A company is implementing a standardized security baseline across its AWS accounts. The accounts are in an organization in AWS Organizations.
The company must deploy consistent IAM roles and policies across all existing and future accounts in the organization.
Which solution will meet these requirements with the MOST operational efficiency?
A. Enable AWS Control Tower in the management account. Configure AWS Control Tower Account Factory customization to deploy the required IAM roles and policies to all accounts.
B. Activate trusted access for AWS CloudFormation StackSets in Organizations. In the management account, create a stack set that has service-managed permissions to deploy the required IAM roles and policies to all accounts. Enable automatic deployment for the stack set.
C. In each member account, create IAM roles that have permissions to create and manage resources. In the management account, create an AWS CloudFormation stack set that has self-managed permissions to deploy the required IAM roles and policies to all accounts. Enable automatic deployment for the stack set.
D. In the management account, create an AWS CodePipeline pipeline. Configure the pipeline to use AWS CloudFormation to automate the deployment of the required IAM roles and policies. Set up cross-account IAM roles to allow CodePipeline to deploy resources in the member accounts.
Show Answer
Correct Answer: B
Explanation: AWS CloudFormation StackSets with service-managed permissions integrate directly with AWS Organizations. By activating trusted access, a single StackSet can deploy IAM roles and policies across all existing organization accounts and automatically deploy to new accounts when automatic deployment is enabled. This avoids manually creating cross-account roles and is more operationally efficient than self-managed StackSets, CodePipeline orchestration, or adopting Control Tower solely for this requirement.
Question 53
A company is implementing a CI/CD pipeline for an application by using AWS CodePipeline and AWS CodeBuild. The company needs a solution to run unit tests and automatically generate code coverage reports before any code is deployed to production. The CI/CD pipeline execution must fail if the code coverage is less than 80%.
Which solution will meet these requirements?
A. Create an AWS Lambda function to run unit tests and generate code coverage reports. Add a Lambda invoke action to a stage in the CodePipeline pipeline. Create an Amazon EventBridge scheduled rule to run hourly to monitor the Lambda function's output. Configure the rule to fail the pipeline if coverage is less than 80%.
B. Create an AWS Step Functions workflow to run unit tests and generate code coverage reports. Add a Step Functions test action to a stage in the CodePipeline pipeline to invoke the workflow. Configure the workflow to fail if the code coverage is less than 80%.
C. Create a CodeBuild project with a buildspec.yml file that includes commands to run unit tests and generate code coverage reports. Add a CodeBuild test action to a stage in the CodePipeline pipeline. Configure the CodeBuild test action to use the source artifacts from the source action as input. Modify the buildspec.yml file to fail the build if coverage is less than 80%.
D. Create a CodeBuild project with Jenkins installed. Configure Jenkins to run unit tests and generate code coverage reports. Add a Jenkins test action to a stage in the CodePipeline pipeline. Configure the Jenkins test action to output the coverage report as an output artifact. Configure an approval action to fail the pipeline if code coverage is less than 80%.
Show Answer
Correct Answer: C
Explanation: AWS CodeBuild is the native service for running builds, unit tests, and generating code coverage reports as part of a CI/CD pipeline. A buildspec.yml file can execute the test suite, generate coverage, and explicitly fail the build when coverage is below 80%. CodePipeline will then fail at the CodeBuild action, preventing deployment to production. The other options either rely on inappropriate services (Lambda, Step Functions), unsupported action types, or unnecessary Jenkins infrastructure and manual approval rather than automatic enforcement.
Question 54
A company is developing a microservices-based application on AWS. The application consists of AWS Lambda functions and Amazon Elastic Container Service (Amazon ECS) services that need to be deployed frequently.
A DevOps engineer needs to implement a consistent deployment solution across all components of the application. The solution must automate the deployments, minimize downtime during updates, and manage configuration data for the application.
Which solution will meet these requirements with the LEAST development effort?
A. Use AWS CloudFormation to define and provision the Lambda functions and ECS services. Implement stack updates with resource replacement for all components. Use AWS Secrets Manager to manage the configuration data.
