A company stores its Python-based application code in AWS CodeCommit. The company uses AWS CodePipeline to deploy the application. The CodeCommit repository and the CodePipeline pipeline are deployed to the same AWS account.
The company's security team requires all code to be scanned for vulnerabilities before the code is deployed to production. If any vulnerabilities are found, the deployment must stop.
Which solution will meet these requirements?
A. Create a new CodeBuild project. Configure the project to run a security scan on the code by using Amazon CodeGuru Security. Configure the CodeBuild project to raise an error if CodeGuru Security finds vulnerabilities. Create a new IAM role that has sufficient permissions to run CodeGuru Security scans. Assign the role to the CodeBuild project. In the CodePipeline pipeline, add a new stage before the deployment stage. Select AWS CodeBuild as the action provider for the new stage. Use the source artifact from the CodeCommit repository. Configure the action to use the CodeBuild project.
B. Create a new CodeBuild project. Configure the project to run a security scan on the code by using Amazon Inspector. Configure the CodeBuild project to raise an error if Amazon Inspector finds vulnerabilities. Create a new IAM role that has sufficient permissions to run Amazon Inspector scans. Assign the role to the CodeBuild project. In the CodePipeline pipeline, add a new stage before the deployment stage. Select AWS CodeBuild as the action provider for the new stage. Use the source artifact from the CodeCommit repository. Configure the action to use the CodeBuild project.
C. Update the IAM role that is attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the CodePipeline pipeline, add a new stage before the deployment stage. Select DevOps Guru as the action provider for the new stage. Use the source artifact from the CodeCommit repository.
D. Update the IAM role that is attached to CodePipeline to include sufficient permissions to invoke Amazon DevOps Guru. In the CodePipeline pipeline, add a new stage before the deployment stage. Select CodeGuru Security as the action provider for the new stage. Use the source artifact from the CodeCommit repository.
Show Answer
Correct Answer: A
Explanation: Amazon CodeGuru Security is the AWS service for static application security testing (SAST) of source code, including Python. Integrating a CodeBuild project into CodePipeline before deployment allows the scan to run and fail the build if vulnerabilities are detected, preventing deployment. Amazon Inspector scans workloads and container images rather than performing source code SAST, and DevOps Guru is for operational issue detection, not code vulnerability scanning.
Question 84
A company has a web application that is hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster runs on AWS Fargate that is available through an internet-facing Application Load Balancer.
The application is experiencing stability issues that lead to longer response times. A DevOps engineer needs to configure observability in Amazon CloudWatch to troubleshoot the issue. The solution must provide only the minimum necessary permissions.
Which combination of steps will meet these requirements? (Choose three.)
A. Deploy the CloudWatch agent as a Kubernetes StatefulSet to the EKS cluster.
B. Deploy the AWS Distro for OpenTelemetry Collector as a Kubernetes DaemonSet to the EKS cluster.
C. Associate a Kubernetes service account with an IAM role by using IAM roles for service accounts in Amazon EKS. Use the CloudWatchAgentServerPolicy AWS managed policy.
D. Associate a Kubernetes service account with an IAM role by using IAM roles for service accounts in Amazon EKS. Use the CloudWatchAgentAdminPolicy AWS managed policy.
E. Configure an IAM OpenID Connect (OIDC) provider for the EKS cluster.
F. Enable EKS control plane logging for the EKS cluster.
Show Answer
Correct Answer: C, E, F
Explanation: For EKS, IRSA requires an IAM OIDC provider and a Kubernetes service account associated with an IAM role. Using CloudWatchAgentServerPolicy follows least privilege compared to the admin policy. Enabling EKS control plane logging sends control plane logs to CloudWatch for troubleshooting. On EKS Fargate, DaemonSets are not supported, so deploying the ADOT Collector as a DaemonSet is not viable; a CloudWatch agent StatefulSet is also not the standard requirement for Fargate observability in this context.
