A company uses Amazon Route 53 with latency-based routing across multiple AWS Regions to provide resiliency. The company uses Route 53 with latency-based routing to direct traffic to the nearest Region. Within each Region, weighted A records distribute traffic across multiple Availability Zones.
During a recent update, some Availability Zone endpoints became unhealthy. Route 53 continued to route traffic to the unhealthy endpoints. The company must prevent this issue from occurring in the future.
Which solution will meet this requirement?
A. Add a Route 53 health check for each of the weighted records that received traffic during the recent update.
B. Increase the weight of Route 53 records in the Region where traffic must go during updates.
C. Reconfigure all records to use latency-based routing across all Regions uniformly.
D. Reduce the TTL value for latency-based routing to detect changes more quickly.
Show Answer
Correct Answer: A
Explanation: Associate a Route 53 health check with each weighted record for an Availability Zone endpoint. Route 53 can then stop returning records whose endpoints are unhealthy. Changing weights or TTLs does not detect endpoint health, and latency-based routing selects among Regions rather than checking Availability Zone endpoints.
Question 3
A retail company runs its primary ecommerce web application in the us-east-1 AWS Region with a fully configured disaster recovery (DR) environment in the us-west-2 Region. The company requires automatic failover to the DR environment if the primary environment becomes unhealthy.
How should the company configure Amazon Route 53 to enable automated failover between the primary and DR environments?
A. Create a Route 53 health check that monitors the primary web application endpoint. Configure a failover routing policy with primary and secondary records that point to the respective primary and secondary environments. Set the primary record with the health check association. Configure the secondary record as the failover record.
B. Create two Route 53 latency-based routing records. Point one routing record at each environment. Configure Amazon CloudWatch alarms to monitor the primary environment. Use an Amazon EventBridge rule to update the latency routing weights when the primary environment becomes unhealthy.
C. Configure a Route 53 geolocation routing policy that directs all global traffic to the primary Region by default. Set up Route 53 DNS Firewall rules to detect application failures and automatically update the geolocation routing to redirect traffic to the secondary Region.
D. Deploy Route 53 Resolver DNS Firewall rule groups in both Regions. Configure Amazon CloudWatch alarms to monitor the primary environment. Use Amazon EventBridge rules to trigger DNS Firewall actions that redirect queries to the DR environment when failures occur.
Show Answer
Correct Answer: A
Explanation: Use a Route 53 failover routing policy with primary and secondary records. Associate a health check with the primary record so Route 53 sends traffic to the secondary DR environment when the primary endpoint is unhealthy.
Question 4
A CloudOps engineer has blocked public access to all company Amazon S3 buckets. The CloudOps engineer wants to be notified when an S3 bucket becomes publicly readable in the future.
What is the MOST operationally efficient way to meet this requirement?
A. Create an AWS Lambda function that periodically checks the public access settings for each S3 bucket. Set up Amazon SNS to send notifications.
B. Create a cron script that uses the S3 API to check the public access settings for each S3 bucket. Set up Amazon SNS to send notifications.
C. Enable S3 Event Notifications for each S3 bucket. Subscribe S3 Event Notifications to an Amazon SNS topic.
D. Enable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon SNS topic.
Show Answer
Correct Answer: D
Explanation: AWS Config's managed rule s3-bucket-public-read-prohibited continuously evaluates S3 buckets for public read access and can trigger notifications through Amazon SNS when a bucket becomes noncompliant. This is the most operationally efficient solution because it is managed, event-driven, and avoids building and maintaining custom polling with Lambda or cron jobs. S3 Event Notifications do not natively notify on changes to bucket public readability/compliance.
Question 4
A company is migrating its production file server to AWS. All data that is stored on the file server must remain accessible if an Availability Zone becomes unavailable or when system maintenance is performed. Users must be able to interact with the file server through the SMB protocol Users also must have the ability to manage file permissions by using Windows ACLs.
Which solution will meet these requirements?
A. Create a single AWS Storage Gateway file gateway.
B. Create an Amazon FSx for Windows File Server Multi-AZ file system.
C. Deploy two AWS Storage Gateway file gateways across two Availability Zones. Configure an Application Load Balancer in front of the file gateways.
