A company is developing an ecommerce application on AWS. The company wants to make sure that the application can handle sudden increases in traffic.
The company uses AWS CodePipeline for its CI/CD process. The company must implement a solution to integrate automated load testing into the CI/CD pipeline to validate the application's performance. The solution must perform production deployment only if the performance exceeds a threshold.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy the application by using AWS Elastic Beanstalk. Enable load balancing. Use Elastic Beanstalk to deploy tools for load tests. Run the tests during each deployment, and roll back the deployment if performance thresholds are unmet. Create an AWS Lambda function to monitor test metrics. Set up alarms for performance thresholds. Configure Amazon EventBridge to return an error if a test fails and to proceed with production deployment if a test passes.
B. Implement AWS Fargate tasks to run tools for load tests. Use Amazon Elastic container Service (Amazon ECS) to manage the test containers. Create AWS Lambda functions to analyze the test results. Integrate the functions with CodePipeline by using custom actions to initiate and evaluate the tests. Program the functions to return an error if a test fails and to proceed with production deployment if a test passes.
C. Launch Amazon EC2 instances to run tools for load tests. Store test scripts in a GitHub repository. Use AWS Step Functions to orchestrate the tests and result analysis in the CodePipeline workflow. Use Amazon EventBridge to invoke an AWS Lambda function based on the test results. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.
D. Use AWS CodeBuild to run tools for load tests, store the test artifacts in Amazon S3, and configure a CodePipeline stage to invoke the CodeBuild project. Use Amazon CloudWatch to monitor the test metrics and to set up alarms for performance thresholds. Integrate an AWS Lambda function into the pipeline by using a custom action. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.
Show Answer
Correct Answer: D
Explanation: AWS CodeBuild is a fully managed service that integrates natively with CodePipeline and is well suited to run automated load-testing tools during the CI/CD process. The pipeline can invoke a CodeBuild project to execute the tests, store artifacts in Amazon S3, and use CloudWatch metrics/alarms plus a Lambda custom action (or build failure) to gate the pipeline so production deployment proceeds only when performance thresholds are met. This avoids managing EC2 instances, ECS/Fargate tasks, or Elastic Beanstalk infrastructure, resulting in the least operational overhead.
Question 64
A company uses a pipeline in AWS CodePipeline to deploy an application. The company created an AWS Fault Injection Service (AWS FIS) experiment template to test the resiliency of the application. A DevOps engineer needs to integrate the experiment into the pipeline.
Which solution will meet this requirement?
A. Configure a new stage in the pipeline that includes an AWS FIS action. Configure the action to reference the AWS FIS experiment template. Grant the pipeline access to start the experiment.
B. Create an Amazon EventBridge scheduler. Grant the scheduler permission to start the AWS FIS experiment. Configure a new stage in the pipeline that includes an action to invoke the EventBridge scheduler.
C. Create an AWS Lambda function to start the AWS FIS experiment. Grant the Lambda function permission to start the experiment. Create a new stage in the pipeline that has a Lambda action. Set the action to invoke the Lambda function.
D. Export the AWS FIS experiment template to an Amazon S3 bucket. Create an AWS CodeBuild unit test project that has a buildspec that starts the AWS FIS experiment. Grant the CodeBuild project access to start the experiment. Configure a new stage in the pipeline that includes an action to run the CodeBuild unit test project.
Show Answer
Correct Answer: C
Explanation: AWS CodePipeline does not provide a native AWS Fault Injection Service (AWS FIS) action. To integrate an FIS experiment into a pipeline, use a Lambda action that invokes a Lambda function calling the AWS FIS StartExperiment API. Grant the Lambda function IAM permissions to start the experiment. EventBridge Scheduler is intended for time-based scheduling, not pipeline-triggered execution, and CodeBuild is unnecessary for simply invoking the FIS API. Option A is invalid because there is no native FIS pipeline action.
Question 65
A company is developing code and wants to use semantic versioning. The company's DevOps team needs to create a pipeline for compiling the code. The team also needs to manage versions of the compiled code. If the code uses any open source libraries, the libraries must also be cached in the build process.
Which solution will meet these requirements?
A. Create an AWS CodeArtifact repository and associate the upstream repositories. Create an AWS CodeBuild project that builds the semantic version of the code artifacts. Configure the project to authenticate and connect to the CodeArtifact repository and publish the artifact to the repository.
B. Use AWS CodeDeploy to upload the generated semantic version of the artifact to an Amazon Elastic File System (Amazon EFS) file system.