Sources:
https://docs.aws.amazon.com/pdfs/prescriptive-guidance/latest/amazon-eks-observability-best-practices/amazon-eks-observability-best-practices.pdf
https://aws.amazon.com/blogs/devops/automate-container-anomaly-monitoring-of-amazon-elastic-kubernetes-service-clusters-with-amazon-devops-guru
Question 85
A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. The company launches and terminates new EC2 instances every hour. The account includes existing EC2 instances that have been running for longer than a week.
The company's security policy requires all running EC2 instances to have an EC2 instance profile attached. The company has created a default EC2 instance profile. The default EC2 instance profile must be attached to any EC2 instances that do not have a profile attached.
Which solution will meet these requirements?
A. Configure an Amazon EventBridge rule that matches the Amazon EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function to attach the default instance profile to the EC2 instances.
B. Configure AWS Config. Deploy an AWS Config ec2-instance-profile-attached managed rule. Configure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.
C. Configure an Amazon EventBridge rule that matches the Amazon EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.
D. Configure AWS Config. Deploy an AWS Config iam-role-managed-policy-check managed rule. Configure an automatic remediation action that invokes an AWS Lambda function to attach the default instance profile to the EC2 instances.
Show Answer
Correct Answer: B
Explanation: AWS Config provides the managed rule ec2-instance-profile-attached to detect EC2 instances without an attached instance profile, including existing long-running instances and newly launched instances. By configuring automatic remediation with an AWS Systems Manager Automation runbook, the default instance profile can be attached automatically whenever noncompliance is detected. EventBridge rules on RunInstances or StartInstances would not continuously evaluate existing resources, and iam-role-managed-policy-check is unrelated to instance profile attachment.
Question 86
A security team wants to use AWS CloudTrail to monitor all actions and API calls in multiple accounts that are in the same organization in AWS Organizations. The security team needs to ensure that account users cannot turn off CloudTrail in the accounts.
Which solution will meet this requirement?
A. Apply an SCP to all OUs to deny the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail action.
B. Create IAM policies in each account to deny the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail action.
C. Set up Amazon CloudWatch alarms to notify the security team when a user disables CloudTrail in an account.
D. Use AWS Config to automatically re-enable CloudTrail if a user disables CloudTrail in an account.
Show Answer
Correct Answer: A
Explanation: An AWS Organizations service control policy (SCP) can prevent principals in member accounts from calling cloudtrail:StopLogging and cloudtrail:DeleteTrail, even if they otherwise have IAM permissions. This enforces the restriction across all accounts in the organization. IAM policies can be modified within accounts, while CloudWatch alarms and AWS Config only detect or remediate after the fact rather than preventing the action.
Question 87
A large company recently acquired a small company. The large company invited the small company to join the large company's existing organization in AWS Organizations as a new OU.
A DevOps engineer determines that the small company needs to launch t3.small Amazon EC2 instance types for the company's application workloads. The small company needs to deploy the instances only within US-based AWS Regions.
The DevOps engineer needs to use an SCP in the small company's new OU to ensure that the small company can launch only the required instance types.
Which solution will meet these requirements?
A. Configure a statement to deny the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is not equal to t3.small. Configure another statement to deny the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is not equal to us-*.
B. Configure a statement to allow the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is not equal to t3.small. Configure another statement to allow the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is not equal to us-*.
C. Configure a statement to deny the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is equal to t3.small. Configure another statement to deny the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is equal to us-*.
D. Configure a statement to allow the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is equal to t3.small. Configure another statement to allow the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is equal to us-*.
Show Answer
Correct Answer: A
Explanation: SCPs are best used with explicit Deny statements to set guardrails. Deny ec2:RunInstances when ec2:InstanceType is not t3.small prevents launching any other instance type. A separate Deny on ec2:RunInstances when aws:RequestedRegion is not a US region (us-*) restricts launches to US-based Regions. The Allow-based options are invalid for this use case because SCP Allow statements cannot be conditioned in the required way, and option C denies the desired configuration instead of undesired ones.
