A company has a web application that is hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster runs on AWS Fargate that is available through an internet-facing Application Load Balancer.
The application is experiencing stability issues that lead to longer response times. A DevOps engineer needs to configure observability in Amazon CloudWatch to troubleshoot the issue. The solution must provide only the minimum necessary permissions.
Which combination of steps will meet these requirements? (Choose three.)
A. Deploy the CloudWatch agent as a Kubernetes StatefulSet to the EKS cluster.
B. Deploy the AWS Distro for OpenTelemetry Collector as a Kubernetes DaemonSet to the EKS cluster.
C. Associate a Kubernetes service account with an IAM role by using IAM roles for service accounts in Amazon EKS. Use the CloudWatchAgentServerPolicy AWS managed policy.
D. Associate a Kubernetes service account with an IAM role by using IAM roles for service accounts in Amazon EKS. Use the CloudWatchAgentAdminPolicy AWS managed policy.
E. Configure an IAM OpenID Connect (OIDC) provider for the EKS cluster.
F. Enable EKS control plane logging for the EKS cluster.
Show Answer
Correct Answer: B, C, E
Explanation: For Amazon EKS on AWS Fargate, observability for application performance and stability is best implemented with Container Insights using the AWS Distro for OpenTelemetry (ADOT). This enables collection of metrics and traces needed to troubleshoot latency and stability issues. Using IAM roles for service accounts (IRSA) with the CloudWatchAgentServerPolicy provides the minimum required permissions, avoiding overly broad admin access. To use IRSA, the EKS cluster must have an IAM OIDC provider configured. DaemonSets are the standard pattern referenced for ADOT in exam context, and this combination focuses on application-level observability with least privilege.
Question 47
A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. The company launches and terminates new EC2 instances every hour. The account includes existing EC2 instances that have been running for longer than a week.
The company's security policy requires all running EC2 instances to have an EC2 instance profile attached. The company has created a default EC2 instance profile. The default EC2 instance profile must be attached to any EC2 instances that do not have a profile attached.
Which solution will meet these requirements?
A. Configure an Amazon EventBridge rule that matches the Amazon EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function to attach the default instance profile to the EC2 instances.
B. Configure AWS Config. Deploy an AWS Config ec2-instance-profile-attached managed rule. Configure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.
C. Configure an Amazon EventBridge rule that matches the Amazon EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.
D. Configure AWS Config. Deploy an AWS Config iam-role-managed-policy-check managed rule. Configure an automatic remediation action that invokes an AWS Lambda function to attach the default instance profile to the EC2 instances.
Show Answer
Correct Answer: B
Explanation: AWS Config can continuously evaluate all EC2 instances, including those already running for weeks and newly launched ones, to check whether an instance profile is attached. The managed rule ec2-instance-profile-attached directly enforces this requirement, and automatic remediation with an SSM Automation runbook can attach the default instance profile when noncompliance is detected. EventBridge-based solutions only react to specific API events and do not reliably cover existing instances or all lifecycle scenarios. Option D checks IAM policies, not EC2 instance profiles.
Question 48
A security team wants to use AWS CloudTrail to monitor all actions and API calls in multiple accounts that are in the same organization in AWS Organizations. The security team needs to ensure that account users cannot turn off CloudTrail in the accounts.
Which solution will meet this requirement?
A. Apply an SCP to all OUs to deny the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail action.
B. Create IAM policies in each account to deny the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail action.
C. Set up Amazon CloudWatch alarms to notify the security team when a user disables CloudTrail in an account.
D. Use AWS Config to automatically re-enable CloudTrail if a user disables CloudTrail in an account.
Show Answer
Correct Answer: A
Explanation: Using AWS Organizations, a Service Control Policy (SCP) can enforce guardrails across all member accounts. By denying cloudtrail:StopLogging and cloudtrail:DeleteTrail with an SCP applied to the relevant OUs, no account user or administrator can disable or remove CloudTrail. IAM policies can be overridden by higher-privilege users, and CloudWatch or AWS Config only detect or remediate after the fact rather than preventing the action.
Question 49
A large company recently acquired a small company. The large company invited the small company to join the large company's existing organization in AWS Organizations as a new OU.
A DevOps engineer determines that the small company needs to launch t3.small Amazon EC2 instance types for the company's application workloads. The small company needs to deploy the instances only within US-based AWS Regions.
The DevOps engineer needs to use an SCP in the small company's new OU to ensure that the small company can launch only the required instance types.
Which solution will meet these requirements?
A. Configure a statement to deny the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is not equal to t3.small. Configure another statement to deny the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is not equal to us-*.
B. Configure a statement to allow the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is not equal to t3.small. Configure another statement to allow the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is not equal to us-*.
C. Configure a statement to deny the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is equal to t3.small. Configure another statement to deny the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is equal to us-*.
D. Configure a statement to allow the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is equal to t3.small. Configure another statement to allow the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is equal to us-*.
