A company needs to manage shared libraries for various projects across its development AWS account and production AWS account. The company has configured IAM roles for developers and has defined an AWS CodePipeline pipeline by using the AWS Cloud Development Kit (AWS CDK).
A DevOps engineer must implement a solution to ensure that only developers can access the latest versions of the libraries. The solution must test shared packages independently before the shared packages are consumed by other applications and before they go to production.
Which solution will meet these requirements?
A. Create a single AWS CodeArtifact repository for development and production in a central account. Use IAM policies for the developer roles to allow only developers to access the shared libraries. Create an Amazon EventBridge role to start an AWS CodeBuild project and to test each package before the package is copied to the production repository.
B. Create an AWS CodeArtifact repository in the development account. Create another CodeArtifact repository in the production account. For the development repository, add a repository policy that allows only developers to access the shared libraries. Create an Amazon EventBridge rule to start the CodePipeline pipeline and to test each package before the package is copied to the production repository.
C. Create a single Amazon S3 bucket with versioning enabled for development and production in a central account. Use IAM policies for the developer roles to allow only the developers to access the shared libraries. Create an Amazon EventBridge rule to start an AWS CodeBuild project and to test each package before the package is copied to production.
D. Create an Amazon S3 bucket with versioning enabled in the development account. Create another S3 bucket with versioning enabled in the production account. For the development S3 bucket, add a bucket policy that allows only developers to access the shared libraries. Create an Amazon EventBridge role to start the CodePipeline pipeline. Configure the role to test each package when the package is copied to production and to revert the changes if the tests fail.
Show Answer
Correct Answer: B
Explanation: AWS CodeArtifact is the appropriate managed artifact repository for shared libraries. Using separate repositories in development and production supports promotion after validation. Restricting the development repository to developer access ensures only developers can consume the latest library versions. An EventBridge rule can trigger the existing CodePipeline to test packages before promotion to the production repository. S3 is not a package repository, and a single repository does not provide a clean promotion boundary.
Question 43
A company manages its multi-account environment by using AWS Organizations and AWS Control Tower. The company must deploy standardized security controls and compliance policies across all of its AWS accounts and AWS Regions. Any changes to these controls must be automatically applied to all accounts simultaneously.
The company has the required security controls and compliance policies defined in AWS Cloud Development Kit (AWS CDK) as a security controls construct.
Which solution will deploy these controls across all accounts and Regions with the LEAST operational overhead?
A. Create an AWS CDK app that includes an AWS CloudFormation StackSets construct. Configure the StackSets construct to use the security controls construct as its template. Specify the target accounts and Regions. Create automation to deploy the CDK app to create and manage the CloudFormation stack set.
B. Create an AWS CDK app that synthesizes an AWS CloudFormation template from the security controls construct. Use Amazon EventBridge to invoke an AWS Lambda function to update a CloudFormation stack set when changes are made to the security controls construct.
C. Convert the security controls construct to an AWS CloudFormation macro. Create a CloudFormation stack set that references the macro and deploys the macro to all target accounts. Use Organizations to automatically add new accounts to the stack set’s list of target accounts.
D. Use AWS Control Tower to create a customized landing zone that includes configurations from the security controls construct. Configure AWS Control Tower to automatically enroll new accounts and to apply the landing zone template.
Show Answer
Correct Answer: A
Explanation: AWS CDK can directly define CloudFormation StackSets. Service-managed StackSets integrated with AWS Organizations deploy stacks across accounts and Regions and automatically target new accounts/OUs. Reusing the existing CDK construct as part of a CDK app is the most appropriate approach. The other options either require extra custom automation (B), misuse CloudFormation macros (C), or describe Control Tower capabilities that do not deploy arbitrary CDK constructs via a customized landing zone (D).
Sources:
https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html
Question 44
A company has an application that uses an Amazon API Gateway REST API, AWS Lambda functions, and an Amazon DynamoDB table. The application currently runs in a single AWS Region. The company wants to make the application highly available across two Regions. User traffic must be routed to the Region that provides the least latency.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a replica of the DynamoDB table in a second Region.
B. Create a global secondary index for the DynamoDB table.
C. Create copies of the REST API and the Lambda functions in a second Region.
D. Create health checks in Amazon Route 53. Create DNS records that include a failover routing policy.
E. Create health checks in Amazon Route 53. Create DNS records that include a latency routing policy.
F. Create DNS records in Amazon Route 53 that include a multivalue answer routing policy.
Show Answer
Correct Answer: A, C, E
Explanation: To achieve a highly available multi-Region architecture, replicate the DynamoDB table using DynamoDB global tables so each Region has a local writable replica. Deploy identical API Gateway REST APIs and Lambda functions in the second Region. Use Amazon Route 53 latency-based routing with health checks so users are directed to the lowest-latency healthy Regional endpoint. A global secondary index does not provide cross-Region replication, failover routing does not meet the lowest-latency requirement, and multivalue answer routing is not intended for latency-based Regional routing.