Question 88
A company uses an Amazon Aurora PostgreSQL global database that has two secondary AWS Regions. A DevOps engineer has configured the database parameter group to guarantee an RPO of 60 seconds. Write operations on the primary cluster are occasionally blocked because of the RPO setting.
The DevOps engineer needs to reduce the frequency of blocked write operations.
Which solution will meet these requirements?
A. Add an additional secondary cluster to the global database.
B. Enable write forwarding for the global database.
C. Remove one of the secondary clusters from the global database.
D. Configure synchronous replication for the global database.
Show Answer
Correct Answer: C
Explanation: Aurora Global Database uses asynchronous cross-Region replication. The managed RPO feature can block writes on the primary when replication lag exceeds the configured threshold (60 seconds). Reducing the number of secondary clusters reduces cross-Region replication work and the likelihood that lag exceeds the RPO threshold, thereby reducing blocked writes. Write forwarding does not reduce replication lag, adding another secondary would increase replication overhead, and synchronous replication across Aurora Global Database is not supported.
Question 89
A company has a continuous integration pipeline where the company creates container images by using AWS CodeBuild. The created images are stored in Amazon Elastic Container Registry (Amazon ECR).
Checking for and fixing the vulnerabilities in the images takes the company too much time. The company wants to identify the image vulnerabilities quickly and notify the security team of the vulnerabilities.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Activate Amazon Inspector enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
B. Create an Amazon EventBridge rule for Amazon Inspector findings. Set an Amazon Simple Notification Service (Amazon SNS) topic as the rule target.
C. Activate AWS Lambda enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Email Service (Amazon SES).
D. Create a new AWS Lambda function. Invoke the new Lambda function when scan findings are detected.
E. Activate default basic scanning for Amazon ECR for all container images. Configure the default basic scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
Show Answer
Correct Answer: A, B
Explanation: Amazon Inspector enhanced scanning for Amazon ECR provides continuous vulnerability assessment with minimal operational overhead. Amazon Inspector emits findings to Amazon EventBridge, which can route them directly to an Amazon SNS topic to notify the security team without requiring custom code. Basic scanning does not provide continuous Inspector-based findings, and Lambda/SES options add unnecessary operational complexity.
Question 90
A company has deployed a new REST API by using Amazon API Gateway. The company uses the API to access confidential data. The API must be accessed from only specific VPCs in the company.
Which solution will meet these requirements?
A. Create and attach a resource policy to the API Gateway API. Configure the resource policy to allow only the specific VPC IDs.
B. Add a security group to the API Gateway API. Configure the inbound rules to allow only the specific VPC IP address ranges.
C. Create and attach an IAM role to the API Gateway API. Configure the IAM role to allow only the specific VPC IDs.
D. Add an ACL to the API Gateway API. Configure the outbound rules to allow only the specific VPC IP address ranges.
Show Answer
Correct Answer: A
Explanation: API Gateway supports resource policies that can restrict access based on the source VPC or VPC endpoint (for private APIs), as well as IP-based conditions. Security groups cannot be attached to API Gateway, IAM roles do not restrict access by VPC, and network ACLs are VPC constructs, not API Gateway controls. A resource policy is the correct mechanism to limit API access to specific VPCs.
Question 91
A large company runs critical workloads in multiple AWS accounts. The AWS accounts are managed under AWS Organizations with all features enabled. The company stores confidential customer data in an Amazon S3 bucket. Access to the S3 bucket requires multiple levels of approval.
The company wants to monitor when the S3 bucket is accessed by using the AWS CLI. The company also wants insights into the various activities performed by other users on all other S3 buckets in the AWS accounts to detect any issues.
Which solution will meet these requirements?
A. Create an AWS CloudTrail trail that is delivered to Amazon CloudWatch in each AWS account. Enable data events logs for all S3 buckets. Use Amazon GuardDuty for anomaly detection in all the AWS accounts. Use Amazon Athena to perform SQL queries on the custom metrics created from the CloudTrail logs.
