A company uses a CI/CD pipeline to deploy its workload in the ap-southeast-2 Region. The company receives images through a Network Load Balancer (NLB) and processes the images in AWS Fargate tasks on an Amazon Elastic Container Service (Amazon ECS) cluster.
An Amazon Elastic Container Registry (Amazon ECR) repository stores the images as Docker images. The company uses Amazon Route 53 to configure DNS. The company saves the images in an Amazon S3 bucket and saves the metadata from the images in an Amazon DynamoDB table.
The company wants to expand the workload to a second Region. A DevOps engineer needs to build a highly available and resilient design to expand the workload to the eu-west-2 Region.
Which combination of steps will meet these requirements with the FEWEST configuration changes? (Choose three.)
A. Configure ECR replication to eu-west-2 on the repository. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a latency routing policy in Route 53 for the two workloads.
B. Configure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in ap-southeast-2.
C. Configure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in the same Region that the tasks run in.
D. Configure a new S3 bucket in eu-west-2. Configure data replication between the S3 bucket in ap-southeast-2 and the S3 bucket in eu-west-2. Configure the Fargate tasks to use the S3 bucket in the same Region that the tasks run in to perform S3 PUT operations and GET operations.
E. Configure an S3 Multi-Region Access Point for the S3 bucket in ap-southeast-2 and a new S3 bucket in eu-west-2. Configure two-way replication on the S3 buckets. Configure the workloads to use the Multi-Region Access Point for S3 PUT operations and GET operations.
F. Configure the CI/CD pipeline to deploy ECR images to both Regions. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a failover routing policy in Route 53 for the two workloads.
Show Answer
Correct Answer: A, C, E
Explanation: A provides multi-Region compute with minimal change by replicating container images via ECR replication, deploying an NLB and ECS/Fargate in eu-west-2, and using Route 53 latency routing for high availability. C uses DynamoDB global tables with Region-local access, which is the recommended, resilient design for multi-Region writes and reads with low latency. E uses S3 Multi-Region Access Points with two-way replication, giving highly available, Region-agnostic access to objects with minimal application changes compared to managing buckets directly.
Question 37
A DevOps administrator is responsible for managing the security of a company's Amazon CloudWatch Logs log groups. The company's security policy states that employee IDs must not be visible in logs except by authorized personnel. Employee IDs follow the pattern of Emp-XXXXXX, where each X is a digit.
An audit discovered that employee IDs are found in a single log file. The log file is available to engineers, but the engineers are not authorized to view employee IDs. Engineers currently have an AWS IAM Identity Center permission that allows logs:* on all resources in the account.
The administrator must mask the employee ID so that new log entries that contain the employee ID are not visible to unauthorized personnel.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new data protection policy on the log group. Add an Emp-\d{6} custom data identifier configuration. Create an IAM policy that has a Deny action for the Action":"logs:Unmask" permission on the resource. Attach the policy to the engineering accounts.
B. Create a new data protection policy on the log group. Add managed data identifiers for the personal data category. Create an IAM policy that has a Deny action for the "NotAction":"logs:Unmask" permission on the resource. Attach the policy to the engineering accounts.
C. Create an AWS Lambda function to parse a log file entry, remove the employee ID, and write the results to a new log file. Create a Lambda subscription filter on the log group and select the Lambda function. Grant the lambda:InvokeFunction permission to the log group.
D. Create an Amazon Data Firehose delivery stream that has an Amazon S3 bucket as the destination. Create a Firehose subscription filter on the log group that uses the Firehose delivery stream. Remove the "logs:*" permission on the engineering accounts. Create an Amazon Macie job on the S3 bucket that has an Emp-\d{6} custom identifier.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch Logs data protection policies are purpose-built to detect and mask sensitive data in new log events with minimal operational overhead. A custom data identifier using the regular expression Emp-\d{6} precisely matches the employee ID format. By applying a data protection policy to the log group, the IDs are automatically masked in new log entries. Access to unmasked data is controlled by the logs:Unmask permission; explicitly denying this permission to engineers ensures they cannot view the employee IDs, while authorized personnel still can. This approach avoids custom code, extra pipelines, or data duplication, making it the most operationally efficient solution.
Question 38
A company hosts an application in its AWS account. The application uses an Amazon S3 bucket to store objects that contain sensitive information.
The company needs to capture object-level S3 API calls, including calls that are rejected because the calls were made by using credentials that are not valid.
