A company has an organization in AWS Organizations. The organization has all features enabled and has AWS CloudTrail trusted access configured for the management account. An Amazon Simple Notification Service (Amazon SNS) topic is configured for notifications.
The company needs all AWS events in all AWS Regions in the organization to be recorded and retained in an audit account. The company needs near real-time notifications of any failed login attempts.
A DevOps engineer has created an organization trail in the management account to log events for all Regions.
Which solution will meet these requirements with the LEAST operational effort?
A. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account. In the audit account, create an Amazon EventBridge rule that reacts to failed login events in CloudTrail. Configure the EventBridge rule to notify the SNS topic.
B. Configure the trail to publish logs to a new Amazon S3 bucket in the management account. Configure an Amazon Athena table to read from the new S3 bucket. Create an AWS Lambda function that queries the Athena table for failed login events and publishes the findings to the SNS topic. Create an Amazon EventBridge scheduled rule to invoke the Lambda function every 5 minutes.
C. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account and a new Amazon CloudWatch log group in the management account. Create a CloudWatch Logs metric filter on the log group to create a custom metric for failed logins. Configure a CloudWatch alarm that uses the custom metric and notifies the SNS topic.
D. Configure the trail to publish logs to a new Amazon CloudWatch log group in the audit account. Create an Amazon Kinesis data stream in the audit account. Configure a subscription filter on the log group to send the logs to the data stream. Use Amazon Managed Service for Apache Flink to filter the data stream for failed logins. Publish the results to the SNS topic.
Show Answer
Correct Answer: C
Explanation: An organization trail can deliver all accounts and Regions’ events centrally to a single CloudWatch Logs log group. Creating one metric filter for failed login events and a CloudWatch alarm to notify SNS provides near real-time alerts with minimal setup. Other options add polling, cross-Region/EventBridge complexity, or streaming infrastructure, increasing operational effort.
Question 27
A company is developing code and wants to use semantic versioning. The company's DevOps team needs to create a pipeline for compiling the code. The team also needs to manage versions of the compiled code. If the code uses any open source libraries, the libraries must also be cached in the build process.
Which solution will meet these requirements?
A. Create an AWS CodeArtifact repository and associate the upstream repositories. Create an AWS CodeBuild project that builds the semantic version of the code artifacts. Configure the project to authenticate and connect to the CodeArtifact repository and publish the artifact to the repository.
B. Use AWS CodeDeploy to upload the generated semantic version of the artifact to an Amazon Elastic File System (Amazon EFS) file system.
C. Use an AWS CodeBuild project to build the code and to publish the generated semantic version of the artifact to AWS Artifact. Configure build caching in the CodeBuild project.
D. Create a new AWS CodeArtifact repository. Create an AWS Lambda function that pulls open source packages from the internet and publishes the packages to the repository. Configure AWS CodeDeploy to build semantic versions of the code and publish the versions to the repository.
Show Answer
Correct Answer: A
Explanation: AWS CodeArtifact is designed to store, version, and manage build artifacts and dependencies with native support for semantic versioning. By configuring upstream repositories, open source libraries are cached automatically during builds. AWS CodeBuild can compile the code, apply semantic versioning, authenticate to CodeArtifact, and publish the compiled artifacts. The other options misuse services (CodeDeploy, EFS, AWS Artifact, or Lambda) that are not intended for artifact versioning and dependency caching.
Question 27
A company runs a microservices application on Amazon Elastic Kubernetes Service (Amazon EKS). Users recently reported significant delays while accessing an account summary feature, particularly during peak business hours.
A DevOps engineer used Amazon CloudWatch metrics and logs to troubleshoot the issue. The logs indicated normal CPU and memory utilization on the EKS nodes. The DevOps engineer was not able to identify where the delays occurred within the microservices architecture.
The DevOps engineer needs to increase the observability of the application to pinpoint where the delays are occurring.
Which solution will meet these requirements?
A. Deploy the AWS X-Ray daemon as a DaemonSet in the EKS cluster. Use the X-Ray SDK to instrument the application code. Redeploy the application
B. Enable CloudWatch Container Insights for the EKS cluster. Use the Container Insights data to diagnose the delays.
C. Create alarms based on the existing CloudWatch metrics. Set up an Amazon Simple Notification Service (Amazon SNS) topic to send email alerts.