B. Create an AWS CloudTrail organization trail that is delivered to Amazon CloudWatch in the Organizations management account. Enable data events logs for all S3 buckets. Use Amazon CloudWatch anomaly detection in all the AWS accounts. Use Amazon Athena to perform SQL queries on the custom metrics created from the CloudTrail logs.
C. Create an AWS CloudTrail organization trail that is delivered to Amazon CloudWatch in the Organizations management account. Enable data events logs for all S3 buckets. Use Amazon CloudWatch anomaly detection in all the AWS accounts. Use Amazon CloudWatch Metrics Insights to perform SQL queries on the custom metrics created from the CloudTrail logs.
D. Create an AWS CloudTrail trail that is delivered to Amazon CloudWatch in each AWS account. Enable data events logs for all S3 buckets. Use a custom solution for anomaly detection in all the AWS accounts. Use Amazon CloudWatch Metrics Insights to perform SQL queries on the custom metrics created from the CloudTrail logs.
Show Answer
Correct Answer: C
Explanation: An AWS CloudTrail organization trail is the appropriate centralized solution for AWS Organizations with all features enabled. Enabling S3 data events captures object-level access across buckets, including AWS CLI access to the sensitive bucket. CloudWatch anomaly detection can help identify unusual activity from CloudTrail-derived metrics. Amazon CloudWatch Metrics Insights supports SQL-like queries over CloudWatch metrics, whereas Athena queries data stored in Amazon S3 rather than CloudWatch metrics. Therefore, the option using an organization trail and Metrics Insights is the best fit.
Question 92
A DevOps team manages infrastructure for an application. The application uses long-running processes to process items from an Amazon Simple Queue Service (Amazon SQS) queue. The application is deployed to an Auto Scaling group.
The application recently experienced an issue where items were taking significantly longer to process. The queue exceeded the expected size, which prevented various business processes from functioning properly. The application records all logs to a third-party tool.
The team is currently subscribed to an Amazon Simple Notification Service (Amazon SNS) topic that the team uses for alerts. The team needs to be alerted if the queue exceeds the expected size.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an Amazon CloudWatch metric alarm with a period of 1 hour and a static threshold to alarm if the average of the ApproximateNumberOfMessagesDelayed metric is greater than the expected value. Configure the alarm to notify the SNS topic.
B. Create an Amazon CloudWatch metric alarm with a period of 1 hour and a static threshold to alarm if the sum of the ApproximateNumberOfMessagesVisible metric is greater than the expected value. Configure the alarm to notify the SNS topic.
C. Create an AWS Lambda function that retrieves the ApproximateNumberOfMessages SQS queue attribute value and publishes the value as a new CloudWatch custom metric. Create an Amazon EventBridge rule that is scheduled to run every 5 minutes and that invokes the Lambda function. Configure a CloudWatch metrics alarm with a period of 1 hour and a static threshold to alarm if the sum of the new custom metric is greater than the expected value.
D. Create an AWS Lambda function that checks the ApproximateNumberOfMessagesDelayed SQS queue attribute and compares the value to a defined expected size in the function. Create an Amazon EventBridge rule that is scheduled to run every 5 minutes and that invokes the Lambda function. When the ApproximateNumberOfMessagesDelayed SQS queue attribute exceeds the expected size, send a notification the SNS topic.
Show Answer
Correct Answer: B
Explanation: Amazon SQS already publishes the ApproximateNumberOfMessagesVisible CloudWatch metric, which represents the number of messages available for processing (the queue backlog). The most operationally efficient solution is to create a CloudWatch alarm directly on this native metric and notify the existing SNS topic. ApproximateNumberOfMessagesDelayed measures only delayed messages, not the overall queue size, and Lambda-based polling/custom metrics add unnecessary operational overhead.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.