D. Deploy two Amazon FSx for Windows File Server Single-AZ 2 file systems Configure Microsoft Distributed File System Replication (DFSR).
Show Answer
Correct Answer: B
Explanation: Amazon FSx for Windows File Server provides SMB file shares and supports Windows ACLs. A Multi-AZ file system replicates data across Availability Zones and supports failover during AZ outages or maintenance, meeting the availability requirement.
Question 4
A company needs to monitor the disk utilization of Amazon EBS volumes. The EBS volumes are attached to Amazon EC2 Linux instances. A CloudOps engineer must set up an Amazon CloudWatch alarm that provides an alert when disk utilization increases to more than 80%.
Which combination of steps must the CloudOps engineer take to meet these requirements? (Choose three.)
A. Create an IAM role that includes the CloudWatchAgentServerPolicy AWS managed policy. Attach the role to the instances.
B. Create an IAM role that includes the CloudWatchApplicationInsightsReadOnlyAccess AWS managed policy. Attach the role to the instances.
C. Install and start the CloudWatch agent by using AWS Systems Manager or the command line.
D. Install and start the CloudWatch agent by using an IAM role. Attach the CloudWatchAgentServerPolicy AWS managed policy to the role.
E. Configure a CloudWatch alarm to enter ALARM state when the disk_used_percent CloudWatch metric is greater than 80%.
F. Configure a CloudWatch alarm to enter ALARM state when the disk_used CloudWatch metric is greater than 80% or when the disk_free CloudWatch metric is less than 20%.
Show Answer
Correct Answer: A, C, E
Explanation: The CloudWatch agent must run on each Linux instance to collect disk utilization metrics, and the instance role needs the CloudWatchAgentServerPolicy to publish those metrics to CloudWatch. Configure the alarm on the agent’s disk_used_percent metric with a threshold greater than 80%.
Question 5
A school uses a web application to track student attendance. The application uses an Amazon API Gateway REST API and backend AWS Lambda functions. The application stores data in an Amazon DynamoDB table that is in on-demand capacity mode.
Teachers report slow application performance at the same time every weekday. A CloudOps engineer notices that the performance problems happen only when the application demand suddenly increases. The application can handle the peak load if the load increases gradually. The CloudOps engineer must modify the application to resolve the performance issue.
Which solution will meet this requirement?
A. Configure provisioned concurrency with scheduled auto scaling for the Lambda functions.
B. Configure reserved concurrency with scheduled auto scaling for the Lambda functions.
C. Change the DynamoDB table from on-demand capacity mode to provisioned capacity mode with auto scaling.
D. Change the DynamoDB table from on-demand capacity mode to provisioned capacity mode. Set the provisioned capacity to match peak usage.
Show Answer
Correct Answer: A
Explanation: The symptoms indicate Lambda cold-start latency during predictable traffic spikes. The application performs well when load ramps up gradually, but suffers when demand suddenly increases at the same time each weekday. Provisioned concurrency keeps Lambda execution environments pre-initialized, and scheduled auto scaling can increase provisioned concurrency before the expected spike. Reserved concurrency only limits and guarantees concurrency; it does not eliminate cold starts. Changing DynamoDB to provisioned capacity does not address this pattern because the table is already using on-demand mode, which is designed to absorb traffic, and the described behavior matches Lambda initialization latency rather than DynamoDB throughput limits.
Question 5
A CloudOps engineer needs to implement a backup strategy for Amazon EC2 resources and Amazon RDS resources. The backup strategy must meet the following retention requirements:
• Daily backups: must be kept for 6 days
• Weekly backups: must be kept for 4 weeks
• Monthly backups: must be kept for 11 months
• Yearly backups: must be kept for 7 years
Which backup strategy will meet these requirements with the LEAST administrative effort?
A. Use Amazon Data Lifecycle Manager to create an Amazon EBS snapshot policy. Create tags on each resource that needs to be backed up. Create multiple schedules according to the requirements within the policy. Set the appropriate frequency and retention period.
