A company uses AWS Organizations to manage multiple AWS accounts. The accounts are in an OU that has a policy attached to allow all actions. The company is migrating several Git repositories to a specified AWS CodeConnections supported Git provider. The Git repositories manage AWS CloudFormation stacks for application infrastructure that the company deploys across multiple AWS Regions.
The company wants a DevOps team to integrate CodeConnections into the CloudFormation stacks. The DevOps team must ensure that company staff members can integrate only with the specified Git provider. The deployment process must be highly available across Regions.
Which combination of steps will meet these requirements? (Choose three.)
A. Add a new SCP statement to the OU that denies the CodeConnections CreatingConnections action where the provider type is not the specified Git provider.
B. Add a new SCP statement to the OU that allows the CodeConnections CreatingConnections action where the provider type is the specified Git provider.
C. Use CodeConnectlons to configure a single CodeConnections connection to each Git repository.
D. Use CodeConnections to create a CodeConnections connection from each Region where the company operates to each Git repository.
E. Use CodeConnections to create a CodeConnections repository link. Update each CfoudFormation stack to sync from the Git repository.
F. For each Git repository, create a pipeline in AWS CodePipefine that has the Git repository set as the source and a CloudFormation deployment stage.
Show Answer
Correct Answer: A, D, E
Explanation: An SCP with an explicit deny ensures staff can create connections only to the specified Git provider (A). CodeConnections resources are regional, so creating a connection in each operating Region provides high availability for multi-Region deployments (D). Using CodeConnections repository links allows CloudFormation stacks to sync directly from the Git repositories as required (E).
Question 21
A company has implemented a new microservices-based application on an Amazon Elastic Container Service (Amazon ECS) cluster. After each deployment, the company wants to validate the critical user journeys and API endpoints before routing traffic to the new application version.
The company must implement an automated solution to detect issues in the new deployment and to initiate a rollback if necessary.
Which solution will meet these requirements with the LEAST operational overhead?
A. Set up Amazon CloudWatch Application Insights for the ECS cluster. Create an Amazon EventBridge rule to invoke an AWS Lambda function to analyze the task states. Program the Lambda function to use the ECS UpdateService API call to initiate a rollback if a specific percentage of tasks fail.
B. Set up Amazon CloudWatch Application Insights for the ECS cluster. Configure Application Insights to monitor key performance indicators of the microservices in the critical user journeys and API calls. Create CloudWatch alarms based on the insights. Use Amazon EventBridge to invoke an AWS Step Functions workflow to evaluate the alarms. Configure the workflow to initiate a rollback if necessary by using the alarms' built-in integration with Amazon ECS.
C. Create CloudWatch Synthetics canaries that simulate critical user journeys and API calls. Implement AWS X-Ray tracing for all the microservices Configure X-Ray to send traces to CloudWatch. Create CloudWatch alarms based on error rates and latency metrics. Create an AWS Lambda function to analyze the traces and to initiate a rollback if necessary by using the alarms' built-in integration with Amazon ECS.
D. Create CloudWatch Synthetics canaries that simulate critical user journeys and API calls. Configure the canaries to run against the new deployment. Create CloudWatch alarms that are invoked when canaries fail. Use the alarms’ built-in integration with Amazon ECS to initiate a rollback if the alarms are invoked before traffic is routed to the new deployment.
Show Answer
Correct Answer: D
Explanation: The requirement is to validate critical user journeys and API endpoints after deployment and automatically roll back with the least operational overhead. CloudWatch Synthetics canaries actively simulate real user journeys and API calls, directly validating behavior before traffic is routed. CloudWatch alarms on canary failures can use built-in ECS/CodeDeploy rollback integration, avoiding custom Lambda functions, Step Functions, or complex analysis. This makes option D the simplest and lowest-overhead automated rollback solution.
Question 22
A company has application code in an AWS CodeConnections compatible Git repository. The company wants to configure unit tests to run when pull requests are opened. The company wants to ensure that the test status is visible in pull requests when the tests are completed. The company wants to save output data files that the tests generate to an Amazon S3 bucket after the tests are finished.
Which combination of solutions will meet these requirements? (Choose three.)
A. Create an IAM service role to allow access to the resources that are required to run the tests. B Create a pipeline in AWS CodePipeline that has a test stage. Create a trigger to run the pipeline when pull requests are created or updated. Add a source action to report test results.
C. Create an AWS CodeBuild project to run the tests. Enable webhook triggers to run the tests when pull requests are created or updated. Enable build status reporting to report test results.
D. Create a buildspec.yml file that has a reports section to upload output files when the tests have finished running.
E. Create a buildspec.yml file that has an artifacts section to upload artifacts when the tests have finished running.
F. Create an appspec.yml file that has a files section to upload output files when the tests have finished running.
Show Answer
Correct Answer: A, C, E
Explanation: An IAM service role is required so the build service can run tests and write results to Amazon S3 (A). AWS CodeBuild supports webhook triggers for pull requests from CodeConnections repositories and can report build status back to the pull request, making test results visible (C). To save output data files to an S3 bucket after tests complete, the buildspec.yml artifacts section is used to upload files to S3 (E).
