A company uses an Amazon Aurora PostgreSQL DB cluster and loads transactional data into the database every 5 hours. Data analysts use the Aurora PostgreSQL database to run short-running queries, create complex aggregated queries, and create simple reports that use the data. The data analysts also manually update the data, including deleting and inserting data.
The data analysts have reported performance issues. The database team recently identified a long-running idle transaction connection that affected performance by blocking other queries and preventing VACUUM operations. The team wants to be proactively notified about these potential operational issues and about the recommended actions to fix the issues.
The company's AWS account uses Amazon DevOps Guru to monitor all the applications in the account.
Which solution will meet these requirements?
A. Turn on Performance Insights and DevOps Guru in the existing Aurora PostgreSQL DB cluster. Configure DevOps Guru to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
B. Turn on Performance Insights in the existing Aurora PostrgreSQL DB cluster. Configure Amazon EventBridge to receive events from the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
C. Turn on Performance Insights and DevOps Guru in the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the database team by using Amazon Simple Email Service (Amazon SES).
D. Turn on Performance Insights in the existing Aurora PostrgreSQL DB cluster. Configure Amazon EventBridge to receive events from the existing Aurora PostgreSQL DB cluster. Configure DevOps Guru to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
Show Answer
Correct Answer: A
Explanation: Amazon DevOps Guru for RDS works with Performance Insights to detect database performance and operational issues such as long-running idle transactions, blocking, and VACUUM problems, and provides recommendations. Enabling Performance Insights and DevOps Guru on the Aurora PostgreSQL cluster allows these insights. DevOps Guru notifications are delivered through Amazon SNS. EventBridge is not required for this use case, and SES is not the standard notification mechanism.
Question 74
A company uses an organization in AWS Organizations to manage many AWS accounts. The company has enabled all features for the organization. The company uses AWS CloudFormation StackSets to deploy configurations to the accounts. The company uses AWS Config to monitor an Amazon S3 bucket.
The company needs to ensure that all object uploads to the S3 bucket use AWS Key Management Service (AWS KMS) encryption.
Which solution will meet these requirements?
A. Create an AWS Config conformance pack that includes the s3-bucket-server-side-encryption-enabled rule. Deploy the conformance pack to the accounts. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic.
B. Create an SCP that includes a deny statement for the s3:createBucket action and a condition statement where s3:x-amz-server-side-encryption is not aws:kms. Attach the SCP to the root of the organization.
C. Create an AWS CloudFormation stack set to enable an AWS CloudTrail trail to capture S3 data events for the organization. In the stack set, create an Amazon EventBridge rule to match S3 PutObject events that do not use AWS KMS encryption. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic.
D. Create an SCP that includes a deny statement for the s3:putObject action and a condition where s3:x-amz-server-side-encryption is not aws:kms. Attach the SCP to the root of the organization.
Show Answer
Correct Answer: D
Explanation: To enforce that every object upload uses AWS KMS encryption, the control must prevent noncompliant uploads at request time. An AWS Organizations SCP can deny the s3:PutObject action unless the request includes the server-side encryption header set to aws:kms. AWS Config and CloudTrail/EventBridge can detect or notify after the fact but do not enforce the requirement. Denying s3:CreateBucket is unrelated to object uploads.
Question 75
A DevOps administrator is responsible for managing the security of a company's Amazon CloudWatch Logs log groups. The company's security policy states that employee IDs must not be visible in logs except by authorized personnel. Employee IDs follow the pattern of Emp-XXXXXX, where each X is a digit.
An audit discovered that employee IDs are found in a single log file. The log file is available to engineers, but the engineers are not authorized to view employee IDs. Engineers currently have an AWS IAM Identity Center permission that allows logs:* on all resources in the account.
The administrator must mask the employee ID so that new log entries that contain the employee ID are not visible to unauthorized personnel.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new data protection policy on the log group. Add an Emp-\d{6} custom data identifier configuration. Create an IAM policy that has a Deny action for the Action":"logs:Unmask" permission on the resource. Attach the policy to the engineering accounts.
