to AWS Lambda functions. Use Amazon S3 for static content hosting. Migrate the database to Amazon DocumentDB (with MongoDB compatibility).
Show Answer
Correct Answer: B
Explanation: Option B removes the single points of failure with minimal changes to the existing EC2/MySQL architecture. Placing EC2 instances in an Auto Scaling group across multiple Availability Zones behind an Application Load Balancer provides high availability for the application tier. Migrating MySQL to Amazon Aurora Multi-AZ improves database resilience with low application impact due to MySQL compatibility. The other options require major architectural rewrites or inappropriate services, making them less suitable.
Question 17
A company uses a pipeline in AWS CodePipeline to upload AWS CloudFormation templates to an Amazon S3 bucket. The pipeline uses the templates to deploy CloudFormation stacks that match the names of the templates.
The company has experienced issues when it tries to revert templates to a previous version. To prevent these issues, the company must have the ability to review template modifications before the modifications are deployed to production.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure a connection in AWS CodeConnections to a Git repository. Store the templates in the Git repository. Configure a pull request workflow to review template modifications. Configure AWS CloudFormation Git sync for the stacks.
B. Add a manual review action in the pipeline to review modifications to the template code before the stack deployments.
C. Update the pipeline to invoke an AWS Lambda function to check the template modifications before the stack deployments.
D. Configure a connection in AWS CodeConnections to a Git repository. Store the templates in the Git repository. Configure the pipeline to include a source action that uses the connection. Add a manual review action to the pipeline to review template modifications before the stack deployments.
Show Answer
Correct Answer: A
Explanation: Using a Git repository with pull requests enables native diff-based review and controlled reversion of CloudFormation templates before production changes. AWS CloudFormation Git sync automatically deploys stacks on merge, eliminating custom pipeline logic or manual approval steps. This provides required pre-deployment review with the least operational overhead compared to adding manual pipeline actions or custom Lambda checks.
Question 18
A company has multiple development teams in separate business units that work in a single shared AWS account. All Amazon EC2 resources that users create in the account must include tags that specify which user created the resources. The tagging must occur within the first hour of resource creation.
A DevOps engineer needs to add tags to new resources that include the ID of the user that created the resource and the appropriate cost center ID. The DevOps engineer configures an AWS Lambda function to use the cost center mappings to tag the resources. The DevOps engineer also sets up AWS CloudTrail in the shared AWS account. An Amazon S3 bucket stores the CloudTrail event logs.
Which solution will meet the tagging requirements?
A. Create an S3 event notification on the S3 bucket to invoke the Lambda function for s3:ObjectTagging:Put events. Enable bucket versioning on the S3 bucket.
B. Enable server access logging on the S3 bucket. Create an S3 event notification on the S3 bucket for s3:ObjectTagging:* events.
C. Enable AWS Config in the account. Configure the required-tags AWS managed rule to check and update the required tags.
D. Create an Amazon EventBridge rule that uses Amazon EC2 as the event source. Configure the rule to match events that CloudTrail delivers. Configure the rule to target the Lambda function.
Show Answer
Correct Answer: D
Explanation: Amazon EventBridge can receive CloudTrail management events in near real time, including EC2 API calls such as RunInstances. By creating an EventBridge rule that matches these CloudTrail events and targets a Lambda function, the function can immediately extract the user identity from the event, map it to the correct cost center, and apply the required tags well within the one-hour window. The S3-based options only react to log file delivery or object tagging events and are not suitable for timely resource tagging, and AWS Config rules can evaluate compliance but cannot reliably tag resources at creation time.
Question 18
A DevOps engineer needs to configure an AWS CodePipeline pipeline that publishes container images to an Amazon Elastic Container Registry (Amazon ECR) repository. The pipeline must wait for the previous run to finish and must run when new Git tags are pushed to a Git repository that is connected to AWS CodeConnections. An existing deployment pipeline needs to run in response to the publication of new container images.
Which solution will meet these requirements?
A. Configure a CodePipeline V2 type pipeline that uses QUEUED mode. Add a trigger filter to the pipeline definition that includes all tags. Configure an Amazon EventBridge rule that matches container image pushes to start the existing deployment pipeline.
B. Configure a CodePipeline V2 type pipeline that uses SUPERSEDED mode. Add a trigger filter to the pipeline definition that includes all branches. Configure an Amazon EventBridge rule that matches container image pushes to start the existing deployment pipeline.
C. Configure a CodePipeline V1 type pipeline that uses SUPERSEDED mode. Add a trigger filter to the pipeline definition that includes all tags. Add a stage at the end of the pipeline to invoke the existing deployment pipeline.
D. Configure a CodePipeline V1 type pipeline that uses QUEUED mode. Add a trigger filter to the pipeline definition that includes all branches. Add a stage at the end of the pipeline to invoke the existing deployment pipeline.
Show Answer
Correct Answer: A
Explanation: The pipeline must wait for prior executions, which requires CodePipeline V2 with QUEUED mode (SUPERSEDED would cancel in‑progress runs). The trigger must fire on Git tag pushes, which is supported with V2 trigger filters for tags via CodeConnections. Finally, the existing deployment pipeline should run when new images are published, best achieved by an Amazon EventBridge rule that listens for ECR image push events and starts the downstream pipeline. Other options use incorrect execution modes, triggers (branches instead of tags), or legacy V1 features.
Question 19
A company has a web application that publishes logs that contain metadata for transactions, with a status of success or failure for each log. The logs are in JSON format. The application publishes the logs to an Amazon CloudWatch Logs log group.
The company wants to create a dashboard that displays the number of successful transactions.
Which solution will meet this requirement with the LEAST operational overhead?