Which solution will meet these requirements?
A. Create an AWS CloudTrail trail in the account. Enable S3 data events logging. Configure the trail to log to Amazon CloudWatch.
B. Create a new S3 bucket. Configure access logging on the application's S3 bucket. Deliver the access logs to the new S3 bucket.
C. Configure Amazon GuardDuty with S3 protection enabled for the account. Create an Amazon EventBridge rule that matches findings that are associated with the S3 bucket. Configure the rule to use an Amazon Simple Queue Service (Amazon SQS) queue as the target.
D. Create an AWS CloudTrail trail and a new S3 bucket in the account. Configure the trail to log to the S3 new bucket.
Show Answer
Correct Answer: A
Explanation: AWS CloudTrail with S3 data events enabled is the service that records object-level S3 API calls (such as GetObject, PutObject, DeleteObject). CloudTrail data events log both successful and failed requests, including authorization failures and requests made with invalid credentials (recorded with error codes). S3 server access logs do not provide the same complete API-level context and are not the primary mechanism for capturing rejected API calls. Therefore, enabling S3 data events on a CloudTrail trail (optionally sending logs to CloudWatch) meets the requirement.
Question 39
A DevOps engineer uses AWS WAF to manage web ACLs across an AWS account. The DevOps engineer must ensure that AWS WAF is enabled for all Application Load Balancers (ALBs) in the account. The DevOps engineer uses an AWS CloudFormation template to deploy an individual ALB and AWS WAF as part of each application stack's deployment process. If AWS WAF is removed from the ALB after the ALB is deployed, AWS WAF must be added to the ALB automatically.
Which solution will meet these requirements with the MOST operational efficiency?
A. Enable AWS Config. Add the alb-waf-enabled managed rule. Create an AWS Systems Manager Automation document to add AWS WAF to an ALB. Edit the rule to automatically remediate. Select the Systems Manager Automation document as the remediation action.
B. Enable AWS Config. Add the alb-waf-enabled managed rule. Create an Amazon EventBridge rule to send all AWS Config ConfigurationItemChangeNotification notification types to an AWS Lambda function. Configure the Lambda function to call the AWS Config start-resource-evaluation API in detective mode.
C. Configure an Amazon EventBridge rule to periodically call an AWS Lambda function that calls the detect-stack-drift API on the CloudFormation template. Configure the Lambda function to modify the ALB attributes with waf.fail_open.enabled set to true if the AWS::WAFv2::WebACLAssociation resource shows a status of drifted.
D. Configure an Amazon EventBridge rule to periodically call an AWS Lambda function that calls the detect-stack-drift API on the CloudFormation template. Configure the Lambda function to delete and redeploy the CloudFormation stack if the AWS::WAFv2::WebACLAssociation resource shows a status of drifted.
Show Answer
Correct Answer: A
Explanation: AWS Config can continuously evaluate all ALBs using the managed alb/elb-waf-enabled rule to detect when a Web ACL is missing. By attaching an automatic remediation action that invokes an AWS Systems Manager Automation document to re-associate the WAF, the ALB is corrected automatically without custom code. This is fully managed, event-driven, and the most operationally efficient approach compared to custom EventBridge/Lambda or CloudFormation drift workflows.
Question 40
A company's DevOps team uses Node Package Manager (NPM) open source libraries to build applications. The DevOps team runs its application build process in an AWS CodeBuild project that downloads the NPM libraries from public NPM repositories.
The company wants to host the NPM libraries in private NPM repositories. The company also needs to be able to run checks on new versions of the libraries before the DevOps team uses the libraries.
Which solution will meet these requirements with the LEAST operational effort?
A. Create an AWS CodeArtifact repository with an upstream repository named npm-store. Configure the application build process to use the CodeArtifact repository as the default source for NPM. Create an AWS CodePipeline pipeline to perform the required checks on package versions in the CodeArtifact repository. Set the package status to unlisted if a failure occurs.
B. Enable Amazon S3 caching in the CodeBuild project configuration. Add a step in the buildspec.yaml config file to perform the required checks on the package versions in the cache.
C. Create an AWS CodeCommit repository for each library. Clone the required NPM libraries to the appropriate CodeCommit repository. Modify the CodeBuild appspec.yaml config file to use the private CodeCommit repositories. Add a step to perform the required checks on the package versions.
