A DevOps engineer needs to design a cloud-based solution to standardize deployment artifacts for AWS Cloud deployments and on-premises deployments. There is currently no routing traffic between the on-premises data center and the AWS environment.
The solution must be able to consume downstream packages from public repositories and must be highly available. Data must be encrypted in transit and at rest. The solution must store the deployment artifacts in object storage and deploy the deployment artifacts into Amazon Elastic Container Service (Amazon ECS). The deployment artifacts must be encrypted in transit if the deployment artifacts travel across the public internet.
The DevOps engineer needs to deploy this solution in less than two weeks.
Which solution will meet these requirements?
B. Use an AWS Direct Connect connection and a VPN connection to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
C. Use two AWS VPN connections to connect the on-premises data center to AWS. Use AWS CodeArtifact to store the deployment artifacts.
D. Use parallel AWS Direct Connect connections to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
Show Answer
Correct Answer: C
Explanation: The requirements emphasize rapid deployment (<2 weeks), high availability, encryption in transit and at rest, use of object storage–backed artifact management, and the ability to consume packages from public repositories without existing network connectivity. AWS CodeArtifact is a fully managed, highly available service that stores artifacts durably and supports encryption at rest and in transit, integrates natively with ECS-based workflows, and can proxy public repositories. Using AWS VPN connections can be provisioned quickly over the public internet and provides encrypted transit without the long lead time of Direct Connect. In contrast, Direct Connect and self-managed artifact managers on EC2 require more time and operational overhead, making them unsuitable for the timeline.
Question 32
A DevOps engineer needs to troubleshoot a pipeline that uses a GitHub code repository. The pipeline contains a source stage, a build stage, and a deploy stage. The pipeline also has an AWS CodeStar connection to the GitHub code repository.
The build stage uses an AWS CodeBuild build project. The build project needs to perform a git clone of the repository as part of the build process.
The DevOps engineer validates that the source stage is working properly. However, the build stage fails each time the pipeline runs.
What is the reason that the build stage fails in the pipeline?
A. The build stage within the pipeline needs to use the AWS CodeStar connection action.
B. The AWS CodeStar connection to GitHub contains incorrect credentials.
C. The AWS CodePipeline service role does not have permission to use the AWS CodeStar connection.
D. The AWS CodeBuild service role does not have permission to use the AWS CodeStar connection.
Show Answer
Correct Answer: D
Explanation: The source stage already works, which confirms that the AWS CodeStar connection and the CodePipeline service role are configured correctly. The failure occurs in the build stage because the CodeBuild project performs a git clone directly from GitHub. For this operation, the AWS CodeBuild service role must have permission to use the CodeStar connection (codestar-connections:UseConnection). Without this permission, the build stage cannot access the repository and fails.
Question 32
A company has an RPO of 24 hours and an RTO of 10 minutes for a critical web application that runs on Amazon EC2 instances. The company uses AWS Organizations to manage its AWS account. The company wants to set up AWS Backup for its AWS environment.
A DevOps engineer configures AWS Organizations for AWS Backup. The DevOps engineer creates a new centralized AWS account to store the backups. Each EC2 instance has four Amazon Elastic Block Store (Amazon EBS) volumes attached.
Which solution will meet this requirement MOST securely?
A. Create encrypted backup vaults and customer managed AWS KMS keys in both accounts. Configure AWS Backup to create full EC2 backups as AMIs. Copy the backups to the centralized vault.
B. Create encrypted vaults in both accounts by using the source account's AWS KMS key. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
C. Create backup vaults in both accounts. Use AWS managed keys for encryption. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
D. Create encrypted vaults in both accounts. Use a customer managed KMS key in the source account. Use an AWS managed key in the centralized account. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
Show Answer
Correct Answer: A
Explanation: The requirement emphasizes the MOST secure setup while meeting strict RPO/RTO for a critical EC2-based application. Creating EC2 backups as AMIs enables rapid recovery of the entire instance, including all attached EBS volumes, which supports the 10‑minute RTO. For security and cross-account backup copying, AWS best practice is to use customer managed KMS keys in both the source and centralized backup accounts. Customer managed keys provide granular access control, auditability, and explicit key policies that allow secure cross-account re-encryption when backups are copied. Options that rely on AWS managed keys or reuse a single account’s key reduce control and are less secure in a multi-account AWS Organizations setup.