C. Use an AWS CodeBuild project to build the code and to publish the generated semantic version of the artifact to AWS Artifact. Configure build caching in the CodeBuild project.
D. Create a new AWS CodeArtifact repository. Create an AWS Lambda function that pulls open source packages from the internet and publishes the packages to the repository. Configure AWS CodeDeploy to build semantic versions of the code and publish the versions to the repository.
Show Answer
Correct Answer: A
Explanation: AWS CodeArtifact is designed to store and manage versioned software packages and integrates with CodeBuild. Upstream repositories allow caching and proxying of open source dependencies, satisfying the requirement to cache libraries during builds. CodeBuild compiles the code and can publish semantically versioned artifacts to CodeArtifact. The other options misuse services: CodeDeploy does not compile code or manage artifact repositories, AWS Artifact is not a package repository, and Lambda is unnecessary for dependency caching.
Question 66
A company has an AWS account named PipelineAccount. The account manages a pipeline in AWS CodePipeline. The account uses an IAM role named CodePipeline_Service_Role and produces an artifact that is stored in an Amazon S3 bucket. The company uses a customer managed AWS KMS key to encrypt objects in the S3 bucket.
A DevOps engineer wants to configure the pipeline to use an AWS CodeDeploy application in an AWS account named CodeDeployAccount to deploy the produced artifact.
The DevOps engineer updates the KMS key policy to grant the CodeDeployAccount account permission to use the key. The DevOps engineer configures an IAM role named DevOps_Role in the CodeDeployAccount account that has access to the CodeDeploy resources that the pipeline requires. The DevOps engineer updates an Amazon EC2 instance role that operates within the CodeDeployAccount account to allow access to the S3 bucket and the KMS key that is in the PipelineAccount account.
Which additional steps will meet these requirements?
A. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the CodePipeline_Service_Role IAM role to grant permission to assume the DevOps_Role role.
B. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the DevOps_Role IAM role to grant permission to assume CodePipelfne_Service_Role role.
C. Update the S3 bucket policy to grant the PipelineAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the CodePipeline_Service_Role IAM to grant permission to assume the DevOps_Role role.
D. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the CodeDeployAccount account to assume the role. Update the CodePipeline_Service_Role IAM role to grant permission to assume the DevOps_Role role.
Show Answer
Correct Answer: A
Explanation: For a cross-account CodePipeline to CodeDeploy deployment, the artifact bucket policy must allow the target account to access the artifacts, the target account role (DevOps_Role) must trust the source account so CodePipeline can assume it, and the CodePipeline service role must be permitted to sts:AssumeRole into the target role. The KMS key permissions and instance role permissions have already been addressed in the scenario.
Question 67
A DevOps team operates an integration service that runs on an Amazon EC2 instance. The DevOps team uses Amazon Route 53 to manage the integration service's domain name by using a simple routing record. The integration service is stateful and uses Amazon Elastic File System (Amazon EFS) for data storage and state storage. The integration service does not support load balancing between multiple nodes.
The DevOps team deploys the integration service on a new EC2 instance as a warm standby to reduce the mean time to recovery. The DevOps team wants the integration service to automatically fail over to the standby EC2 instance.
Which solution will meet these requirements?
A. Update the existing Route 53 DNS record's routing policy to weighted. Set the existing DNS record's weighting to 100. For the same domain, add a new DNS record that points to the standby EC2 instance. Set the new DNS record's weighting to 0. Associate an application health check with each record.
B. Update the existing Route 53 DNS record's routing policy to weighted. Set the existing DNS record's weighting to 99. For the same domain, add a new DNS record that points to the standby EC2 instance. Set the new DNS record's weighting to 1. Associate an application health check with each record.
C. Create an Application Load Balancer (ALB). Update the existing Route 53 record to point to the ALB. Create a target group for each EC2 instance. Configure an application health check on each target group. Associate both target groups with the same ALB listener. Set the primary target group's weighting to 100. Set the standby target group's weighting to 0.
D. Create an Application Load Balancer (ALB). Update the existing Route 53 record to point to the ALB. Create a target group for each EC2 instance. Configure an application health check on each target group. Associate both target groups with the same ALB listener. Set the primary target group's weighting to 99. Set the standby target group's weighting to 1.