Show Answer
Correct Answer: A
Explanation: Service control policies work by setting maximum permissions using explicit denies. To restrict usage, you must deny actions that fall outside the allowed boundaries. Option A correctly denies ec2:RunInstances when the instance type is not t3.small and denies it when the requested region is not a US region, effectively allowing only t3.small instances in US-based Regions. The other options rely on Allow statements with conditions, which SCPs do not support, or they deny the exact resources that should be permitted.
Question 50
A company uses an Amazon Aurora PostgreSQL global database that has two secondary AWS Regions. A DevOps engineer has configured the database parameter group to guarantee an RPO of 60 seconds. Write operations on the primary cluster are occasionally blocked because of the RPO setting.
The DevOps engineer needs to reduce the frequency of blocked write operations.
Which solution will meet these requirements?
A. Add an additional secondary cluster to the global database.
B. Enable write forwarding for the global database.
C. Remove one of the secondary clusters from the global database.
D. Configure synchronous replication for the global database.
Show Answer
Correct Answer: C
Explanation: Aurora global databases replicate asynchronously to each secondary Region. With a strict 60‑second RPO, writes on the primary are blocked when replication lag to any secondary exceeds the threshold. Removing one secondary cluster reduces cross‑Region replication load and lag, making it less likely that the RPO will be violated and therefore reducing the frequency of blocked write operations. The other options either add more replication burden or do not address replication lag.
Question 51
A company has a continuous integration pipeline where the company creates container images by using AWS CodeBuild. The created images are stored in Amazon Elastic Container Registry (Amazon ECR).
Checking for and fixing the vulnerabilities in the images takes the company too much time. The company wants to identify the image vulnerabilities quickly and notify the security team of the vulnerabilities.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Activate Amazon Inspector enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
B. Create an Amazon EventBridge rule for Amazon Inspector findings. Set an Amazon Simple Notification Service (Amazon SNS) topic as the rule target.
C. Activate AWS Lambda enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Email Service (Amazon SES).
D. Create a new AWS Lambda function. Invoke the new Lambda function when scan findings are detected.
E. Activate default basic scanning for Amazon ECR for all container images. Configure the default basic scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
Show Answer
Correct Answer: A, B
Explanation: Amazon Inspector enhanced scanning for Amazon ECR provides automated, continuous vulnerability scanning of container images with minimal setup. Using continuous scanning ensures new and updated images are assessed immediately. Amazon Inspector publishes findings to Amazon EventBridge by default, so creating an EventBridge rule to forward those findings to an Amazon SNS topic enables quick notification of the security team without custom code. This combination delivers fast detection and alerting with the least operational overhead.
Question 52
A company has deployed a new REST API by using Amazon API Gateway. The company uses the API to access confidential data. The API must be accessed from only specific VPCs in the company.
Which solution will meet these requirements?
A. Create and attach a resource policy to the API Gateway API. Configure the resource policy to allow only the specific VPC IDs.
B. Add a security group to the API Gateway API. Configure the inbound rules to allow only the specific VPC IP address ranges.
C. Create and attach an IAM role to the API Gateway API. Configure the IAM role to allow only the specific VPC IDs.
D. Add an ACL to the API Gateway API. Configure the outbound rules to allow only the specific VPC IP address ranges.
Show Answer
Correct Answer: A
Explanation: Amazon API Gateway supports resource policies that can restrict access based on source conditions such as VPC IDs (for private APIs via VPC endpoints) or IP ranges. Attaching a resource policy to the API and allowing only specific VPC IDs ensures the API can be accessed only from the designated VPCs. API Gateway does not use security groups or ACLs directly, and IAM roles cannot restrict access by VPC ID in this manner.
Question 53
A large company runs critical workloads in multiple AWS accounts. The AWS accounts are managed under AWS Organizations with all features enabled. The company stores confidential customer data in an Amazon S3 bucket. Access to the S3 bucket requires multiple levels of approval.
The company wants to monitor when the S3 bucket is accessed by using the AWS CLI. The company also wants insights into the various activities performed by other users on all other S3 buckets in the AWS accounts to detect any issues.
Which solution will meet these requirements?
A. Create an AWS CloudTrail trail that is delivered to Amazon CloudWatch in each AWS account. Enable data events logs for all S3 buckets. Use Amazon GuardDuty for anomaly detection in all the AWS accounts. Use Amazon Athena to perform SQL queries on the custom metrics created from the CloudTrail logs.
B. Create an AWS CloudTrail organization trail that is delivered to Amazon CloudWatch in the Organizations management account. Enable data events logs for all S3 buckets. Use Amazon CloudWatch anomaly detection in all the AWS accounts. Use Amazon Athena to perform SQL queries on the custom metrics created from the CloudTrail logs.
C. Create an AWS CloudTrail organization trail that is delivered to Amazon CloudWatch in the Organizations management account. Enable data events logs for all S3 buckets. Use Amazon CloudWatch anomaly detection in all the AWS accounts. Use Amazon CloudWatch Metrics Insights to perform SQL queries on the custom metrics created from the CloudTrail logs.
D. Create an AWS CloudTrail trail that is delivered to Amazon CloudWatch in each AWS account. Enable data events logs for all S3 buckets. Use a custom solution for anomaly detection in all the AWS accounts. Use Amazon CloudWatch Metrics Insights to perform SQL queries on the custom metrics created from the CloudTrail logs.