B. Create a new data protection policy on the log group. Add managed data identifiers for the personal data category. Create an IAM policy that has a Deny action for the "NotAction":"logs:Unmask" permission on the resource. Attach the policy to the engineering accounts.
C. Create an AWS Lambda function to parse a log file entry, remove the employee ID, and write the results to a new log file. Create a Lambda subscription filter on the log group and select the Lambda function. Grant the lambda:InvokeFunction permission to the log group.
D. Create an Amazon Data Firehose delivery stream that has an Amazon S3 bucket as the destination. Create a Firehose subscription filter on the log group that uses the Firehose delivery stream. Remove the "logs:*" permission on the engineering accounts. Create an Amazon Macie job on the S3 bucket that has an Emp-\d{6} custom identifier.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch Logs data protection policies are designed to automatically detect and mask sensitive data in log events at read time for unauthorized users. Because the employee ID format is organization-specific (Emp-XXXXXX), a custom data identifier using the regex Emp-\d{6} is appropriate. Users with logs:Unmask can reveal masked data, so explicitly denying logs:Unmask to engineers ensures they only see masked values while authorized personnel can retain unmask permission. This is the most operationally efficient native solution.
Question 76
A company hosts an application in its AWS account. The application uses an Amazon S3 bucket to store objects that contain sensitive information.
The company needs to capture object-level S3 API calls, including calls that are rejected because the calls were made by using credentials that are not valid.
Which solution will meet these requirements?
A. Create an AWS CloudTrail trail in the account. Enable S3 data events logging. Configure the trail to log to Amazon CloudWatch.
B. Create a new S3 bucket. Configure access logging on the application's S3 bucket. Deliver the access logs to the new S3 bucket.
C. Configure Amazon GuardDuty with S3 protection enabled for the account. Create an Amazon EventBridge rule that matches findings that are associated with the S3 bucket. Configure the rule to use an Amazon Simple Queue Service (Amazon SQS) queue as the target.
D. Create an AWS CloudTrail trail and a new S3 bucket in the account. Configure the trail to log to the S3 new bucket.
Show Answer
Correct Answer: A
Explanation: AWS CloudTrail S3 data events capture object-level API activity such as GetObject, PutObject, and DeleteObject. CloudTrail records both successful and failed API calls, including authorization failures. S3 server access logging records requests to S3 but is not the appropriate mechanism for comprehensive object-level API auditing. GuardDuty detects threats rather than logging all API calls, and a standard CloudTrail trail without S3 data events does not capture object-level operations.
Question 77
A DevOps engineer uses AWS WAF to manage web ACLs across an AWS account. The DevOps engineer must ensure that AWS WAF is enabled for all Application Load Balancers (ALBs) in the account. The DevOps engineer uses an AWS CloudFormation template to deploy an individual ALB and AWS WAF as part of each application stack's deployment process. If AWS WAF is removed from the ALB after the ALB is deployed, AWS WAF must be added to the ALB automatically.
Which solution will meet these requirements with the MOST operational efficiency?
A. Enable AWS Config. Add the alb-waf-enabled managed rule. Create an AWS Systems Manager Automation document to add AWS WAF to an ALB. Edit the rule to automatically remediate. Select the Systems Manager Automation document as the remediation action.
B. Enable AWS Config. Add the alb-waf-enabled managed rule. Create an Amazon EventBridge rule to send all AWS Config ConfigurationItemChangeNotification notification types to an AWS Lambda function. Configure the Lambda function to call the AWS Config start-resource-evaluation API in detective mode.
C. Configure an Amazon EventBridge rule to periodically call an AWS Lambda function that calls the detect-stack-drift API on the CloudFormation template. Configure the Lambda function to modify the ALB attributes with waf.fail_open.enabled set to true if the AWS::WAFv2::WebACLAssociation resource shows a status of drifted.
D. Configure an Amazon EventBridge rule to periodically call an AWS Lambda function that calls the detect-stack-drift API on the CloudFormation template. Configure the Lambda function to delete and redeploy the CloudFormation stack if the AWS::WAFv2::WebACLAssociation resource shows a status of drifted.