Question 33
A company runs applications on Amazon EC2 instances that are in an Amazon EC2 Auto Scaling group. The EC2 instances are behind an Application Load Balancer (ALB). Users recently began to experience errors when traffic was directed to some of the EC2 instances.
A DevOps engineer discovers that the Auto Scaling group reports the problematic instances are healthy despite the application errors. User experience returns to normal after the DevOps engineer resolves the application errors on the problematic instances.
The company wants to ensure that traffic is routed only to healthy instances that are not experiencing application errors. The company also wants a support team to receive a notification if the traffic routing configuration changes.
Which solution will meet these requirements?
A. Configure the Auto Scaling group to use ELB health checks. Enable AWS Config. Create an AWS Config rule to ensure that any new Auto Scaling group will use ELB health checks. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the support team if the traffic routing configuration changes. Configure the AWS Config rule to send a notification to the topic.
B. Configure the Auto Scaling group to use EC2 health checks. Enable AWS Config. Create an AWS Config rule to ensure that any new Auto Scaling group will use EC2 health checks. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the support team if the traffic routing configuration changes. Configure the AWS Config rule to send a notification to the topic.
C. Configure the Auto Scaling group to use EC2 health checks. Create an Amazon CloudWatch synthetic canary to monitor the application. Create a CloudWatch alarm that is triggered when the CloudWatch canary fails. Configure the alarm to notify the support team when the alarm state is in alarm.
D. Configure the Auto Scaling group to use ELB health checks. Create an Amazon CloudWatch synthetic canary to monitor the application. Create a CloudWatch alarm that is triggered when the CloudWatch canary fails. Configure the alarm to notify the support team when the alarm state is in alarm.
Show Answer
Correct Answer: A
Explanation: The core issue is that instances with application-level failures were still considered healthy by the Auto Scaling group. Using ELB (ALB) health checks ensures that traffic is routed only to instances that pass application-level health checks, not just EC2 status checks. This directly prevents traffic from being sent to instances with application errors.
Additionally, the requirement to notify the support team when the traffic routing configuration changes is best met by AWS Config. AWS Config can detect and report configuration changes (such as health check type changes or new Auto Scaling groups without ELB health checks) and send notifications via Amazon SNS.
Options with EC2 health checks do not detect application errors, and options using CloudWatch Synthetics provide monitoring and alerting but do not enforce or govern traffic routing configuration changes. Therefore, option A fully satisfies both requirements.
Question 33
A company has developed a web application that conducts seasonal sales on public holidays. The web application is deployed on AWS and uses AWS services for storage, database, computing, and encryption. During seasonal sales, the company expects high network traffic from a large number of users. The company must receive insights regarding any unexpected behavior during the sale.
A DevOps team wants to review the insights upon detecting anomalous behaviors during the sale. The DevOps team wants to receive recommended actions to resolve the anomalous behaviors. The recommendations must be provided on the provisioned infrastructure to address the issues that might occur in the future.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Enable Amazon DevOps Guru in the AWS account. Determine the coverage for DevOps Guru for all supported AWS resources in the account. Use the DevOps Guru dashboard to find the analysis, recommendations, and related metrics.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon DevOps Guru to send notifications about important events to the company when anomalies are identified.
C. Create an Amazon S3 bucket. Store Amazon CloudWatch logs, AWS CloudTrail data, and AWS Config data in the S3 bucket. Use Amazon Athena to generate insights on the data. Create a dashboard by using Amazon QuickSight.
D. Configure email message reports for an Amazon QuickSight dashboard. Schedule and send the email reports to the company.
E. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon Athena to send query results about important events to the company when anomalies are identified.
Show Answer
Correct Answer: A, B
Explanation: Amazon DevOps Guru is a managed AIOps service that automatically analyzes operational data from supported AWS resources to detect anomalous behavior, identify root causes, and provide concrete remediation recommendations with minimal setup and operational overhead. Using the DevOps Guru dashboard satisfies the need for insights and recommended actions on the existing infrastructure. Integrating DevOps Guru with Amazon SNS enables near-real-time notifications when anomalies are detected, ensuring the DevOps team is alerted promptly during high-traffic seasonal sales. The alternative options require building and maintaining custom analytics pipelines and dashboards, which increases operational overhead and does not natively provide remediation recommendations.