D. Increase the timeout settings in the application code for network operations to allow more time for operations to finish.
Show Answer
Correct Answer: A
Explanation: The issue occurs within a microservices architecture where node-level CPU and memory metrics are normal, indicating the latency is likely in service-to-service calls. AWS X-Ray provides distributed tracing, which increases application-level observability by showing how requests flow through each microservice and where time is spent. Deploying the X-Ray daemon on EKS and instrumenting the code allows pinpointing the exact source of delays. Other options only provide infrastructure metrics, alerts, or masking the problem rather than identifying it.
Question 28
A company has an AWS account named PipelineAccount. The account manages a pipeline in AWS CodePipeline. The account uses an IAM role named CodePipeline_Service_Role and produces an artifact that is stored in an Amazon S3 bucket. The company uses a customer managed AWS KMS key to encrypt objects in the S3 bucket.
A DevOps engineer wants to configure the pipeline to use an AWS CodeDeploy application in an AWS account named CodeDeployAccount to deploy the produced artifact.
The DevOps engineer updates the KMS key policy to grant the CodeDeployAccount account permission to use the key. The DevOps engineer configures an IAM role named DevOps_Role in the CodeDeployAccount account that has access to the CodeDeploy resources that the pipeline requires. The DevOps engineer updates an Amazon EC2 instance role that operates within the CodeDeployAccount account to allow access to the S3 bucket and the KMS key that is in the PipelineAccount account.
Which additional steps will meet these requirements?
A. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the CodePipeline_Service_Role IAM role to grant permission to assume the DevOps_Role role.
B. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the DevOps_Role IAM role to grant permission to assume CodePipelfne_Service_Role role.
C. Update the S3 bucket policy to grant the PipelineAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the CodePipeline_Service_Role IAM to grant permission to assume the DevOps_Role role.
D. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the CodeDeployAccount account to assume the role. Update the CodePipeline_Service_Role IAM role to grant permission to assume the DevOps_Role role.
Show Answer
Correct Answer: A
Explanation: For a cross-account CodePipeline to deploy with CodeDeploy, three things are required: (1) the artifact S3 bucket must allow access from the target account, (2) CodePipeline must be able to assume a role in the target account, and (3) that target role must trust the source account and allow CodeDeploy actions. The S3 bucket policy must grant CodeDeployAccount access to read the artifact. The DevOps_Role in CodeDeployAccount must trust PipelineAccount so CodePipeline can assume it. Finally, CodePipeline_Service_Role must have sts:AssumeRole permission on DevOps_Role. Option A correctly includes all of these steps.
Question 28
A company uses a trunk-based development branching strategy. The company has two AWS CodePipeline pipelines that are integrated with a Git provider. The pull_request pipeline has a branch filter that matches the feature branches. The main_branch pipeline has a branch filter that matches the main branch.
When pull requests are merged into the main branch, the pull requests are deployed by using the main_branch pipeline.
The company's developers need test results for all submitted pull requests as quickly as possible from the pull_request pipeline. The company wants to ensure that the main_branch pipeline’s test results finish and that each deployment is complete before the next pipeline execution.
Which solution will meet these requirements?
A. Configure the pull_request pipeline to use PARALLEL mode. Configure the main_branch pipeline to use QUEUED mode.
B. Configure the pull_request pipeline to use SUPERSEDED mode. Configure the main_branch pipeline to use QUEUED mode.
C. Configure the pull_request pipeline to use PARALLEL mode. Configure the main_branch pipeline to use SUPERSEDED mode
D. Configure the pull_request pipeline to use QUEUED mode. Configure the main_branch pipeline to use SUPERSEDED mode.
Show Answer
Correct Answer: A
Explanation: The pull_request pipeline must return test results as quickly as possible, which is best achieved by using PARALLEL mode so multiple pull request executions can run concurrently without waiting. The main_branch pipeline must ensure that tests finish and each deployment completes fully before the next execution begins, which requires QUEUED mode so executions run strictly one at a time in order. This combination satisfies both speed for pull requests and controlled, sequential deployments on the main branch.
Question 29
A DevOps team operates an integration service that runs on an Amazon EC2 instance. The DevOps team uses Amazon Route 53 to manage the integration service's domain name by using a simple routing record. The integration service is stateful and uses Amazon Elastic File System (Amazon EFS) for data storage and state storage. The integration service does not support load balancing between multiple nodes.