D. Create an AWS CodeCommit repository for each library. Clone the required NPM libraries to the appropriate CodeCommit repository. Modify the CodeBuild buildspec.yaml config file so that NPM uses the private CodeCommit repositories. Add an AWS CodePipeline pipeline that performs the required checks on the package versions for each new commit to the repositories. Configure the pipeline to revert to the most recent commit in the event of a failure.
Show Answer
Correct Answer: A
Explanation: AWS CodeArtifact natively supports private package repositories for NPM with upstream connections to public npmjs.org, allowing the company to host dependencies privately while automatically proxying and caching public packages. This requires minimal operational effort compared to manually cloning or managing packages. CodeArtifact integrates directly with CodeBuild as the default NPM source, and package version checks can be automated with CodePipeline. Packages that fail validation can be marked unlisted to prevent usage, fully meeting the requirements with the least overhead.
Question 41
A company is using AWS Organizations and wants to implement a governance strategy with the following requirements:
• AWS resource access is restricted to the same two Regions for all accounts.
• AWS services are limited to a specific group of authorized services for all accounts.
• Authentication is provided by Active Directory.
• Access permissions are organized by job function and are identical in each account.
Which solution will meet these requirements?
A. Establish an organizational unit (OU) with group policies in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
B. Establish a permission boundary in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
C. Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS Resource Access Manager (AWS RAM) to share management account roles with permissions for each job function, including AWS IAM Identity Center for authentication in each account.
D. Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
Show Answer
Correct Answer: D
Explanation: Service control policies (SCPs) are the correct mechanism in AWS Organizations to centrally restrict allowed AWS Regions and services across all accounts. CloudFormation StackSets can then be used to consistently provision identical IAM roles in every account, organized by job function. Including an IAM trust policy enables federation with Active Directory for authentication. This combination satisfies centralized governance, identical permissions across accounts, and AD-based authentication.
Question 42
A company used a lift and shift strategy to migrate a workload to AWS. The company has an Auto Scaling group of Amazon EC2 instances. Each EC2 instance runs a web application, a database, and a Redis cache.
Users are experiencing large variations in the web application's response times. Requests to the web application go to a single EC2 instance that is under significant load. The company wants to separate the application components to improve availability and performance.
Which solution will meet these requirements?
A. Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Application Load Balancer and an Auto Scaling group for the Redis cache.
B. Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create a Network Load Balancer and an Auto Scaling group in a single Availability Zone for the Redis cache.
C. Create a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Amazon ElastiCache (Redis OSS) cluster for the cache. Create a target group that has a DNS target type that contains the ElastiCache (Redis OSS) cluster hostname.
D. Create an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create an Amazon ElastiCache (Redis OSS) cluster for the cache.
Show Answer
Correct Answer: D
Explanation: The goal is to separate tightly coupled components to improve availability and performance. An Application Load Balancer with an Auto Scaling group distributes HTTP traffic across multiple web instances. Migrating the database to Amazon Aurora with Multi-AZ provides managed scaling, high availability, and removes database load from EC2 instances. Using Amazon ElastiCache (Redis OSS) externalizes the cache to a purpose-built, highly available service instead of running Redis on EC2. Other options misuse load balancers for Redis, place components in a single AZ, or include unsupported patterns.
Question 43
A company has an application that uploads access logs to an Amazon CloudWatch Logs log group. The fields in the log lines include the response code and the application name.
The company wants to create a CloudWatch metric to track the number of requests by response code in a specific range and with a specific application name.
Which solution will meet these requirements?
A. Create a CloudWatch Logs log event filter on the CloudWatch Logs log stream to match the response code range. Configure the log event filter to increment a metric. Set the response code and application name as dimensions.
B. Create a CloudWatch Logs metric filter on the CloudWatch Logs log group to match the response code range. Configure the metric filter to increment a metric. Set the response code and application name as dimensions.
C. Create a CloudWatch Contributor Insights rule on the CloudWatch Logs log stream with a filter to match the response code range. Configure the Contributor Insights rule to increment a CloudWatch metric with the response code and application name as dimensions.
D. Create a CloudWatch Logs Insights query on the CloudWatch Logs log group to match the response code range. Configure the Logs Insights query to increment a CloudWatch metric with the response code and application name as dimensions.