Show Answer
Correct Answer: C
Explanation: An AWS CloudTrail organization trail is required to centrally monitor S3 access across all AWS accounts in AWS Organizations. Delivering the trail to Amazon CloudWatch enables near-real-time monitoring via the AWS CLI. Enabling S3 data events captures object-level access for the confidential bucket and all other buckets. Amazon CloudWatch anomaly detection can identify unusual activity patterns. Because the logs are in CloudWatch, SQL-style analysis must be done with Amazon CloudWatch Metrics Insights; Amazon Athena can only query data stored in Amazon S3, not CloudWatch metrics. Therefore, option C best meets all requirements.
Question 54
A DevOps team manages infrastructure for an application. The application uses long-running processes to process items from an Amazon Simple Queue Service (Amazon SQS) queue. The application is deployed to an Auto Scaling group.
The application recently experienced an issue where items were taking significantly longer to process. The queue exceeded the expected size, which prevented various business processes from functioning properly. The application records all logs to a third-party tool.
The team is currently subscribed to an Amazon Simple Notification Service (Amazon SNS) topic that the team uses for alerts. The team needs to be alerted if the queue exceeds the expected size.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an Amazon CloudWatch metric alarm with a period of 1 hour and a static threshold to alarm if the average of the ApproximateNumberOfMessagesDelayed metric is greater than the expected value. Configure the alarm to notify the SNS topic.
B. Create an Amazon CloudWatch metric alarm with a period of 1 hour and a static threshold to alarm if the sum of the ApproximateNumberOfMessagesVisible metric is greater than the expected value. Configure the alarm to notify the SNS topic.
C. Create an AWS Lambda function that retrieves the ApproximateNumberOfMessages SQS queue attribute value and publishes the value as a new CloudWatch custom metric. Create an Amazon EventBridge rule that is scheduled to run every 5 minutes and that invokes the Lambda function. Configure a CloudWatch metrics alarm with a period of 1 hour and a static threshold to alarm if the sum of the new custom metric is greater than the expected value.
D. Create an AWS Lambda function that checks the ApproximateNumberOfMessagesDelayed SQS queue attribute and compares the value to a defined expected size in the function. Create an Amazon EventBridge rule that is scheduled to run every 5 minutes and that invokes the Lambda function. When the ApproximateNumberOfMessagesDelayed SQS queue attribute exceeds the expected size, send a notification the SNS topic.
Show Answer
Correct Answer: B
Explanation: The requirement is to be alerted when the SQS queue exceeds the expected size with the most operational efficiency. Amazon SQS already publishes the relevant metrics to CloudWatch, so no custom Lambda or EventBridge scheduling is needed. The metric that reflects backlog is ApproximateNumberOfMessagesVisible, which represents messages available for processing. A CloudWatch alarm with a static threshold that triggers an SNS notification directly meets the requirement with minimal operational overhead. Metrics like ApproximateNumberOfMessagesDelayed do not represent processing backlog, and Lambda-based solutions add unnecessary complexity.
Question 55
A company operates a globally deployed product out of multiple AWS Regions. The company's DevOps team needs to use Amazon API Gateway to deploy an API to support the product.
The API must be deployed redundantly. The deployment must provide independent availability from each company location. The deployment also must respond to a custom domain URL and must optimize performance for the API user requests.
Which solution will meet these requirements?
A. Deploy an API Gateway edge-optimized API endpoint in the us-east-1 Region. Create an API Gateway custom domain for the API. Create an Amazon Route 53 record set with a geoproximity routing policy for the API's custom domain. Increase the geographic bias to the maximum allowed value.
B. Deploy an API Gateway regional API endpoint in the us-east-1 Region. Integrate the API Gateway API with a public Application Load Balancer (ALB). Create an AWS Global Accelerator standard accelerator. Associate the endpoint with the ALCreate an Amazon Route 53 alias record set that points the custom domain name to the DNS name that is assigned to the accelerator.
C. Deploy an API Gateway regional API endpoint in every AWS Region where the company's product is deployed. Create an API Gateway custom domain in each Region for the deployed API Gateway API. Create an Amazon Route 53 record set that has a latency routing policy for every deployed API Gateway custom domain.
D. Deploy an API Gateway edge-optimized API endpoint in the us-east-1 Region. Create an Amazon CloudFront distribution. Configure the CloudFront distribution with an alternate domain name. Specify the API Gateway Invoke URL as the origin domain. Create an Amazon Route 53 alias record set with a simple routing policy. Point the routing policy to the CloudFront distribution domain name.
Show Answer
Correct Answer: C
Explanation: The requirements call for redundant, region-independent availability, support for a custom domain, and optimized performance for global users. Deploying API Gateway regional endpoints in every required AWS Region provides true regional independence. Creating a custom domain in each Region and using Amazon Route 53 latency-based routing directs users to the closest healthy Region, optimizing performance while maintaining redundancy. Other options either rely on a single Region or do not provide independent regional deployments.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.