The DevOps team deploys the integration service on a new EC2 instance as a warm standby to reduce the mean time to recovery. The DevOps team wants the integration service to automatically fail over to the standby EC2 instance.
Which solution will meet these requirements?
A. Update the existing Route 53 DNS record's routing policy to weighted. Set the existing DNS record's weighting to 100. For the same domain, add a new DNS record that points to the standby EC2 instance. Set the new DNS record's weighting to 0. Associate an application health check with each record.
B. Update the existing Route 53 DNS record's routing policy to weighted. Set the existing DNS record's weighting to 99. For the same domain, add a new DNS record that points to the standby EC2 instance. Set the new DNS record's weighting to 1. Associate an application health check with each record.
C. Create an Application Load Balancer (ALB). Update the existing Route 53 record to point to the ALB. Create a target group for each EC2 instance. Configure an application health check on each target group. Associate both target groups with the same ALB listener. Set the primary target group's weighting to 100. Set the standby target group's weighting to 0.
D. Create an Application Load Balancer (ALB). Update the existing Route 53 record to point to the ALB. Create a target group for each EC2 instance. Configure an application health check on each target group. Associate both target groups with the same ALB listener. Set the primary target group's weighting to 99. Set the standby target group's weighting to 1.
Show Answer
Correct Answer: A
Explanation: The service is stateful and cannot handle traffic being split across multiple instances, so an Application Load Balancer is not suitable. Amazon Route 53 can provide DNS-based failover without load balancing. Using a weighted routing policy with health checks, assigning weight 100 to the primary instance and weight 0 to the standby ensures that all traffic goes to the primary during normal operation. When the primary instance fails its health check, Route 53 automatically stops returning that record and routes traffic to the standby instance, meeting the warm-standby automatic failover requirement.
Question 29
A company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations.
A DevOps team is responsible for the application deployment process across the environments. The deployment process uses an AWS CodePipeline pipeline in a Shared Services account. The DevOps team members are in the same user group. The team members have administrative access to all accounts through AWS IAM Identity Center.
A recent deployment problem in the development environment required the DevOps team to perform manual steps. The deployment to the production environment then resulted in an incident that caused the pipeline to fail, which blocked new deployments for several hours.
A DevOps engineer needs to ensure that only the pipeline can perform deployments in the production environment. The DevOps engineer must have access to the environment in case of an emergency.
Which solution will meet these requirements with the MOST operational efficiency?
A. Update the DevOps group to have the ReadOnlyAccess permission set for the production accounts. Configure the DevOps engineer user with a new permission set that has AdministratorAccess permissions and that allows the user to assume the pipeline role. Add an SCP that denies modification of resources by any entity other than the pipeline role.
B. Create an SCP that denies all write actions for the DevOps team members on the production OU. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the pipeline role.
C. Update the DevOps group to be able to assume the pipeline role for the production accounts. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the DevOps engineer.
D. Create an SCP that denies all write actions for the DevOps team members on the production OU. Use a specific tag to tag the resources that CodePipeline provisions. Add an SCP that denies modification of tagged resources by any entity other than the DevOps engineer.
Show Answer
Correct Answer: A
Explanation: An SCP that denies modifications by any principal other than the CodePipeline role ensures only the pipeline can deploy to production. Granting the DevOps group ReadOnlyAccess prevents accidental changes, while giving a single DevOps engineer an AdministratorAccess permission set with the ability to assume the pipeline role provides an emergency break-glass path. SCPs override IAM permissions, so this approach is secure and operationally efficient.
Question 30
A company hosts several applications in an AWS account. Each application sends logs to its own log group in Amazon CloudWatch. The company's CloudWatch costs for ingestion are increasing.
A DevOps engineer needs to identify which applications are the source of the increased logging costs.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Use CloudWatch metrics to create a custom expression that identifies the CloudWatch log groups that receive the most data.
B. Use Amazon CloudWatch Logs Insights to create a query for the application log groups to identify the number of log groups that received data during a specific time period.