Show Answer
Correct Answer: A
Explanation: The service is stateful and explicitly does not support load balancing across multiple nodes, so an ALB is not appropriate. Route 53 weighted routing with two records for the same name, weights of 100 (primary) and 0 (standby), plus health checks, sends all traffic to the primary during normal operation. If the primary health check fails, Route 53 stops returning the unhealthy record and returns the standby record instead, providing automatic failover without sending normal traffic to the standby.
Question 68
A company hosts several applications in an AWS account. Each application sends logs to its own log group in Amazon CloudWatch. The company's CloudWatch costs for ingestion are increasing.
A DevOps engineer needs to identify which applications are the source of the increased logging costs.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Use CloudWatch metrics to create a custom expression that identifies the CloudWatch log groups that receive the most data.
B. Use Amazon CloudWatch Logs Insights to create a query for the application log groups to identify the number of log groups that received data during a specific time period.
C. Use AWS Cost Explorer to generate a cost report that details costs for CloudWatch usage.
D. Use AWS CloudTrail to filter for CreateLogStream events for each application.
Show Answer
Correct Answer: A
Explanation: CloudWatch Logs publishes the IncomingBytes metric per log group, which directly reflects ingestion volume. Since CloudWatch Logs ingestion charges are based on the amount of data ingested, comparing IncomingBytes across log groups is the most operationally efficient way to identify which applications are driving increased logging costs. Cost Explorer shows aggregated service costs but not per-log-group ingestion sources, Logs Insights queries log content rather than ingestion volume, and CloudTrail CreateLogStream events do not measure data volume.
Question 69
A company has a search application that has a web interface. The company uses Amazon CloudFront, Application Load Balancers (ALBs), and Amazon EC2 instances in an Auto Scaling group with a desired capacity of 3. The company uses prebaked AMIs. The application starts in 1 minute. The application queries an Amazon OpenSearch Service cluster.
The application is deployed to multiple Availability Zones. Because of compliance requirements, the application needs to have a disaster recovery (DR) environment in a separate AWS Region. The company wants to minimize the ongoing cost of the DR environment and requires an RTO and an RPO of under 30 minutes. The company has created an ALB in the DR Region.
Which solution will meet these requirements?
A. Add the new ALB as an origin in the CloudFront distribution. Configure origin failover functionality. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 0 in the DR Region. Create a new OpenSearch Service cluster in the DR Region. Set up cross-cluster replication for the cluster.
B. Create a new CloudFront distribution in the DR Region and add the new ALB as an origin. Use Amazon Route 53 DNS for Regional failover. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 0 in the DR Region. Reconfigure the OpenSearch Service cluster as a Multi-AZ with Standby deployment. Ensure that the standby nodes are in the DR Region.
C. Create a new CloudFront distribution in the DR Region and add the new ALB as an origin. Use Amazon Route 53 DNS for Regional failover. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 3 in the DR Region. Reconfigure the OpenSearch Service cluster as a Multi-AZ with Standby deployment. Ensure that the standby nodes are in the DR Region.
D. Add the new ALB as an origin in the CloudFront distribution. Configure origin failover functionality. Copy the AMI to the DR Region. Create a launch template and an Auto Scaling group with a desired capacity of 3 in the DR Region. Create a new OpenSearch Service cluster in the DR Region. Set up cross-cluster replication for the cluster.
Show Answer
Correct Answer: A
Explanation: An active-passive DR design minimizes ongoing cost by keeping compute scaled to zero in the DR Region and launching instances only during failover. Because the application starts in about 1 minute, scaling from zero still fits within the 30-minute RTO. OpenSearch Service Multi-AZ does not span Regions, so a separate OpenSearch cluster in the DR Region with cross-cluster replication is required to achieve cross-Region disaster recovery and meet the RPO target. CloudFront is a global service, so adding the DR ALB as a secondary origin and using origin failover avoids the need for a second distribution. Keeping three EC2 instances always running in the DR Region would not minimize ongoing cost.
Question 70
A DevOps engineer needs to troubleshoot a pipeline that uses a GitHub code repository. The pipeline contains a source stage, a build stage, and a deploy stage. The pipeline also has an AWS CodeStar connection to the GitHub code repository.
The build stage uses an AWS CodeBuild build project. The build project needs to perform a git clone of the repository as part of the build process.
The DevOps engineer validates that the source stage is working properly. However, the build stage fails each time the pipeline runs.
What is the reason that the build stage fails in the pipeline?