Question 45
A company wants to build a pipeline to update the standard AMI monthly. The AMI must be updated to use the most recent patches to ensure that launched Amazon EC2 instances are up to date. Each new AMI must be available to all AWS accounts in the company's organization in AWS Organizations.
The company needs to configure an automated pipeline to build the AMI.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an AWS CodePipeline pipeline that uses AWS CodeBuild. Create an AWS Lambda function to run the pipeline every month. Create an AWS CloudFormation template. Share the template with all AWS accounts in the organization.
B. Create an AMI pipeline by using EC2 Image Builder. Configure the pipeline to distribute the AMI to the AWS accounts in the organization. Configure the pipeline to run monthly.
C. Create an AWS CodePipeline pipeline that runs an AWS Lambda function to build the AMI. Configure the pipeline to share the AMI with the AWS accounts in the organization. Configure Amazon EventBridge Scheduler to invoke the pipeline every month.
D. Create an AWS Systems Manager Automation runbook. Configure the automation to run in all AWS accounts in the organization. Create an AWS Lambda function to run the automation every month.
Show Answer
Correct Answer: B
Explanation: EC2 Image Builder is the managed AWS service designed specifically to automate creation, patching, testing, scheduling, and distribution of AMIs. It supports recurring builds (such as monthly) and can distribute AMIs across AWS accounts, including within an AWS Organizations environment, making it the most operationally efficient solution.
Question 46
A company uses Amazon RDS for Microsoft SQL Server as its primary database for applications. The company needs to ensure high availability within and across AWS Regions.
An Amazon Route 53 CNAME record is configured for the database endpoint. The applications connect to the database endpoint. The company must redirect application traffic to a standby database during a failover event. The company must maintain an RPO of less than 1 minute and an RTO of less than 10 minutes.
Which solution will meet these requirements?
A. Deploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment that uses cross-Region read replicas. Use automation to promote the read replica to a standalone instance and to update the Route 53 record.
B. Deploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment. Set up automated snapshots to be copied to another Region every 5 minutes. Use AWS Lambda to restore the latest snapshot in the secondary Region during failover.
C. Deploy an Amazon RDS for SQL Server Single-AZ DB instance. Use AWS Database Migration Service (AWS DMS) to replicate data continuously to an RDS DB instance in another Region. Use Amazon CloudWatch alarms to notify the company about failover events.
D. Deploy an Amazon RDS for SQL Server Single-AZ DB instance. Configure AWS Backup to create cross-Region backups every 30 seconds. Use automation to restore the latest backup and to update the Route 53 record during failover.
Show Answer
Correct Answer: A
Explanation: The requirements are high availability within a Region and across Regions, with RPO under 1 minute and RTO under 10 minutes. Amazon RDS for SQL Server Multi-AZ provides synchronous high availability within a Region. Cross-Region read replicas for RDS for SQL Server provide near-real-time replication to another Region; during a regional disaster, the replica can be promoted and DNS (Route 53 CNAME) updated via automation. Snapshot-based approaches cannot meet the RPO/RTO targets, and the Single-AZ options do not provide the required intra-Region high availability.
Question 47
A company has a workflow that generates a file for each of the company's products and stores the files in a production environment Amazon S3 bucket. The company's users can access the S3 bucket.
Each file contains a product ID. Product IDs for products that have not been publicly announced are prefixed with a specific UUID. Product IDs are 12 characters long. IDs for products that have not been publicly announces begin with the letter P.
The company does not want information about products that have not been publicly announced to be available in the production environment S3 bucket.
Which solution will meet these requirements?
A. Create a new staging S3 bucket. Generate all files in the new staging bucket. Create an Amazon Macie custom data identifier to identify product IDs in the new bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.
B. Create an Amazon Macie custom data identifier to identify product IDs in the production bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Remove all files that have a Macie finding from the production S3 bucket.
C. Create a new staging S3 bucket. Generate all files in the new staging bucket. Launch an Amazon Macie sensitive data discovery job with a managed data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.
D. Create an Amazon Macie sensitive data discovery job with a managed data identifier. Remove all files that have a Macie finding from the production S3 bucket.
Show Answer
Correct Answer: A
Explanation: The requirement is to prevent files containing unannounced product IDs from ever appearing in the production S3 bucket. The correct approach is to generate files in a staging bucket, use an Amazon Macie sensitive data discovery job with a custom data identifier that matches the company's specific product ID pattern (such as the UUID/prefix pattern), and copy only files without findings into the production bucket. Managed data identifiers would not detect this custom format, and scanning the production bucket is reactive rather than preventive.
Question 48
A company is migrating its web application to AWS. The application uses WebSocket connections for real-time updates and requires sticky sessions.
A DevOps engineer must implement a highly available architecture for the application. The application must be accessible to users worldwide with the least possible latency.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy an Application Load Balancer (ALB). Deploy another ALB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the ALBs. Integrate the ALBs with Amazon Route 53 latency-based routing.
B. Deploy a Network Load Balancer (NLB). Deploy another NLB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the NLBs. Integrate the NLBs with Amazon Route 53 geolocation routing.