C. Use AWS Cost Explorer to generate a cost report that details costs for CloudWatch usage.
D. Use AWS CloudTrail to filter for CreateLogStream events for each application.
Show Answer
Correct Answer: A
Explanation: CloudWatch Logs publishes the IncomingBytes metric per log group, which directly measures the volume of data ingested and therefore correlates to ingestion cost. Using metrics to identify log groups with the highest IncomingBytes is the most direct and operationally efficient way to pinpoint applications driving increased logging costs.
Question 30
A company is experiencing failures in its AWS CodeDeploy deployments for a critical application. The application is deployed on Amazon EC2 instances. A DevOps engineer must analyze the failed deployments to identify the root cause of the failures.
Which solution will provide the appropriate information to troubleshoot the deployment issues?
A. Configure VPC Flow Logs to monitor network traffic. Use Amazon Inspector to detect non-network deployment issues. Use Amazon Detective to analyze the findings.
B. Enable detailed monitoring on the EC2 instances. Use AWS Systems Manager Run Command to run troubleshooting scripts on all the EC2 instances simultaneously. Analyze the results in AWS CloudTrail logs.
C. Use Amazon CloudWatch Logs to review application logs. Analyze CodeDeploy deployment logs in the /opt/codedeploy-agent/deployment-root/ directory on the EC2 instances. Use AWS X-Ray to trace requests through the application components.
D. Examine AWS Trusted Advisor checks for the CodeDeploy deployments. Use the AWS Health Dashboard to monitor application health. Analyze performance metrics in Amazon CloudWatch dashboards.
Show Answer
Correct Answer: C
Explanation: AWS CodeDeploy troubleshooting relies primarily on deployment and lifecycle hook logs generated by the CodeDeploy agent on each EC2 instance. These logs, located under /opt/codedeploy-agent/deployment-root/, provide detailed error messages for failed hooks and scripts. Reviewing application logs in Amazon CloudWatch Logs enables centralized analysis, and AWS X-Ray can help correlate deployment-related issues with application request behavior. The other options focus on networking, general health checks, or metrics and do not provide the specific deployment failure details needed.
Question 31
A company has a search application that has a web interface. The company uses Amazon CloudFront, Application Load Balancers (ALBs), and Amazon EC2 instances in an Auto Scaling group with a desired capacity of 3. The company uses prebaked AMIs. The application starts in 1 minute. The application queries an Amazon OpenSearch Service cluster.
The application is deployed to multiple Availability Zones. Because of compliance requirements, the application needs to have a disaster recovery (DR) environment in a separate AWS Region. The company wants to minimize the ongoing cost of the DR environment and requires an RTO and an RPO of under 30 minutes. The company has created an ALB in the DR Region.
Which solution will meet these requirements?
A. Add the new ALB as an origin in the CloudFront distribution. Configure origin failover functionality. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 0 in the DR Region. Create a new OpenSearch Service cluster in the DR Region. Set up cross-cluster replication for the cluster.
B. Create a new CloudFront distribution in the DR Region and add the new ALB as an origin. Use Amazon Route 53 DNS for Regional failover. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 0 in the DR Region. Reconfigure the OpenSearch Service cluster as a Multi-AZ with Standby deployment. Ensure that the standby nodes are in the DR Region.
C. Create a new CloudFront distribution in the DR Region and add the new ALB as an origin. Use Amazon Route 53 DNS for Regional failover. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 3 in the DR Region. Reconfigure the OpenSearch Service cluster as a Multi-AZ with Standby deployment. Ensure that the standby nodes are in the DR Region.
D. Add the new ALB as an origin in the CloudFront distribution. Configure origin failover functionality. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 3 in the DR Region. Create a new OpenSearch Service cluster in the DR Region. Set up cross-cluster replication for the cluster.
Show Answer
Correct Answer: A
Explanation: An active-passive DR design minimizes ongoing cost while meeting <30‑minute RTO/RPO. Using CloudFront origin failover allows traffic to shift to the DR ALB without DNS changes. Keeping the DR Auto Scaling group at desired capacity 0 avoids steady-state compute cost, and instances can launch quickly from copied prebaked AMIs to meet RTO. Creating a separate OpenSearch cluster in the DR Region with cross-cluster replication provides near-real-time data replication and meets the RPO requirement. Options B and C are invalid because OpenSearch Multi-AZ does not span Regions, and C/D incur unnecessary ongoing cost by running instances in the DR Region.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.