A CloudOps engineer has used AWS CloudFormation to deploy a serverless application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The CloudOps engineer must delete the AWS CloudFormation stack without deleting the DynamoDB table.
Which action should the CloudOps engineer take before deleting the AWS CloudFormation stack?
A. Add a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
B. Add a Snapshot deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
C. Enable termination protection on the AWS CloudFormation stack.
D. Update the application's IAM policy with a Deny statement for the dynamodb:DeleteTable action.
Show Answer
Correct Answer: A
Explanation: CloudFormation deletes managed resources when a stack is deleted unless a DeletionPolicy is specified. Setting DeletionPolicy to Retain on the DynamoDB table preserves the table while allowing the rest of the stack to be deleted. Snapshot is not the appropriate policy for DynamoDB in this context, termination protection prevents stack deletion, and an IAM deny on DeleteTable would interfere rather than instruct CloudFormation to retain the resource.
Question 12
A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the account.
Which solution will meet this requirement with the MOST operational efficiency?
A. Create an Amazon CloudWatch alarm that detects AWS Management Console root user sign-in events. Configure the alarm to send email notifications directly through AWS Trusted Advisor.
B. Launch an Amazon EC2 instance. Schedule a script to run every hour to analyze AWS CloudTrail events. Configure the script to send email notifications to an Amazon SNS topic when AWS Management Console root user sign-in events occur.
C. Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in events. Configure the rule to send email notifications to an Amazon SQS queue.
D. Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in events. Configure the rule to send email notifications to an Amazon SNS topic.
Show Answer
Correct Answer: D
Explanation: Amazon EventBridge can directly match AWS Management Console root user sign-in events from CloudTrail and invoke an Amazon SNS topic for email notifications. This is a fully managed, event-driven solution with minimal operational overhead. CloudWatch alarms do not directly detect these sign-in events for email via Trusted Advisor, an EC2 polling script is operationally inefficient, and SQS does not send email notifications.
Question 13
A company has a new security policy that requires all Amazon EBS volumes to be encrypted at rest. The company needs to use a custom key policy to manage access to the encryption keys. The company must rotate the keys once each year.
Which solution will meet these requirements with the LEAST operational overhead?
D. Create AWS KMS symmetric customer managed keys by using imported key material. Rotate the keys on a yearly basis.
Show Answer
Correct Answer: A
Explanation: Amazon EBS encryption uses AWS KMS symmetric keys, not asymmetric keys. The requirement for a custom key policy means the company must use customer managed KMS keys rather than AWS owned keys. Automatic rotation is supported for symmetric customer managed keys and rotates annually with minimal operational effort. Imported key material does not support automatic rotation and would require manual management.
Question 14
To comply with regulations, a CloudOps engineer needs to back up an Amazon EC2 Amazon Machine Image (AMI) to an Amazon S3 bucket. If the CloudOps engineer restores the AMI from the bucket in the future, the AMI must use the same AMI image ID as the original AMI.
Which solution will meet this requirement?
A. Create a copy of the AMI. Specify the destination S3 bucket. Set the launch permissions to implicit.
B. Archive the snapshot that is associated with the AMI. Specify the S3 bucket as the archive destination.
C. Create a store image task. Specify the image ID and the destination S3 bucket.
D. Use the AWS CLI copy-image command. Specify the image ID and the destination S3 bucket.
Show Answer
Correct Answer: C
Explanation: The only AWS feature that backs up an AMI directly to an Amazon S3 bucket is the CreateStoreImageTask API. However, AWS does not preserve the original AMI ID when the image is restored; a restored AMI receives a new AMI ID. Therefore, while option C is the correct mechanism for storing an AMI in S3, the stated requirement of restoring with the same AMI ID cannot be met by AWS.
Sources:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-store-restore.html
https://repost.aws/questions/QUam7wlMUpSFiD5qgD24WcVQ/i-want-to-move-ami
Question 15
A CloudOps engineer manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member accounts. The CloudOps engineer must prevent all teams, including their administrators, from using Amazon DynamoDB. The solution must not affect the ability of the teams to access other AWS services.
Which solution will meet these requirements?
A. In all member accounts, configure IAM policies that deny access to all DynamoDB resources for all users, including the root user.
B. Create a service control policy (SCP) in the management account to deny all DynamoDB actions. Apply the SCP to the root of the organization.
C. In all member accounts, configure IAM policies that deny AmazonDynamoDBFullAccess to all users, including the root user.
D. Remove the default service control policy (SCP) in the management account. Create a replacement SCP that includes a single statement that denies all DynamoDB actions.
Show Answer
Correct Answer: B
Explanation: Service control policies (SCPs) set the maximum available permissions for member accounts in AWS Organizations. An SCP that explicitly denies all DynamoDB actions, attached at the organization root, applies to all member accounts and cannot be bypassed by IAM users, roles, or the member account root user. IAM policies cannot restrict the root user, and removing the default SCP is unnecessary and would not by itself implement the required restriction.
Question 16
A CloudOps engineer configured AWS Backup to capture snapshots from a single Amazon EC2 instance that has one Amazon EBS volume attached. On the first snapshot, the EBS volume has 10 GiB of data. On the second snapshot, the EBS volume still contains 10 GiB of data, but 4 GiB have changed. On the third snapshot, 2 GiB of data have been added to the volume, for a total of 12 GiB.
How much total storage is required to store these snapshots?