Question 34
A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be housed within the United States. The company has many AWS accounts in an organization in AWS Organizations that has all features enabled.
The engineer must restrict which AWS Regions the company can use. The engineer must also ensure that an alert is sent as soon as possible if any activity outside the governance policy occurs. The controls must be automatically enabled on any new Region outside the United States.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an Organizations SCP deny policy that has a condition that the aws:RequestedRegion property does not match a list of all US Regions. Include an exception in the policy for global services. Attach the policy to the root of the organization.
B. Configure AWS CloudTrail to send logs to Amazon CloudWatch Logs. Enable CloudTrail for all Regions. Use a CloudWatch Logs metric filter to create a metric in non-US Regions. Configure a CloudWatch alarm to send an alert if the metric is greater than 0.
C. Use an AWS Lambda function that checks for AWS service activity. Deploy the Lambda function to all Regions. Write an Amazon EventBridge rule that runs the Lambda function every hour. Configure the rule to send an alert if the Lambda function finds any activity in a non-US Region.
D. Use an AWS Lambda function to query Amazon Inspector to look for service activity in non-US Regions. Configure the Lambda function to send alerts if Amazon Inspector finds any activity.
E. Create an Organizations SCP allow policy that has a condition that the aws:RequestedRegion property matches a list of all US Regions. Include an exception in the policy for global services. Attach the policy to the root of the organization.
Show Answer
Correct Answer: A, B
Explanation: The requirement is to prevent use of non‑US Regions and to alert immediately if any activity occurs outside policy, including in newly enabled Regions.
An SCP with an explicit deny based on aws:RequestedRegion (Option A) enforces the restriction centrally across all accounts and automatically applies to any newly launched Region, while allowing global services via exception. An allow‑list SCP (Option E) is less appropriate because deny policies are the recommended governance control for region restrictions and avoid accidental gaps.
CloudTrail enabled in all Regions with delivery to CloudWatch Logs and alarms (Option B) provides near‑real‑time detection and alerting of any API activity in non‑US Regions. This satisfies the requirement for immediate alerts.
The Lambda-based options are slower, more complex, and do not provide immediate detection, and Amazon Inspector is not designed for region usage monitoring.
Question 34
A company is developing an ecommerce application that has a backend that runs on Amazon EC2 instances. The application has a static frontend website that is hosted in an Amazon S3 bucket.
The company uses a GitHub repository for version control and must automate builds and deployments whenever code is pushed to the main branch. The company must deploy changes to the frontend and backend independently of each other.
Which solution will meet these requirements?
A. Create a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages that use AWS CodeDeploy as the action provider to deploy the frontend and backend, respectively.
B. Create a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages. For the backend stage, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend stage, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket.
C. Create two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. Configure a deployment stage that uses AWS CodeDeploy as the action provider for each pipeline to deploy the frontend and the backend.
D. Create two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. For the backend pipeline, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend pipeline, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket.
Show Answer
Correct Answer: D
Explanation: The frontend and backend must be built and deployed independently, which is best achieved by using two separate AWS CodePipeline pipelines. The backend runs on EC2 and should be deployed with AWS CodeDeploy, which is designed for application deployments to EC2 instances. The frontend is a static website hosted on Amazon S3, so the native S3 deploy action is the appropriate and simplest deployment mechanism. This approach cleanly separates concerns, allows independent deployments, and uses the correct deployment services for each component.
Question 35
A company uses an Amazon Aurora PostgreSQL DB cluster and loads transactional data into the database every 5 hours. Data analysts use the Aurora PostgreSQL database to run short-running queries, create complex aggregated queries, and create simple reports that use the data. The data analysts also manually update the data, including deleting and inserting data.
The data analysts have reported performance issues. The database team recently identified a long-running idle transaction connection that affected performance by blocking other queries and preventing VACUUM operations. The team wants to be proactively notified about these potential operational issues and about the recommended actions to fix the issues.
The company's AWS account uses Amazon DevOps Guru to monitor all the applications in the account.
Which solution will meet these requirements?
A. Turn on Performance Insights and DevOps Guru in the existing Aurora PostgreSQL DB cluster. Configure DevOps Guru to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
B. Turn on Performance Insights in the existing Aurora PostrgreSQL DB cluster. Configure Amazon EventBridge to receive events from the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
C. Turn on Performance Insights and DevOps Guru in the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the database team by using Amazon Simple Email Service (Amazon SES).