A. Create an Amazon OpenSearch Service cluster and an OpenSearch Service subscription filter to send the log group data to the cluster. Create a dashboard within the Dashboards feature in the OpenSearch Service cluster by using a search query for transactions that have a status of success.
B. Create a CloudWatch subscription filter for the log group that uses an AWS Lambda function. Configure the Lambda function to parse the JSON logs and publish a custom metric to CloudWatch for transactions that have a status of success. Create a CloudWatch dashboard by using a metric graph that displays the custom metric.
C. Create a CloudWatch metric filter for the log groups with a filter pattern that matches the transaction status property and a value of success. Create a CloudWatch dashboard by using a metric graph that displays the new metric.
D. Create an Amazon Kinesis data stream that is subscribed to the log group. Configure the data stream to filter incoming log data based on a status of success and to send the filtered logs to an AWS Lambda function. Configure the Lambda function to publish a custom metric to CloudWatch. Create a CloudWatch dashboard by using a metric graph that displays the custom metric.
Show Answer
Correct Answer: C
Explanation: CloudWatch metric filters can directly parse JSON-formatted log events in a log group and emit a CloudWatch metric when a field (for example, status) equals "success." This requires no additional services, infrastructure, or custom code. The resulting metric can be graphed directly on a CloudWatch dashboard, resulting in the least operational overhead compared to OpenSearch, Lambda, or Kinesis-based solutions.
Question 19
A company is running an application on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs to implement comprehensive logging for the control plane and the nodes. The company must analyze API requests to the Kubernetes control plane and must monitor container performance on the nodes.
Which solution will meet these requirements with the LEAST operational overhead?
A. Enable AWS CloudTrail for control plane logging. Deploy Logstash as a ReplicaSet on the nodes to collect logs from the nodes. Use Amazon OpenSearch Service to store and analyze the logs for the control plane and the nodes.
B. Enable control plane logging for the EKS cluster. Send the logs to Amazon CloudWatch. Use CloudWatch Container Insights to collect logs for the nodes and the containers. Use CloudWatch Logs Insights to query and analyze the logs for the control plane and the nodes.
C. Enable API server control plane logging for the EKS cluster. Send the logs to Amazon S3 Deploy Kubernetes Event Exporter to the nodes to collect logs from the nodes. Send the logs to Amazon S3. Use Amazon Athena to query logs for the control plane and the nodes. Use Amazon QuickSight for visualization.
D. Use AWS Distro for OpenTelemetry to collect logs for the control plane and the nodes. Stream all the logs to Amazon Data Firehose. Use Amazon Redshift to analyze the aggregated log data for the control plane and the nodes.
Show Answer
Correct Answer: B
Explanation: Option B uses native, fully managed AWS integrations for EKS. Enabling EKS control plane logging sends API server, audit, and authenticator logs directly to Amazon CloudWatch with no infrastructure to manage. CloudWatch Container Insights natively collects node and container metrics and logs, fulfilling the requirement to monitor container performance. CloudWatch Logs Insights provides managed querying and analysis. All other options introduce additional components (Logstash, OpenSearch, S3/Athena pipelines, OpenTelemetry, Redshift) that increase operational overhead.
Question 20
A DevOps engineer updates an AWS CloudFormation stack to add a nested stack that includes several Amazon EC2 instances. When the DevOps engineer attempts to deploy the updated stack, the nested stack fails to deploy.
What should the DevOps engineer do to determine the cause of the failure?
A. Use the CloudFormation detect root cause capability for the failed stack to analyze the failure and return the event that is the most likely cause for the failure.
B. Query failed stacks by specifying the root stack as the ParentId property. Examine the StackStatusReason property for all returned stacks to determine the reason the nested stack failed to deploy.
C. Activate AWS Systems Manager for the AWS account where the application runs. Use the AWS Systems Manager Automation AWS-SupportTroubleshootCFNCustomResource runbook to determine the reason the nested stack failed to deploy.
D. Configure the CloudFormation template to publish logs to Amazon CloudWatch. View the CloudFormation logs for the failed stack in the CloudWatch console to determine the reason the nested stack failed to deploy.
Show Answer
Correct Answer: B
Explanation: When a nested CloudFormation stack fails, the failure details are recorded on the nested stack itself. By querying stacks that have the root stack set as the ParentId, the engineer can identify the nested stack and examine its StackStatusReason (and related events) to see the exact cause of the failure, such as parameter issues or resource creation errors. This is the standard and direct way to diagnose nested stack deployment failures.
Question 20
A company operates a fleet of Amazon EC2 instances that host critical applications and handle sensitive data. The EC2 instances must have up-to-date security patches to protect against vulnerabilities and ensure compliance with industry standards and regulations. The company needs an automated solution to monitor and enforce security patch compliance across the EC2 fleet.
Which solution will meet these requirements?
A. Configure AWS Systems Manager Patch Manager and AWS Config with defined patch baselines and compliance rules that run Systems Manager Automation documents.
B. Access each EC2 instance by using SSH keys. Check for and apply security updates by using package managers. Verify the installations.
C. Configure Auto Scaling groups that have scaling policies based on Amazon CloudWatch metrics. Configure Auto Scaling launch templates that launch new instances by using the latest AMIs that contain new security patches.
D. Use AWS CloudFormation to recreate EC2 instances with the latest AMI every time a new patch becomes available. Use AWS CloudTrail logs to monitor patch compliance and to send alerts for non-compliant instances.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager Patch Manager is the managed service designed to automate patching and report patch compliance across EC2 instances. When combined with AWS Config rules, the company can continuously monitor compliance and automatically remediate non-compliant instances using Systems Manager Automation. The other options rely on manual processes or indirect mechanisms and do not provide centralized, automated compliance enforcement.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.