B. Use AWS CodeDeploy to manage deployments for the Lambda functions and ECS services. Implement canary deployments for the Lambda functions. Implement blue/green deployments for the ECS services. Use AWS Systems Manager Parameter Store to manage the configuration data.
C. Use AWS Step Functions to orchestrate deployments for the Lambda functions and ECS services. Use canary deployments for the Lambda functions and ECS services in a different AWS Region. Use AWS Systems Manager Parameter Store to manage the configuration data.
D. Use AWS Systems Manager to manage deployments for the Lambda functions and ECS services. Implement all-at-once deployments for the Lambda functions. Implement rolling updates for the ECS services. Use AWS Secrets Manager to manage the configuration data.
Show Answer
Correct Answer: B
Explanation: AWS CodeDeploy natively supports deployments for both AWS Lambda and Amazon ECS. Canary deployments for Lambda and blue/green deployments for ECS minimize downtime and deployment risk with little custom development. AWS Systems Manager Parameter Store is appropriate for managing application configuration data. CloudFormation is primarily provisioning infrastructure rather than deployment orchestration, Step Functions is not the standard deployment service for this purpose, and Systems Manager does not natively provide the requested deployment capabilities across both services.
Question 55
A company is running its ecommerce website on AWS. The website is currently hosted on a single Amazon EC2 instance in one Availability Zone. A MySQL database runs on the same EC2 instance.
The company needs to eliminate single points of failure in the architecture to improve the website's availability and resilience.
Which solution will meet these requirements with the LEAST configuration changes to the website?
A. Deploy the application by using AWS Fargate containers. Migrate the database to Amazon DynamoDB. Use Amazon API Gateway to route requests.
B. Deploy the application on EC2 instances across multiple Availability Zones. Put the EC2 instances into an Auto Scaling group behind an Application Load Balancer. Migrate the database to Amazon Aurora Multi-AZ. Use Amazon CloudFront for content delivery.
C. Use AWS Elastic Beanstalk to deploy the application across multiple AWS Regions. Migrate the database to Amazon Redshift. Use Amazon ElastiCache for session management.
D. Migrate the application to AWS Lambda functions. Use Amazon S3 for static content hosting. Migrate the database to Amazon DocumentDB (with MongoDB compatibility).
Show Answer
Correct Answer: B
Explanation: Running the existing EC2 application across multiple Availability Zones in an Auto Scaling group behind an Application Load Balancer removes the web-tier single point of failure with minimal application changes. Migrating MySQL to Amazon Aurora Multi-AZ provides a highly available relational database with strong MySQL compatibility, requiring far fewer changes than switching to DynamoDB, DocumentDB, or Redshift. CloudFront is an optional enhancement for content delivery and does not require major application changes.
Question 56
A company has multiple development teams in separate business units that work in a single shared AWS account. All Amazon EC2 resources that users create in the account must include tags that specify which user created the resources. The tagging must occur within the first hour of resource creation.
A DevOps engineer needs to add tags to new resources that include the ID of the user that created the resource and the appropriate cost center ID. The DevOps engineer configures an AWS Lambda function to use the cost center mappings to tag the resources. The DevOps engineer also sets up AWS CloudTrail in the shared AWS account. An Amazon S3 bucket stores the CloudTrail event logs.
Which solution will meet the tagging requirements?
A. Create an S3 event notification on the S3 bucket to invoke the Lambda function for s3:ObjectTagging:Put events. Enable bucket versioning on the S3 bucket.
B. Enable server access logging on the S3 bucket. Create an S3 event notification on the S3 bucket for s3:ObjectTagging:* events.
C. Enable AWS Config in the account. Configure the required-tags AWS managed rule to check and update the required tags.
D. Create an Amazon EventBridge rule that uses Amazon EC2 as the event source. Configure the rule to match events that CloudTrail delivers. Configure the rule to target the Lambda function.
