A company asks a CloudOps engineer to provision an additional environment for an application in four additional AWS Regions. The application is running on more than 100 Amazon EC2 instances in the us-east-1 Region, using fully configured Amazon Machine Images (AMIs). The company has an AWS CloudFormation template to deploy resources in us-east-1.
What should the CloudOps engineer do to provision the application in the MOST operationally efficient manner?
A. Copy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs.
B. Create a snapshot of the running instance. Copy the snapshot to the other Regions. Create an AMI from the snapshots. Update the CloudFormation template for each Region to use the new AMI.
C. Run the existing CloudFormation template in each additional Region based on the success of the template that is used currently in us-east-1.
D. Update the CloudFormation template to include the additional Regions in the Auto Scaling group. Update the existing stack in us-east-1.
Show Answer
Correct Answer: A
Explanation: AMIs are Region-specific. The most operationally efficient approach is to copy the existing fully configured AMI to each target Region and use a CloudFormation mapping (or another Region-aware mechanism) so the same template can reference the correct AMI ID in each Region. Creating snapshots and rebuilding AMIs adds unnecessary steps, running the template alone will fail without Region-available AMIs, and Auto Scaling groups cannot span multiple AWS Regions.
Question 22
A company experiences increased production incidents. A CloudOps engineer must provide developers with secure access to Amazon EC2 instances from the AWS Management Console. The developers must be able to successfully connect by using EC2 Instance Connect for real-time troubleshooting.
The EC2 instances are based on the latest Amazon Linux 2023 AMIs. The EC2 instances are publicly accessible. The EC2 instances have been properly configured with security groups that allow inbound SSH traffic. The developers will use the default ec2-user account to access the instances from the console.
Which step should the CloudOps engineer perform NEXT to ensure that the developers can successfully connect by using EC2 Instance Connect?
A. Create an IAM role with EC2 access. Attach the role to the EC2 instances.
B. Download and install the EC2 Instance Connect agent on the production instances.
C. Grant IAM permissions to the developers to use EC2 Instance Connect and describe the EC2 instances.
D. Enable AWS CloudTrail logging. Create a VPC endpoint for EC2 Instance Connect.
Show Answer
Correct Answer: C
Explanation: Amazon Linux 2023 AMIs already include EC2 Instance Connect support, so no additional agent installation is required. The instances are publicly accessible and SSH is allowed by security groups. The remaining requirement is that the developers have the necessary IAM permissions to send the EC2 Instance Connect public key and to describe instances when connecting from the AWS Management Console.
Question 23
A company's developers deploy applications to multiple AWS accounts. The developers are able to create any AWS resource within the AWS accounts.
A security team wants to audit the resources that the developers created in the company's AWS accounts.
Which solution will meet this requirement?
A. Create an AWS account for the security team. Configure AWS Audit Manager in the security team's account. Create an Audit Manager assessment. Include the company's AWS accounts in the assessment scope. Generate an assessment report for the security team.
B. Configure an AWS Config recorder in each AWS account. In the security team's AWS account, create an AWS Config aggregator. Authorize the aggregator in every AWS account. Use Amazon Quick Suite and Amazon Athena to generate a report for the security team.
C. Create a trail in AWS CloudTrail in every AWS account. Create an Amazon RDS DB instance in the security team's account. Configure CloudTrail in every account to write logs to the DB instance. Use Amazon Quick Suite to query the DB instance and generate a report for the security team.
D. Enable AWS Trusted Advisor in every AWS account. Create a scheduled Amazon EventBridge rule to periodically refresh the Trusted Advisor checks. Use the Trusted Advisor console to generate a report for the security team.
Show Answer
Correct Answer: B
Explanation: AWS Config records resource configurations across accounts. A central AWS Config aggregator in the security account collects configuration data from all authorized accounts, providing a centralized inventory for auditing resources created by developers. Athena and Amazon QuickSight can be used to query and report on the aggregated configuration data. Audit Manager focuses on compliance assessments, CloudTrail logs should not be delivered to RDS, and Trusted Advisor is not an inventory/auditing service.
Question 24
A CloudOps engineer needs to quickly resolve issues in an application that runs in a production environment on Amazon EC2 instances. The application uses an Amazon RDS database. To resolve the issues, the CloudOps engineer needs a centralized solution to collect and query logs for both the EC2 instances and the RDS database.