Show Answer
Correct Answer: A
Explanation: AWS Config provides a managed rule (alb-waf-enabled/elb-waf-enabled depending on naming) to detect whether an Application Load Balancer has an associated AWS WAF web ACL. By configuring automatic remediation with an AWS Systems Manager Automation runbook, AWS can automatically re-associate the web ACL whenever it is removed. This is the most operationally efficient solution because it uses managed compliance detection and remediation rather than custom Lambda functions or periodic CloudFormation drift detection. Options B, C, and D either only trigger evaluations without remediation or rely on more complex, less efficient custom logic.
Question 78
A company's DevOps team uses Node Package Manager (NPM) open source libraries to build applications. The DevOps team runs its application build process in an AWS CodeBuild project that downloads the NPM libraries from public NPM repositories.
The company wants to host the NPM libraries in private NPM repositories. The company also needs to be able to run checks on new versions of the libraries before the DevOps team uses the libraries.
Which solution will meet these requirements with the LEAST operational effort?
A. Create an AWS CodeArtifact repository with an upstream repository named npm-store. Configure the application build process to use the CodeArtifact repository as the default source for NPM. Create an AWS CodePipeline pipeline to perform the required checks on package versions in the CodeArtifact repository. Set the package status to unlisted if a failure occurs.
B. Enable Amazon S3 caching in the CodeBuild project configuration. Add a step in the buildspec.yaml config file to perform the required checks on the package versions in the cache.
C. Create an AWS CodeCommit repository for each library. Clone the required NPM libraries to the appropriate CodeCommit repository. Modify the CodeBuild appspec.yaml config file to use the private CodeCommit repositories. Add a step to perform the required checks on the package versions.
D. Create an AWS CodeCommit repository for each library. Clone the required NPM libraries to the appropriate CodeCommit repository. Modify the CodeBuild buildspec.yaml config file so that NPM uses the private CodeCommit repositories. Add an AWS CodePipeline pipeline that performs the required checks on the package versions for each new commit to the repositories. Configure the pipeline to revert to the most recent commit in the event of a failure.
Show Answer
Correct Answer: A
Explanation: AWS CodeArtifact is purpose-built to host private package repositories and supports upstream repositories that proxy and cache public npm packages. Pointing CodeBuild to CodeArtifact centralizes dependency management with minimal operational effort. A validation pipeline can check newly available package versions before they are used, and packages that fail validation can be made unavailable (for example, by changing their status), avoiding the manual overhead of mirroring packages into CodeCommit or relying on S3 caching.
Question 79
A company is using AWS Organizations and wants to implement a governance strategy with the following requirements:
• AWS resource access is restricted to the same two Regions for all accounts.
• AWS services are limited to a specific group of authorized services for all accounts.
• Authentication is provided by Active Directory.
• Access permissions are organized by job function and are identical in each account.
Which solution will meet these requirements?
A. Establish an organizational unit (OU) with group policies in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
B. Establish a permission boundary in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
C. Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS Resource Access Manager (AWS RAM) to share management account roles with permissions for each job function, including AWS IAM Identity Center for authentication in each account.
D. Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
Show Answer
Correct Answer: D
Explanation: Service Control Policies (SCPs) in AWS Organizations enforce organization-wide guardrails such as restricting allowed AWS Regions and limiting accessible services across all member accounts. CloudFormation StackSets can consistently deploy identical IAM roles for each job function into every account. Those roles can include trust policies for federation with an Active Directory-backed IAM identity provider, satisfying centralized authentication and consistent authorization.
Question 80
A company used a lift and shift strategy to migrate a workload to AWS. The company has an Auto Scaling group of Amazon EC2 instances. Each EC2 instance runs a web application, a database, and a Redis cache.
Users are experiencing large variations in the web application's response times. Requests to the web application go to a single EC2 instance that is under significant load. The company wants to separate the application components to improve availability and performance.
Which solution will meet these requirements?
A. Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Application Load Balancer and an Auto Scaling group for the Redis cache.
B. Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create a Network Load Balancer and an Auto Scaling group in a single Availability Zone for the Redis cache.
C. Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Amazon ElastiCache (Redis OSS) cluster for the cache. Create a target group that has a DNS target type that contains the ElastiCache (Redis OSS) cluster hostname.
D. Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create an Amazon ElastiCache (Redis OSS) cluster for the cache.
Show Answer
Correct Answer: D
Explanation: An Application Load Balancer is appropriate for distributing HTTP/HTTPS web traffic across an Auto Scaling group of web servers. Moving the database to Amazon Aurora with Multi-AZ improves availability and separates the data tier from the application tier. Moving Redis to Amazon ElastiCache for Redis provides a managed, highly performant cache service. The other options misuse load balancers for Redis, incorrectly place Redis behind a load balancer, or reduce availability by using a single Availability Zone.
Question 81
A company has an application that uploads access logs to an Amazon CloudWatch Logs log group. The fields in the log lines include the response code and the application name.
The company wants to create a CloudWatch metric to track the number of requests by response code in a specific range and with a specific application name.
Which solution will meet these requirements?
A. Create a CloudWatch Logs log event filter on the CloudWatch Logs log stream to match the response code range. Configure the log event filter to increment a metric. Set the response code and application name as dimensions.
B. Create a CloudWatch Logs metric filter on the CloudWatch Logs log group to match the response code range. Configure the metric filter to increment a metric. Set the response code and application name as dimensions.
C. Create a CloudWatch Contributor Insights rule on the CloudWatch Logs log stream with a filter to match the response code range. Configure the Contributor Insights rule to increment a CloudWatch metric with the response code and application name as dimensions.
D. Create a CloudWatch Logs Insights query on the CloudWatch Logs log group to match the response code range. Configure the Logs Insights query to increment a CloudWatch metric with the response code and application name as dimensions.
Show Answer
Correct Answer: B
Explanation: CloudWatch Logs metric filters are created on a log group and can match log patterns (including numeric conditions such as response code ranges) to publish CloudWatch metrics. Metric filters also support extracting fields as dimensions, such as response code and application name. Log event filters are for subscription/filtering log events, Contributor Insights analyzes top contributors rather than creating custom metrics this way, and Logs Insights queries do not continuously increment CloudWatch metrics.
Question 82
A DevOps engineer manages an AWS CodePipeline pipeline that builds and deploys a web application on AWS. The pipeline has a source stage, a build stage, and a deploy stage. When deployed properly, the web application responds with a 200 OK HTTP response code when the URL of the home page is requested.
The home page recently returned a 503 HTTP response code after CodePipeline deployed the application. The DevOps engineer needs to add an automated test into the pipeline. The automated test must ensure that the application returns a 200 OK HTTP response code after the application is deployed. The pipeline must fail if the response code is not present during the test. The DevOps engineer has added a CheckURL stage after the deploy stage in the pipeline.
What should the DevOps engineer do next to implement the automated test?
A. Configure the CheckURL stage to use an Amazon CloudWatch action. Configure the action to use a canary synthetic monitoring check on the application URL and to report a success or failure to CodePipeline.
B. Create an AWS Lambda function to check the response code status of the URL and to report a success or failure to CodePipeline. Configure an action in the CheckURL stage to invoke the Lambda function.
C. Configure the CheckURL stage to use an AWS CodeDeploy action. Configure the action with an input artifact that is the URL of the application and to report a success or failure to CodePipeline.
D. Deploy an Amazon API Gateway HTTP API that checks the response code status of the URL and that reports success or failure to CodePipeline. Configure the CheckURL stage to use the AWS Device Farm test action and to provide the API Gateway HTTP API as an input artifact.
Show Answer
Correct Answer: B
Explanation: AWS CodePipeline supports invoking an AWS Lambda function as an action. The Lambda function can perform a custom HTTP GET request to the deployed application's URL, verify that the response status is 200 OK, and return success or failure. If the Lambda action fails, the pipeline fails. The other options misuse services: CloudWatch/Synthetics is not a native CodePipeline action for this purpose, CodeDeploy cannot validate a URL as described, and API Gateway with Device Farm is unrelated.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.