A. 12 GIB
B. 16 GiB
C. 26 GiB
D. 32 GIB
Show Answer
Correct Answer: B
Explanation: Amazon EBS snapshots are incremental after the first snapshot. The first snapshot stores 10 GiB. The second snapshot stores only the 4 GiB of changed blocks. The third snapshot stores only the 2 GiB of newly added blocks. Total snapshot storage is 10 + 4 + 2 = 16 GiB.
Question 17
A CloudOps engineer is troubleshooting a VPC with public and private subnets that leverage custom network ACLs. Instances in the private subnet are unable to access the internet. There is an internet gateway attached to the public subnet. The private subnet has a route to a NAT gateway that is also attached to the public subnet. The Amazon EC2 instances are associated with the default security group for the VPC.
What is causing the issue in this scenario?
A. There Is a network ACL on the private subnet set to deny all outbound traffic.
B. There is no NAT gateway deployed in the private subnet of the VPC.
C. The default security group for the VPC blocks all inbound traffic to the EC2 instances.
D. The default security group for the VPC blocks all outbound traffic from the EC2 instances.
Show Answer
Correct Answer: A
Explanation: The VPC design described is otherwise correct: private subnet routes to a NAT gateway in a public subnet, and the public subnet has an internet gateway. A NAT gateway is supposed to reside in a public subnet, so option B is incorrect. The default VPC security group allows all outbound traffic and allows inbound traffic only from resources in the same security group, so options C and D are incorrect. Because the subnets use custom network ACLs, a restrictive outbound ACL (or missing required allow rules, including ephemeral return traffic) can prevent internet access. Among the choices, the network ACL denying outbound traffic is the matching root cause.
Question 18
A company runs an application on a fleet of Amazon EC2 Windows instances in a Multi-AZ deployment. The company needs a solution that will give the instances access to shared files.
The solution must be highly available, must use native Windows storage capabilities, and must maximize consistency for all file requests.
Which solution will meet these requirements?
A. Create an Amazon FSx for Windows File Server Multi-AZ file system. Map file shares on the instances by using the file system's DNS name.
B. Grant the instances access to a shared Amazon S3 bucket. Use Windows Task Scheduler to synchronize the contents of the S3 bucket locally to each instance periodically.
C. Create an Amazon EFS file system that uses the EFS Standard storage class. Mount the file system to the instances by using the file system's DNS name and the EFS mount helper.
D. Create a new Amazon EBS Multi-Attach volume. Attach the EBS volume as an additional drive to each instance.
Show Answer
Correct Answer: A
Explanation: Amazon FSx for Windows File Server Multi-AZ provides highly available, native Windows SMB file shares with synchronous replication and strong consistency semantics suitable for shared Windows application data. It integrates with Windows using DNS-mapped shares. S3 is object storage and periodic sync is not consistent. Amazon EFS does not provide native Windows SMB access. Amazon EBS Multi-Attach is only supported for specific Linux clustered file systems, not Windows shared storage.
Question 19
A company runs on-premises workloads that need to use AWS hosted DNS services. The company requires high availability for DNS queries to ensure continuous DNS resolution for critical applications.
Which solution will meet these requirements?
A. Deploy Amazon Route 53 Resolver inbound endpoints to multiple Availability Zones. Configure on-premises DNS resolvers to use the endpoint IP addresses in a failover configuration.
B. Use Amazon Route 53 latency-based routing to ensure that DNS queries from on-premises systems are directed to the closest resolver endpoint.
C. Configure an Amazon Route 53 private hosted zone. Associate the private hosted zone with the on-premises network.
D. Deploy Amazon Route 53 Resolver outbound endpoints to multiple Availability Zones. Associate the endpoints with the on-premises DNS resolvers.
Show Answer
Correct Answer: A
Explanation: Route 53 Resolver inbound endpoints allow DNS queries originating from on-premises networks to resolve records hosted in AWS (such as private hosted zones). Deploying inbound endpoints across multiple Availability Zones provides high availability, and configuring the on-premises DNS resolvers to use the endpoint IP addresses with failover ensures continued DNS resolution if one endpoint becomes unavailable. Latency-based routing is unrelated to Resolver endpoints, private hosted zones cannot be directly associated with on-premises networks, and outbound endpoints are for forwarding DNS queries from AWS to on-premises DNS servers, not the reverse.
Question 20
A company has an application that processes events sequentially by using an Amazon SQS FIFO queue. The company needs a solution that automatically sends notifications to the SQS queue when new objects are uploaded to an Amazon S3 bucket. The solution must maintain message ordering.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS Lambda function that polls the objects by using the ListObjectsV2 command and detects new objects when the objects are added. Configure the Lambda function to add a message to the SQS queue when new objects are detected.
B. Create an event notification on the S3 bucket. Use the FIFO delivery option. Route the notifications to the existing SQS queue.
C. Create an Amazon SNS FIFO topic. Create an event notification on the S3 bucket. Configure the event to send messages to the SNS topic. Subscribe the existing SQS queue to the SNS topic.
D. Create an access point in Amazon S3 Access Points. Configure the access point to send new items to the existing SQS queue.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Event Notifications can be configured to send object-created events directly to an Amazon SQS FIFO queue using FIFO delivery support, preserving ordering semantics without custom polling or intermediary services. This is the lowest operational overhead. Lambda polling is inefficient, SNS adds an unnecessary component, and S3 Access Points do not provide event forwarding to SQS.
$19
Get all 130 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.