B. Use AWS Backup to create a new backup plan for each retention requirement with a backup frequency of daily, weekly, monthly, or yearly. Set the retention period to match the requirement. Create tags on each resource that needs to be backed up. Set up resource assignment by using the tags.
C. Create an AWS Lambda function. Program the Lambda function to use native tooling to take backups of file systems in Amazon EC2 and to make copies of databases in Amazon RDS. Create an Amazon EventBridge rule to invoke the Lambda function.
D. Use Amazon Data Lifecycle Manager to create an Amazon EBS snapshot policy. Create tags on each resource that needs to be backed up. Set up resource assignment by using the tags. Create multiple schedules according to the requirements within the policy. Set the appropriate frequency and retention period. In Amazon RDS, activate automated backups on the required DB instances.
Show Answer
Correct Answer: B
Explanation: AWS Backup supports both Amazon EC2 and Amazon RDS resources, and backup plans can apply scheduled backups with separate retention periods. Using tag-based resource assignments meets the retention requirements with less administration than custom Lambda automation or managing separate service-specific backup mechanisms.
Question 6
A CloudOps engineer monitors and maintains the availability of resources in an AWS environment. The CloudOps engineer notices that the CPU utilization of an Amazon EC2 instance that runs web server software peaks above 80% at various times during each day. The CPU spikes correlate with peak daily loads. The high CPU load has resulted in performance issues for customers.
The CloudOps engineer needs to resolve the system performance issue without causing any service disruptions.
Which solution will meet these requirements?
A. Configure an Amazon CloudWatch alarm that invokes an AWS Systems Manager Automation runbook to vertically scale the EC2 instance when the CPU utilization exceeds 80%.
B. Configure an AWS Systems Manager Automation runbook to run a script that automatically restarts the application when CPU utilization exceeds 80%.
C. Configure an Amazon EventBridge rule that invokes an AWS Systems Manager Automation document. Configure the document to increase the EC2 instance size when CPU utilization exceeds 80%.
D. Set up an Auto Scaling group with an Amazon CloudWatch alarm that triggers a scaling policy to launch additional EC2 instances when the CPU utilization exceeds 80%.
Show Answer
Correct Answer: D
Explanation: Using an Auto Scaling group with a CloudWatch alarm and scaling policy adds additional EC2 instances during peak CPU demand, distributing load without disrupting service. The other options rely on vertical scaling or restarts, which typically require stopping/replacing the instance or cause service interruption and are less suitable for handling recurring load spikes.
Question 6
An application is running on an Amazon EC2 instance in a VPC with the default DHCP option set. The application connects to an on-premises Microsoft SQL Server database with the DNS name mssql.example.com. The application is unable to resolve the database DNS name.
Which solution will fix this problem?
A. Create an Amazon Route 53 Resolver inbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
B. Create an Amazon Route 53 Resolver inbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
C. Create an Amazon Route 53 Resolver outbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
D. Create an Amazon Route 53 Resolver outbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
Show Answer
Correct Answer: C
Explanation: The EC2 instance needs to send queries for the on-premises domain to the on-premises DNS servers. A Route 53 Resolver outbound endpoint and a forwarding rule for example.com direct those queries to the specified DNS servers. Associate the rule with the VPC so its instances use it. Inbound endpoints are for DNS queries coming into the VPC from on-premises networks.
Question 7
A company stores critical data in Amazon S3 buckets. A CloudOps engineer must build a solution to record all S3 API activity.
Which action will meet this requirement?
A. Configure S3 bucket metrics to record object access logs.
B. Create an AWS CloudTrail trail to log data events for all S3 objects.
C. Enable S3 server access logging for each S3 bucket.
D. Use AWS IAM Access Analyzer for Amazon S3 to store object access logs.
Show Answer
Correct Answer: B
Explanation: AWS CloudTrail data events record object-level Amazon S3 API activity (such as GetObject, PutObject, DeleteObject) for S3 buckets. S3 server access logging records HTTP access requests but is not the AWS API audit mechanism for all S3 API activity. S3 bucket metrics and IAM Access Analyzer do not record API activity logs.
$19
Get all 194 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.