A. The build stage within the pipeline needs to use the AWS CodeStar connection action.
B. The AWS CodeStar connection to GitHub contains incorrect credentials.
C. The AWS CodePipeline service role does not have permission to use the AWS CodeStar connection.
D. The AWS CodeBuild service role does not have permission to use the AWS CodeStar connection.
Show Answer
Correct Answer: D
Explanation: The source stage already succeeds, which indicates the CodeStar connection and the CodePipeline service role can use the connection for source retrieval. The failure occurs because the CodeBuild project performs its own git clone, which requires the CodeBuild service role to have permission to use the CodeStar connection (for example, codestar-connections:UseConnection). Without that permission, the build stage cannot clone the repository.
Question 71
A company runs applications on Amazon EC2 instances that are in an Amazon EC2 Auto Scaling group. The EC2 instances are behind an Application Load Balancer (ALB). Users recently began to experience errors when traffic was directed to some of the EC2 instances.
A DevOps engineer discovers that the Auto Scaling group reports the problematic instances are healthy despite the application errors. User experience returns to normal after the DevOps engineer resolves the application errors on the problematic instances.
The company wants to ensure that traffic is routed only to healthy instances that are not experiencing application errors. The company also wants a support team to receive a notification if the traffic routing configuration changes.
Which solution will meet these requirements?
A. Configure the Auto Scaling group to use ELB health checks. Enable AWS Config. Create an AWS Config rule to ensure that any new Auto Scaling group will use ELB health checks. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the support team if the traffic routing configuration changes. Configure the AWS Config rule to send a notification to the topic.
B. Configure the Auto Scaling group to use EC2 health checks. Enable AWS Config. Create an AWS Config rule to ensure that any new Auto Scaling group will use EC2 health checks. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the support team if the traffic routing configuration changes. Configure the AWS Config rule to send a notification to the topic.
C. Configure the Auto Scaling group to use EC2 health checks. Create an Amazon CloudWatch synthetic canary to monitor the application. Create a CloudWatch alarm that is triggered when the CloudWatch canary fails. Configure the alarm to notify the support team when the alarm state is in alarm.
D. Configure the Auto Scaling group to use ELB health checks. Create an Amazon CloudWatch synthetic canary to monitor the application. Create a CloudWatch alarm that is triggered when the CloudWatch canary fails. Configure the alarm to notify the support team when the alarm state is in alarm.
Show Answer
Correct Answer: A
Explanation: Use ELB health checks for the Auto Scaling group so instance health reflects the load balancer's application-level health checks rather than only EC2 instance status. AWS Config can detect and enforce the desired Auto Scaling health check configuration and notify via Amazon SNS when the configuration changes, satisfying the governance and notification requirement.
Question 72
A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be housed within the United States. The company has many AWS accounts in an organization in AWS Organizations that has all features enabled.
The engineer must restrict which AWS Regions the company can use. The engineer must also ensure that an alert is sent as soon as possible if any activity outside the governance policy occurs. The controls must be automatically enabled on any new Region outside the United States.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an Organizations SCP deny policy that has a condition that the aws:RequestedRegion property does not match a list of all US Regions. Include an exception in the policy for global services. Attach the policy to the root of the organization.
B. Configure AWS CloudTrail to send logs to Amazon CloudWatch Logs. Enable CloudTrail for all Regions. Use a CloudWatch Logs metric filter to create a metric in non-US Regions. Configure a CloudWatch alarm to send an alert if the metric is greater than 0.
C. Use an AWS Lambda function that checks for AWS service activity. Deploy the Lambda function to all Regions. Write an Amazon EventBridge rule that runs the Lambda function every hour. Configure the rule to send an alert if the Lambda function finds any activity in a non-US Region.
D. Use an AWS Lambda function to query Amazon Inspector to look for service activity in non-US Regions. Configure the Lambda function to send alerts if Amazon Inspector finds any activity.
E. Create an Organizations SCP allow policy that has a condition that the aws:RequestedRegion property matches a list of all US Regions. Include an exception in the policy for global services. Attach the policy to the root of the organization.
Show Answer
Correct Answer: A, B
Explanation: Use an AWS Organizations SCP with a Deny on aws:RequestedRegion for all non-US Regions (with exceptions for global services) attached at the organization root to prevent use of non-US Regions across accounts. For detection and rapid alerting, enable a multi-Region CloudTrail, deliver logs to CloudWatch Logs, create metric filters for activity in non-US Regions, and trigger a CloudWatch alarm. Because the SCP denies any Region not explicitly listed as US, newly launched non-US Regions are automatically denied without policy changes.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.