Question 22
A company produces builds for an open source project every day. The company hosts the open source project in a public code repository that the company supports. The company manually invokes a pipeline in AWS CodePipeline to build artifacts for the project. The company wants to make the build artifacts publicly available on a website that the company hosts in an Amazon S3 bucket.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS CodeBuild project. Set the public repository as the source. Use a webhook to rebuild when the company pushes a code change. Configure the artifacts section of the project to use the S3 bucket as the destination. Set up an appropriate path to store build outputs in the bucket. Disable artifact encryption.
B. Create an AWS CodeBuild project. Set the public repository as the source. Configure the artifacts section of the project to use the S3 bucket as the destination. Ensure that artifact encryption is enabled in the artifacts configuration. Configure an Amazon EventBridge rule to initiate the CodeBuild project on a daily schedule.
C. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Update the pipeline to run in response to pull requests to the public repository.
D. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Create an Amazon EventBridge rule to initiate the pipeline on a daily schedule.
Show Answer
Correct Answer: D
Explanation: The company already uses AWS CodePipeline to build the artifacts. Adding a final stage to publish artifacts to an S3 bucket reuses the existing pipeline instead of creating new build infrastructure, minimizing operational overhead. An Amazon EventBridge rule can trigger the pipeline on a daily schedule, satisfying the requirement for daily builds. Other options either introduce a separate CodeBuild project, rely on webhooks or pull requests instead of a daily schedule, or increase management complexity.
Question 23
A company uses AWS Organizations, AWS Control Tower, AWS Config, and Terraform to manage its AWS accounts and resources. The company must ensure that users deploy only AWS Lambda functions that are connected to a VPC in member AWS accounts.
Which solution will meet these requirements with the LEAST operational effort?
A. Configure AWS Control Tower to use proactive controls (guardrails). Enable the optional controls (guardrails) implemented with AWS CloudFormation hooks for Lambda on all OUs.
B. Create a new SCP. Include a conditional statement that uses a StringEquals condition operator to check the lambd:Vpclds condition key against a list of VPC IDs. Configure the SCP to allow the lambda CreateFunction action and the lambda UpdateFunctionConfiguration action if the value of the condition key matches one of the VPC IDs.
C. Create a custom rule in AWS Config to detect Lambda functions that are not connected to a VPC when any Lambda function is created or updated.
D. Create a new SCP. Include a conditional statement that uses a Null condition operator to determine whether the lambda Vpclds condition key is absent. Configure the SCP to deny the lambda CreateFunction action and the lambda UpdateFunctionConfiguration action if the condition key is absent.
Show Answer
Correct Answer: D
Explanation: An SCP that denies Lambda CreateFunction and UpdateFunctionConfiguration when the lambda:VpcIds condition key is null enforces the requirement at the IAM authorization boundary for all tools, including Terraform. This provides preventive, tool-agnostic control with minimal operational effort. Control Tower proactive controls rely on CloudFormation hooks (can be bypassed by Terraform), and AWS Config rules are detective, not preventive.
Question 24
A company needs to update its order processing application to improve resilience and availability. The application requires a stateful database and uses a single-node Amazon RDS DB instance to store customer orders and transaction history. A DevOps engineer must make the database highly available.
Which solution will meet this requirement?
A. Migrate the database to Amazon DynamoDB global tables. Configure automatic failover between AWS Regions by using Amazon Route 53 health checks.
B. Migrate the database to Amazon EC2 instances in multiple Availability Zones. Use Amazon Elastic Block Store (Amazon EBS) Multi-Attach to connect all the instances to a single EBS volume.
C. Use the RDS DB instance as the source instance to create read replicas in multiple Availability Zones. Deploy an Application Load Balancer to distribute read traffic across the read replicas.
D. Modify the RDS DB instance to be a Multi-AZ deployment. Verify automatic failover to the standby instance if the primary instance becomes unavailable.
Show Answer
Correct Answer: D
Explanation: An Amazon RDS Multi-AZ deployment provides synchronous replication to a standby instance in a different Availability Zone and supports automatic failover if the primary instance becomes unavailable. This directly improves availability and resilience for a stateful database with minimal application changes. The other options either do not provide proper write availability, are not suitable for shared storage, or require a complete redesign.
Question 24
A DevOps engineer is planning to use the AWS Cloud Development Kit (AWS CDK) to manage infrastructure as code (IaC) for a microservices-based application. The DevOps engineer must create reusable components for common infrastructure patterns and must apply the same cost allocation tags across different microservices.
Which solution will meet these requirements?
A. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the custom CDK construct library to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment-specific configurations
B. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the custom CDK construct library to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.
C. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the Service Catalog products to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment-specific configurations.
D. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the Service Catalog products to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.
Show Answer
Correct Answer: B
Explanation: Reusable infrastructure patterns in AWS CDK are best implemented with a custom construct library. Cost allocation tags should be applied consistently across all resources by using the CDK Tags class, which applies tags via aspects across the entire app or stacks. In a microservices architecture, each microservice should be deployed as a separate stack to allow independent deployment and lifecycle management. Option B satisfies all these requirements.