Show Answer
Correct Answer: D
Explanation: Amazon EventBridge can match AWS API calls delivered through CloudTrail, such as EC2 resource creation events. The Lambda function can extract the creator's identity from the CloudTrail event, look up the appropriate cost center, and tag the new EC2 resources shortly after creation, satisfying the requirement to tag within one hour. The S3 notification options react to CloudTrail log object activity rather than EC2 creation events, and AWS Config required-tags detects noncompliance but does not automatically update tags.
Question 57
A company has a web application that publishes logs that contain metadata for transactions, with a status of success or failure for each log. The logs are in JSON format. The application publishes the logs to an Amazon CloudWatch Logs log group.
The company wants to create a dashboard that displays the number of successful transactions.
Which solution will meet this requirement with the LEAST operational overhead?
A. Create an Amazon OpenSearch Service cluster and an OpenSearch Service subscription filter to send the log group data to the cluster. Create a dashboard within the Dashboards feature in the OpenSearch Service cluster by using a search query for transactions that have a status of success.
B. Create a CloudWatch subscription filter for the log group that uses an AWS Lambda function. Configure the Lambda function to parse the JSON logs and publish a custom metric to CloudWatch for transactions that have a status of success. Create a CloudWatch dashboard by using a metric graph that displays the custom metric.
C. Create a CloudWatch metric filter for the log groups with a filter pattern that matches the transaction status property and a value of success. Create a CloudWatch dashboard by using a metric graph that displays the new metric.
D. Create an Amazon Kinesis data stream that is subscribed to the log group. Configure the data stream to filter incoming log data based on a status of success and to send the filtered logs to an AWS Lambda function. Configure the Lambda function to publish a custom metric to CloudWatch. Create a CloudWatch dashboard by using a metric graph that displays the custom metric.
Show Answer
Correct Answer: C
Explanation: CloudWatch Logs metric filters can match JSON log fields (such as status=success) and automatically publish a CloudWatch metric that counts matching log events. A CloudWatch dashboard can graph that metric directly. This avoids managing Lambda, Kinesis, or OpenSearch, resulting in the least operational overhead.
Question 59
A company uses AWS Organizations to manage multiple AWS accounts. The accounts are in an OU that has a policy attached to allow all actions. The company is migrating several Git repositories to a specified AWS CodeConnections supported Git provider. The Git repositories manage AWS CloudFormation stacks for application infrastructure that the company deploys across multiple AWS Regions.
The company wants a DevOps team to integrate CodeConnections into the CloudFormation stacks. The DevOps team must ensure that company staff members can integrate only with the specified Git provider. The deployment process must be highly available across Regions.
Which combination of steps will meet these requirements? (Choose three.)
A. Add a new SCP statement to the OU that denies the CodeConnections CreatingConnections action where the provider type is not the specified Git provider.
B. Add a new SCP statement to the OU that allows the CodeConnections CreatingConnections action where the provider type is the specified Git provider.
C. Use CodeConnectlons to configure a single CodeConnections connection to each Git repository.
D. Use CodeConnections to create a CodeConnections connection from each Region where the company operates to each Git repository.
E. Use CodeConnections to create a CodeConnections repository link. Update each CfoudFormation stack to sync from the Git repository.
F. For each Git repository, create a pipeline in AWS CodePipefine that has the Git repository set as the source and a CloudFormation deployment stage.
Show Answer
Correct Answer: A, D, F
Explanation: An explicit SCP deny with a condition on provider type is the correct way to restrict use to only the approved Git provider, because SCPs primarily act as guardrails and explicit denies override broad allows. CodeConnections connections are regional resources, so creating a connection in each operating Region provides regional resilience. To deploy CloudFormation stacks from Git repositories, the standard integration is to use CodePipeline with the Git repository as the source and a CloudFormation deployment stage. A single connection is not highly available across Regions, and repository links are for resource association rather than replacing the deployment pipeline.
Question 60
A company has application code in an AWS CodeConnections compatible Git repository. The company wants to configure unit tests to run when pull requests are opened. The company wants to ensure that the test status is visible in pull requests when the tests are completed. The company wants to save output data files that the tests generate to an Amazon S3 bucket after the tests are finished.
Which combination of solutions will meet these requirements? (Choose three.)