C. Deploy a Network Load Balancer (NLB) with cross-zone load balancing enabled. Configure the NLB with IP-based targets in multiple Availability Zones. Use Amazon CloudFront for global content delivery. Implement sticky sessions by using source IP address preservation on the NLB.
D. Deploy an Application Load Balancer (ALB) for HTTP traffic. Deploy a Network Load Balancer (NLB) in each of the company’s AWS Regions for WebSocket connections. Enable sticky sessions on the ALB. Configure the ALB to forward requests to the NLB.
Show Answer
Correct Answer: A
Explanation: Application Load Balancers natively support WebSocket connections and application cookie-based sticky sessions. Deploying an ALB in each Region with cross-zone load balancing provides high availability across Availability Zones, and Route 53 latency-based routing directs users to the lowest-latency Region globally. NLB does not support cookie-based sticky sessions, CloudFront is not the right solution for globally routing WebSocket origins in this scenario, and ALB cannot forward requests to an NLB.
Question 49
A company has a web application that is hosted on Amazon EC2 instances. The company is deploying the application into multiple AWS Regions.
The application consists of dynamic content such as WebSocket-based real-time product updates. The company uses Amazon Route 53 to manage all DNS records.
Which solution will provide multi-Region access to the application with the LEAST latency?
A. Deploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Create a Route 53 A record with a latency-based routing policy. Add IP addresses of the ALBs as the value of the record.
B. Deploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Deploy an Amazon CloudFront distribution with an origin group that contains the ALBs as origins. Create a Route 53 alias record that points to the CloudFront distribution's DNS address.
C. Deploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Create a Route 53 A record with a multivalue answer routing policy. Add IP addresses of the NLBs as the value of the record.
D. Deploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Deploy an AWS Global Accelerator standard accelerator with an endpoint group for each NLB. Create a Route 53 alias record that points to the accelerator's DNS address.
Show Answer
Correct Answer: D
Explanation: AWS Global Accelerator provides a pair of anycast static IP addresses and routes users over the AWS global network to the optimal regional endpoint, minimizing latency and improving performance for TCP/WebSocket traffic. Using NLBs as Global Accelerator endpoints is a supported architecture. Route 53 can alias to the accelerator for a single global entry point. The other options rely on DNS routing or CloudFront, which is not the best fit for dynamic WebSocket-based multi-Region latency optimization.
Question 50
A company uses Amazon API Gateway and AWS Lambda functions to implement an API. The company uses a pipeline in AWS CodePipeline to build and deploy the API. The pipeline contains a source stage, build stage, and deployment stage.
The company deploys the API without performing smoke tests. Soon after the deployment, the company observes multiple issues with the API. A security audit finds security vulnerabilities in the production code.
The company wants to prevent these issues from happening in the future.
Which combination of steps will meet this requirement? (Choose two.)
A. Create a smoke test script that returns an error code if the API code fails the test. Add an action in the deployment stage to run the smoke test script after deployment. Configure the deployment stage for automatic rollback.
B. Create a smoke test script that returns an error code if the API code fails the test. Add an action in the deployment stage to run the smoke test script after deployment. Configure the deployment stage to fail if the smoke test script returns an error code.
C. Add an action in the build stage that uses Amazon Inspector to scan the Lambda function code after the code is built. Configure the build stage to fail if the scan returns any security findings.
D. Add an action in the build stage to run an Amazon CodeGuru code scan after the code is built. Configure the build stage to fail if the scan returns any security findings.
E. Add an action in the deployment stage to run an Amazon CodeGuru code scan after deployment. Configure the deployment stage to fail if the scan returns any security findings.
Show Answer
Correct Answer: A, D
Explanation: Post-deployment smoke tests should trigger automatic rollback to avoid leaving a bad deployment in production. For security, run Amazon CodeGuru code analysis during the build stage and fail the build on findings so vulnerable code is blocked before deployment.
Question 51
A DevOps engineer is creating a CI/CD pipeline to build container images. The engineer needs to store container images in Amazon Elastic Container Registry (Amazon ECR) and scan the images for common vulnerabilities. The CI/CD pipeline must be resilient to outages in upstream source container image repositories.
Which solution will meet these requirements?
A. Create an ECR private repository in the private registry to store the container images and scan images when images are pushed to the repository. Configure a replication rule in the private registry to replicate images from upstream repositories.
B. Create an ECR public repository in the public registry to cache images from upstream source repositories. Create an ECR private repository to store images. Configure the private repository to scan images when images are pushed to the repository.
C. Create an ECR public repository in the public registry. Configure a pull through cache rule for the repository. Create an ECR private repository to store images. Configure the ECR private registry to perform basic scanning.
D. Create an ECR private repository in the private registry to store the container images. Enable basic scanning for the private registry, and create a pull through cache rule.
Show Answer
Correct Answer: D
Explanation: A pull-through cache rule in an Amazon ECR private registry caches images from upstream public registries, allowing builds to continue during upstream outages. A private ECR repository stores the built images, and enabling basic scanning on the private registry provides vulnerability scanning for common CVEs. Replication rules are for cross-region/account replication, not upstream caching, and pull-through cache is configured on private registries, not public repositories.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.