D. Turn on Performance Insights in the existing Aurora PostrgreSQL DB cluster. Configure Amazon EventBridge to receive events from the existing Aurora PostgreSQL DB cluster. Configure DevOps Guru to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
Show Answer
Correct Answer: A
Explanation: The team needs proactive detection of database operational issues (such as long‑running idle transactions blocking VACUUM) and recommendations to remediate them, plus notifications. Amazon DevOps Guru for RDS/Aurora analyzes Performance Insights metrics to identify anomalous database behavior and provides actionable recommendations. Enabling Performance Insights is required for deep database visibility, and configuring DevOps Guru notifications through Amazon SNS meets the proactive alerting requirement. EventBridge or SES are not required, and options that omit explicitly enabling DevOps Guru for the cluster do not fully meet the requirements.
Question 35
A company wants to proactively monitor and respond to AWS service issues that might affect an application. The company must correlate AWS Health events with application performance metrics and must set up automated alerts. The solution must give the company the ability to archive events, test the application's latency in different scenarios, and create custom metrics.
Which solution will meet these requirements?
A. Use AWS CloudTrail to log all AWS Health events. Use Amazon Athena to query the logs and to correlate the logs with application metrics stored in Amazon Timestream for LiveAnalytics. Set up AWS Chatbot for real-time notifications.
B. Use Amazon EventBridge to route AWS Health events to Amazon CloudWatch Logs. Create a metric filter for AWS Health events. Create custom metrics in CloudWatch that are based on application performance data. Set up CloudWatch alarms that correlate AWS Health events with the custom metrics.
C. Configure the AWS Health Dashboard to send notifications to Amazon Simple Notification Service (Amazon SNS). Use AWS Lambda to correlate the notifications with metrics and to update custom metrics in Amazon CloudWatch. Set up CloudWatch alarms for the custom metrics. Use AWS Systems Manager for automated remediation.
D. Configure AWS X-Ray to trace AWS Health events and application performance. Use Amazon QuickSight to visualize the correlations between events and metrics. Use Amazon GuardDuty to detect anomalies in the application's behavior and to provide alerts.
Show Answer
Correct Answer: B
Explanation: Amazon EventBridge natively integrates with AWS Health and can route Health events to CloudWatch Logs for archiving. CloudWatch metric filters can convert those events into metrics, which can be correlated with custom application performance metrics in CloudWatch. CloudWatch alarms then provide automated alerting. This combination supports correlation, archiving, custom metrics, alerting, and latency testing/monitoring within a single, well-integrated service set.
Question 36
A company uses an organization in AWS Organizations to manage many AWS accounts. The company has enabled all features for the organization. The company uses AWS CloudFormation StackSets to deploy configurations to the accounts. The company uses AWS Config to monitor an Amazon S3 bucket.
The company needs to ensure that all object uploads to the S3 bucket use AWS Key Management Service (AWS KMS) encryption.
Which solution will meet these requirements?
A. Create an AWS Config conformance pack that includes the s3-bucket-server-side-encryption-enabled rule. Deploy the conformance pack to the accounts. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic.
B. Create an SCP that includes a deny statement for the s3:createBucket action and a condition statement where s3:x-amz-server-side-encryption is not aws:kms. Attach the SCP to the root of the organization.
C. Create an AWS CloudFormation stack set to enable an AWS CloudTrail trail to capture S3 data events for the organization. In the stack set, create an Amazon EventBridge rule to match S3 PutObject events that do not use AWS KMS encryption. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic.
D. Create an SCP that includes a deny statement for the s3:putObject action and a condition where s3:x-amz-server-side-encryption is not aws:kms. Attach the SCP to the root of the organization.
Show Answer
Correct Answer: D
Explanation: The requirement is to ensure that all S3 object uploads use AWS KMS encryption, which requires a preventive, enforcement-based control across all accounts in the organization. An SCP can enforce such guardrails. By denying the s3:PutObject action when the s3:x-amz-server-side-encryption condition is not aws:kms, the policy blocks any upload that does not use KMS encryption. This works organization-wide, is evaluated at request time, and ensures compliance rather than just detecting or notifying after the fact. The other options only provide monitoring or notification and do not enforce encryption.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.