A. Create an IAM service role to allow access to the resources that are required to run the tests. B Create a pipeline in AWS CodePipeline that has a test stage. Create a trigger to run the pipeline when pull requests are created or updated. Add a source action to report test results.
C. Create an AWS CodeBuild project to run the tests. Enable webhook triggers to run the tests when pull requests are created or updated. Enable build status reporting to report test results.
D. Create a buildspec.yml file that has a reports section to upload output files when the tests have finished running.
E. Create a buildspec.yml file that has an artifacts section to upload artifacts when the tests have finished running.
F. Create an appspec.yml file that has a files section to upload output files when the tests have finished running.
Show Answer
Correct Answer: A, C, E
Explanation: An AWS CodeBuild project is the appropriate service to run unit tests for pull requests from a CodeConnections-compatible repository. CodeBuild supports webhook triggers for pull request events and build status reporting back to the source provider so test status appears on the pull request. CodeBuild requires an IAM service role to access required AWS resources, including writing to Amazon S3. To save generated output files to S3 after the build, define them in the buildspec.yml artifacts section; CodeBuild uploads artifacts to the configured S3 location. The reports section is for test reports, not general output files, and appspec.yml is used by CodeDeploy, not CodeBuild.
Question 61
A software development team is implementing a CI/CD pipeline for its web application. The team is using AWS CodeBuild to compile Java-based source code and to run unit tests.
The team needs to store the artifacts that are created by the CodeBuild project.
Which solution will meet this requirement?
A. Create an Amazon S3 bucket. Configure the S3 bucket as an artifact output location in the project. Add the artifact locations to the project's buildspec file. Configure an S3 bucket policy that allows the CodeBuild project's resource access role to access the S3 bucket.
B. Create an Amazon S3 bucket. Configure the S3 bucket as an artifact output location in the project's buildspec file. Add the artifact locations to the project's buildspec file. Configure an S3 bucket policy that allows the CodeBuild service role to access the S3 bucket.
C. Configure an Amazon Elastic File System (Amazon EFS) file system as a file system location for the project. Configure the EFS file system as the artifact output location in the project's buildspec file. Configure a file system policy that allows CodeBuild to access the file system.
D. Create an Amazon Elastic Block Store (Amazon EBS) volume. Configure the EBS volume as the artifact output location in the project's buildspec file. Configure an IAM role that allows CodeBuild to access the volume.
Show Answer
Correct Answer: A
Explanation: AWS CodeBuild stores build artifacts in Amazon S3. The artifact output location is configured in the CodeBuild project (or via CodePipeline), while the buildspec defines which files to include as artifacts, not the destination bucket. The CodeBuild service role must have permission to write to the S3 bucket, typically via a bucket policy or IAM permissions. EFS and EBS are not supported as CodeBuild artifact output destinations.
Question 62
A company needs to update its order processing application to improve resilience and availability. The application requires a stateful database and uses a single-node Amazon RDS DB instance to store customer orders and transaction history. A DevOps engineer must make the database highly available.
Which solution will meet this requirement?
A. Migrate the database to Amazon DynamoDB global tables. Configure automatic failover between AWS Regions by using Amazon Route 53 health checks.
B. Migrate the database to Amazon EC2 instances in multiple Availability Zones. Use Amazon Elastic Block Store (Amazon EBS) Multi-Attach to connect all the instances to a single EBS volume.
C. Use the RDS DB instance as the source instance to create read replicas in multiple Availability Zones. Deploy an Application Load Balancer to distribute read traffic across the read replicas.
D. Modify the RDS DB instance to be a Multi-AZ deployment. Verify automatic failover to the standby instance if the primary instance becomes unavailable.
Show Answer
Correct Answer: D
Explanation: Amazon RDS Multi-AZ deployments are the standard high-availability option for relational databases. They maintain a synchronous standby in another Availability Zone and provide automatic failover if the primary instance becomes unavailable, improving resilience without changing the application architecture. Read replicas are primarily for read scaling and disaster recovery, not automatic HA failover. DynamoDB global tables require a database migration and different data model, and EC2 with EBS Multi-Attach is not a supported HA replacement for an RDS relational database.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.