A CloudOps engineer needs to give an existing AWS Lambda function access to an existing Amazon S3 bucket. Traffic between the Lambda function and the S3 bucket must not use public IP addresses. The Lambda function has been configured to run in a VPC.
Which solution will meet these requirements?
A. Configure VPC sharing between the Lambda VPC and the S3 bucket.
B. Attach a transit gateway to the Lambda VPC to allow the Lambda function to connect to the S3 bucket.
C. Create a NAT gateway. Associate the NAT gateway with the subnet where the Lambda function is configured to run.
D. Create an S3 interface endpoint. Change the Lambda function to use the new S3 DNS name.
Show Answer
Correct Answer: D
Explanation: An S3 interface VPC endpoint provides private connectivity to S3 through private IP addresses, so Lambda traffic does not need to traverse public IP addresses. The function can use the endpoint’s DNS name. VPC sharing and a transit gateway do not provide this connection, while a NAT gateway would route requests to S3’s public endpoint.
Question 8
A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB).
A CloudOps engineer must implement deployments without any service interruptions. The company needs the ability to shift traffic between application versions and quickly revert to the previous version by redirecting traffic if issues occur.
Which deployment approach will meet these requirements?
A. Use AWS CodeDeploy blue/green deployment with two ALB target groups. Deploy the new version to a separate fleet. Shift traffic gradually to the new target group. Maintain the original fleet for immediate rollback if necessary.
B. Implement an in-place rolling update by using Auto Scaling instance refresh on the existing target group. Configure connection draining for each instance. Update the launch template. Rely on health checks during the replacement process.
C. Create a new AMI by using the updated application. Modify the Auto Scaling launch template. Temporarily increase desired capacity to add new instances. Then terminate old instances while using ALB connection draining to manage the transition.
D. Design an AWS Step Functions workflow that creates a parallel Auto Scaling group and updates monitoring configurations. Configure the workflow to change instance registrations on the ALB and automatically terminate the previous fleet after a verification period.
Show Answer
Correct Answer: A
Explanation: Blue/green deployments with AWS CodeDeploy and two ALB target groups are designed for zero-downtime deployments, controlled traffic shifting (including gradual/canary), and rapid rollback by redirecting traffic back to the original target group and fleet. The other options perform rolling or manual replacements that do not provide the same built-in traffic shifting and immediate rollback capabilities.
Question 8
A company is expanding globally and needs to back up data on Amazon EBS volumes to a different AWS Region. Most of the EBS volumes that store the data are encrypted, but some of the EBS volumes are unencrypted. The company needs the backup data from all the EBS volumes to be encrypted.
Which solution will meet these requirements with the LEAST management overhead?
A. Configure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS KMS.
B. Create a point-in-time snapshot of the EBS volumes. When the snapshot status is COMPLETED, copy the snapshots to another Region and set the Encrypted parameter to False.
C. Create a point-in-time snapshot of the EBS volumes. Copy the snapshots to an Amazon S3 bucket that uses server-side encryption. Turn on S3 CrossRegion Replication on the S3 bucket.
D. Schedule an AWS Lambda function with the Python runtime. Configure the Lambda function to create the EBS volume snapshots, encrypt the unencrypted snapshots, and copy the snapshots to another Region.
Show Answer
Correct Answer: A
Explanation: Amazon Data Lifecycle Manager can automate EBS snapshot creation and cross-Region copying. The copy can be encrypted with an AWS KMS key, including copies made from unencrypted source volumes, so backups of all the volumes are encrypted with minimal ongoing management.
Question 9
A company needs to deploy a MySQL database on AWS to support an application. The database must be highly available and recoverable. The database must meet a recovery time objective (RTO) of 15 minutes. The database must meet a recovery point objective (RPO) of 5 minutes.
Which solution will meet these requirements in the MOST operationally effective manner?
A. Deploy a MySQL database in a single Availability Zone by using Amazon RDS. Enable automated backups.
B. Deploy a MySQL database across two Availability Zones by using Amazon RDS with a Multi-AZ deployment. Enable point-in-time restore.
C. Deploy a MySQL database across two Availability Zones by using Amazon EC2 instances. Configure database replication and Amazon EBS volume snapshots.
D. Deploy a MySQL database across two Availability Zones by using Amazon RDS. Enable automated backups and database replication.
Show Answer
Correct Answer: B
Explanation: Amazon RDS Multi-AZ for MySQL provides synchronous replication to a standby in another Availability Zone and automatic failover, typically meeting a low RTO. Enabling point-in-time restore through automated backups supports recovery objectives. This is the most operationally effective managed solution compared with self-managed EC2 replication or single-AZ deployment.
Question 9
A company has an application that runs on Amazon EC2 instances. The application stores data on an Amazon RDS for MySQL Single-AZ DB instance. Requests to the DB instance from the application include reads and writes.