Question 25
A company is developing an ecommerce application on AWS. The company wants to make sure that the application can handle sudden increases in traffic.
The company uses AWS CodePipeline for its CI/CD process. The company must implement a solution to integrate automated load testing into the CI/CD pipeline to validate the application's performance. The solution must perform production deployment only if the performance exceeds a threshold.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy the application by using AWS Elastic Beanstalk. Enable load balancing. Use Elastic Beanstalk to deploy tools for load tests. Run the tests during each deployment, and roll back the deployment if performance thresholds are unmet. Create an AWS Lambda function to monitor test metrics. Set up alarms for performance thresholds. Configure Amazon EventBridge to return an error if a test fails and to proceed with production deployment if a test passes.
B. Implement AWS Fargate tasks to run tools for load tests. Use Amazon Elastic container Service (Amazon ECS) to manage the test containers. Create AWS Lambda functions to analyze the test results. Integrate the functions with CodePipeline by using custom actions to initiate and evaluate the tests. Program the functions to return an error if a test fails and to proceed with production deployment if a test passes.
C. Launch Amazon EC2 instances to run tools for load tests. Store test scripts in a GitHub repository. Use AWS Step Functions to orchestrate the tests and result analysis in the CodePipeline workflow. Use Amazon EventBridge to invoke an AWS Lambda function based on the test results. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.
D. Use AWS CodeBuild to run tools for load tests, store the test artifacts in Amazon S3, and configure a CodePipeline stage to invoke the CodeBuild project. Use Amazon CloudWatch to monitor the test metrics and to set up alarms for performance thresholds. Integrate an AWS Lambda function into the pipeline by using a custom action. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.
Show Answer
Correct Answer: D
Explanation: AWS CodeBuild is fully managed, integrates natively with AWS CodePipeline, and is designed to run automated tests without managing servers or clusters. Load-testing tools can run as a pipeline stage, and the build can fail automatically if performance thresholds are not met, preventing promotion to production. CloudWatch provides native metrics and alarms, and S3 stores artifacts, resulting in the least operational overhead compared with managing Elastic Beanstalk, ECS/Fargate, EC2, or Step Functions orchestration.
Question 25
A company has an application that streams logs to an Amazon CloudWatch Logs log group. The logs must be available for the team to search in CloudWatch for at least 30 days. Logs must be accessible with low latency for at least 90 days. After 180 days, log retrieval is rare and latency is not important.
A DevOps engineer creates an Amazon S3 bucket to store the logs. Log availability metrics and data protection are important to the company.
Which solution will meet these requirements in the MOST cost-effective way?
A. Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Kinesis Data Streams to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon Glacier Flexible Retrieval after 180 days.
B. Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 90 days and to Amazon S3 Glacier Flexible Retrieval after 180 days.
C. Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Kinesis Data Streams to send log events to the S3 bucket by writing files. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Instant Retrieval after 180 days.
D. Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Deep Archive after 180 days.
Show Answer
Correct Answer: D
Explanation: Logs must be searchable in CloudWatch for 30 days, so a 30‑day log group retention satisfies that. For exporting logs to S3 cost‑effectively, a CloudWatch Logs subscription filter with Amazon Data Firehose is the standard, managed, low‑cost approach. Using S3 Standard‑IA after 90 days meets the low‑latency access requirement, and transitioning to S3 Glacier Deep Archive after 180 days minimizes storage cost when retrieval is rare and latency is unimportant. Options using CloudWatch Logs Infrequent Access are invalid for subscription filters, and One Zone‑IA does not meet data protection requirements.
Question 26
A company uses a pipeline in AWS CodePipeline to deploy an application. The company created an AWS Fault Injection Service (AWS FIS) experiment template to test the resiliency of the application. A DevOps engineer needs to integrate the experiment into the pipeline.
Which solution will meet this requirement?
A. Configure a new stage in the pipeline that includes an AWS FIS action. Configure the action to reference the AWS FIS experiment template. Grant the pipeline access to start the experiment.
B. Create an Amazon EventBridge scheduler. Grant the scheduler permission to start the AWS FIS experiment. Configure a new stage in the pipeline that includes an action to invoke the EventBridge scheduler.
C. Create an AWS Lambda function to start the AWS FIS experiment. Grant the Lambda function permission to start the experiment. Create a new stage in the pipeline that has a Lambda action. Set the action to invoke the Lambda function.
D. Export the AWS FIS experiment template to an Amazon S3 bucket. Create an AWS CodeBuild unit test project that has a buildspec that starts the AWS FIS experiment. Grant the CodeBuild project access to start the experiment. Configure a new stage in the pipeline that includes an action to run the CodeBuild unit test project.
Show Answer
Correct Answer: C
Explanation: AWS CodePipeline does not provide a native action to start AWS Fault Injection Service (FIS) experiments. To integrate an FIS experiment into a pipeline, a custom action is required. Using an AWS Lambda function is the standard and supported approach: the Lambda function can call the AWS FIS StartExperiment API, is easily granted the required IAM permissions, and can be invoked directly by a CodePipeline Lambda action stage. Other options either rely on non-existent native actions or add unnecessary indirection.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.