Show Answer
Correct Answer: B
Explanation: CloudWatch Logs metric filters are designed to scan log events in a log group, match patterns such as a range of response codes and a specific application name, and publish a CloudWatch metric when matches occur. Metric filters support extracting fields from logs and using them as metric dimensions, which satisfies the requirement to count requests by response code range and application name. The other options either cannot directly create metrics with dimensions from logs or are not intended for real-time metric creation.
Question 44
A DevOps engineer manages an AWS CodePipeline pipeline that builds and deploys a web application on AWS. The pipeline has a source stage, a build stage, and a deploy stage. When deployed properly, the web application responds with a 200 OK HTTP response code when the URL of the home page is requested.
The home page recently returned a 503 HTTP response code after CodePipeline deployed the application. The DevOps engineer needs to add an automated test into the pipeline. The automated test must ensure that the application returns a 200 OK HTTP response code after the application is deployed. The pipeline must fail if the response code is not present during the test. The DevOps engineer has added a CheckURL stage after the deploy stage in the pipeline.
What should the DevOps engineer do next to implement the automated test?
A. Configure the CheckURL stage to use an Amazon CloudWatch action. Configure the action to use a canary synthetic monitoring check on the application URL and to report a success or failure to CodePipeline.
B. Create an AWS Lambda function to check the response code status of the URL and to report a success or failure to CodePipeline. Configure an action in the CheckURL stage to invoke the Lambda function.
C. Configure the CheckURL stage to use an AWS CodeDeploy action. Configure the action with an input artifact that is the URL of the application and to report a success or failure to CodePipeline.
D. Deploy an Amazon API Gateway HTTP API that checks the response code status of the URL and that reports success or failure to CodePipeline. Configure the CheckURL stage to use the AWS Device Farm test action and to provide the API Gateway HTTP API as an input artifact.
Show Answer
Correct Answer: B
Explanation: AWS CodePipeline supports invoking AWS Lambda functions as actions. A Lambda function can perform a custom HTTP request to the deployed application URL, verify that the response code is 200 OK, and explicitly report success or failure back to CodePipeline. This causes the pipeline to fail automatically if the expected response code is not returned, which meets the requirement for an automated post-deployment test.
Question 45
A company stores its Python-based application code in AWS CodeCommit. The company uses AWS CodePipeline to deploy the application. The CodeCommit repository and the CodePipeline pipeline are deployed to the same AWS account.
The company's security team requires all code to be scanned for vulnerabilities before the code is deployed to production. If any vulnerabilities are found, the deployment must stop.
Which solution will meet these requirements?
A. Create a new CodeBuild project. Configure the project to run a security scan on the code by using Amazon CodeGuru Security. Configure the CodeBuild project to raise an error if CodeGuru Security finds vulnerabilities. Create a new IAM role that has sufficient permissions to run CodeGuru Security scans. Assign the role to the CodeBuild project. In the CodePipeline pipeline, add a new stage before the deployment stage. Select AWS CodeBuild as the action provider for the new stage. Use the source artifact from the CodeCommit repository. Configure the action to use the CodeBuild project.
B. Create a new CodeBuild project. Configure the project to run a security scan on the code by using Amazon Inspector. Configure the CodeBuild project to raise an error if Amazon Inspector finds vulnerabilities. Create a new IAM role that has sufficient permissions to run Amazon Inspector scans. Assign the role to the CodeBuild project. In the CodePipeline pipeline, add a new stage before the deployment stage. Select AWS CodeBuild as the action provider for the new stage. Use the source artifact from the CodeCommit repository. Configure the action to use the CodeBuild project.
C. Update the IAM role that is attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the CodePipeline pipeline, add a new stage before the deployment stage. Select DevOps Guru as the action provider for the new stage. Use the source artifact from the CodeCommit repository.
D. Update the IAM role that is attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the CodePipeline pipeline, add a new stage before the deployment stage. Select CodeGuru Security as the action provider for the new stage. Use the source artifact from the CodeCommit repository.
Show Answer
Correct Answer: A
Explanation: The requirement is to scan application source code for vulnerabilities and stop deployment if issues are found. Amazon CodeGuru Security is designed for static application security testing of code (including Python) and integrates with CodeBuild. Adding a CodeBuild stage that runs CodeGuru Security before deployment allows the build to fail on findings, which automatically halts CodePipeline. Amazon Inspector focuses on infrastructure and runtime workloads, not source code scanning, and DevOps Guru is for operational insights, not code security scans.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.