A CloudOps engineer must implement a solution that provides failover for the DB instance. The solution must minimize application downtime.
Which solution will meet these requirements?
A. Modify the DB instance to be a Multi-AZ DB instance deployment.
B. Add a read replica in the same Availability Zone where the DB instance is deployed.
C. Add the DB instance to an Auto Scaling group that has a minimum capacity of 2 and a desired capacity of 2.
D. Use RDS Proxy to configure a proxy in front of the DB instance.
Show Answer
Correct Answer: A
Explanation: Convert the DB instance to a Multi-AZ deployment. RDS maintains a standby in another Availability Zone and automatically fails over to it if the primary becomes unavailable, minimizing downtime while supporting both reads and writes.
Question 10
A CloudOps engineer maintains the security and compliance of a company's AWS account. To ensure the company's Amazon EC2 instances are following company policy, a CloudOps engineer wants to terminate any EC2 instances that do not contain a department tag. Noncompliant resources must be terminated in near real time.
Which solution will meet these requirements?
A. Create an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS-TerminateEC2Instance automation runbook to terminate noncompliant resources.
B. Create a new Amazon EventBridge rule to monitor when new EC2 instances are created. Send the event to an Amazon SNS topic for automatic remediation.
C. Ensure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.
D. Ensure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2Instances automation runbook to stop noncompliant resources.
Show Answer
Correct Answer: A
Explanation: AWS Config's managed required-tags rule can evaluate EC2 instances for the presence of required tags such as a department tag. By configuring automatic remediation with the AWS Systems Manager Automation runbook AWS-TerminateEC2Instance, noncompliant instances can be terminated automatically shortly after they are detected, satisfying the near real-time requirement. The other options either do not enforce compliance automatically, only notify, rely on user behavior, or stop rather than terminate instances.
Question 10
A CloudOps engineer must load test a new Amazon CloudFront distribution to assess data transfer and latency performance.
Which solution will meet this requirement?
A. Send client requests from a single geographic region. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
B. Send client requests from a single geographic region. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.
C. Send client requests from multiple geographic regions. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
D. Send client requests from multiple geographic regions. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.
Show Answer
Correct Answer: D
Explanation: Use load generators in multiple geographic regions to measure CloudFront performance across different edge locations. Have each client resolve DNS independently and distribute requests across the returned IP addresses; reusing one DNS result and IP would concentrate the test and give a less representative assessment.
Question 11
A CloudOps engineer has used AWS CloudFormation to deploy a serverless application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The CloudOps engineer must delete the AWS CloudFormation stack without deleting the DynamoDB table.
Which action should the CloudOps engineer take before deleting the AWS CloudFormation stack?
A. Add a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
B. Add a Snapshot deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
C. Enable termination protection on the AWS CloudFormation stack.
D. Update the application's IAM policy with a Deny statement for the dynamodb:DeleteTable action.
Show Answer
Correct Answer: A
Explanation: CloudFormation deletes managed resources when a stack is deleted unless a DeletionPolicy is specified. Setting DeletionPolicy to Retain on the DynamoDB table preserves the table while allowing the rest of the stack to be deleted. Snapshot is not the appropriate policy for DynamoDB in this context, termination protection prevents stack deletion, and an IAM deny on DeleteTable would interfere rather than instruct CloudFormation to retain the resource.
Question 11
A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account.
A CloudOps engineer needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account.
What must the CloudOps engineer do to meet this requirement?
A. Create a new AWS KMS key in the shared account. Configure the key policy to give read access to the development account's root principal.
B. Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
C. Request a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
D. Create a new AWS KMS key in the development account. Configure the key policy to give read access to the shared account's root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.
Show Answer
Correct Answer: C
Explanation: Request the ACM certificate in the development account, where the application is deployed. ACM certificates are account- and Region-specific, while the DNS-validated certificate’s validation record can be created in the shared account’s Route 53 hosted zone.
Question 12
A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the account.
Which solution will meet this requirement with the MOST operational efficiency?
A. Create an Amazon CloudWatch alarm that detects AWS Management Console root user sign-in events. Configure the alarm to send email notifications directly through AWS Trusted Advisor.
B. Launch an Amazon EC2 instance. Schedule a script to run every hour to analyze AWS CloudTrail events. Configure the script to send email notifications to an Amazon SNS topic when AWS Management Console root user sign-in events occur.
C. Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in events. Configure the rule to send email notifications to an Amazon SQS queue.
D. Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in events. Configure the rule to send email notifications to an Amazon SNS topic.
Show Answer
Correct Answer: D
Explanation: Amazon EventBridge can directly match AWS Management Console root user sign-in events from CloudTrail and invoke an Amazon SNS topic for email notifications. This is a fully managed, event-driven solution with minimal operational overhead. CloudWatch alarms do not directly detect these sign-in events for email via Trusted Advisor, an EC2 polling script is operationally inefficient, and SQS does not send email notifications.
$19
Get all 194 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.