Which solution will meet these requirements?
A. Install and configure the Amazon CloudWatch agent on the EC2 instances to forward ERROR log events to Amazon CloudWatch Logs. Configure the RDS database to export log events to CloudWatch Logs. Use CloudWatch Logs Insights to query the logs.
B. Install and configure the Amazon CloudWatch agent on the EC2 instances to forward INFO log events to an Amazon S3 bucket. Install the CloudWatch agent on the RDS database. Forward ERROR log events to the S3 bucket. Configure S3 Event Notifications to invoke AWS Lambda functions to analyze the logs.
C. Install and configure the Amazon CloudWatch agent on the EC2 instances to forward ERROR log events to Amazon CloudWatch Logs. Use the Logs & events menu to examine log events for the RDS database. Use CloudWatch Logs Insights to query logs only for the EC2 instances.
D. Install and configure the AWS X-Ray agent on the EC2 instances to forward INFO, DEBUG, and latency log events to Amazon CloudWatch Logs. Configure the RDS database to export log events to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the logs.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch Logs provides a centralized log collection and querying solution. Install the CloudWatch agent on EC2 instances to send application/system logs to CloudWatch Logs, configure Amazon RDS to export supported database logs directly to CloudWatch Logs, and use CloudWatch Logs Insights to query across the collected logs. The other options are incorrect because RDS does not support installing the CloudWatch agent (B), do not centralize/query RDS logs with Logs Insights (C), or misuse AWS X-Ray, which is for distributed tracing rather than log forwarding (D).
Question 25
A company is hosting a public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The company needs the website to support HTTPS connections.
Which solution will meet this requirement?
A. Replace the ALB with a Network Load Balancer.
B. Use AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate. Configure the ALB to use the certificate.
C. Import a public SSL/TLS certificate into AWS KMS. Configure the ALB to retrieve the certificate from AWS KMS.
D. Attach a public SSL/TLS certificate to the target group that is associated with the ALB.
Show Answer
Correct Answer: B
Explanation: Application Load Balancers terminate HTTPS using an SSL/TLS certificate attached to an HTTPS listener. AWS Certificate Manager (ACM) is the standard service to provision and manage public certificates for use with ALBs. AWS KMS does not store or serve TLS certificates for ALBs, target groups do not have certificates attached, and replacing the ALB with an NLB is unnecessary to support HTTPS.
Question 26
A company uses AWS Systems Manager to automate tasks across AWS accounts. The company uses monitoring tools to detect issues. The company creates a Systems Manager Automation runbook that runs an AWS Lambda function to remediate the issues.
Initially, the company runs the runbook manually. Now, the company wants to automate running the runbook whenever the monitoring tools detect issues.
Which solution will meet this requirement?
A. Configure the monitoring tools to publish findings to Amazon EventBridge. Create an EventBridge rule that invokes the runbook in response to events from the monitoring tools.
B. Configure the monitoring tools to send findings to an Amazon SNS topic. Subscribe the runbook to the SNS topic. Invoke the runbook when a message is received.
C. Configure the monitoring tools to write findings to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter that invokes the runbook when new log entries are detected.
D. Configure AWS Config to assess the resources and publish configuration changes to Amazon EventBridge. Create a rule to invoke the runbook in response to configuration change events.
Show Answer
Correct Answer: A
Explanation: Amazon EventBridge is the standard event bus for routing operational events from monitoring tools to automated targets. AWS Systems Manager Automation runbooks can be invoked directly by EventBridge rules, enabling automatic remediation when matching events are received. SNS cannot directly subscribe a runbook as described, CloudWatch Logs subscription filters are intended for log consumers rather than Automation runbooks, and AWS Config configuration change events do not generally represent arbitrary monitoring tool detections.
Question 27
A company is attempting to manage its costs in the AWS Cloud. A CloudOps engineer needs specific company-defined tags that are assigned to resources to appear on the billing report.
What should the CloudOps engineer do to meet this requirement?
A. Activate the tags as AWS generated cost allocation tags.
B. Activate the tags as user-defined cost allocation tags.
C. Create a new cost category. Select the account billing dimension.
D. Create a new AWS Cost and Usage Report. Include the resource IDs.
Show Answer
Correct Answer: B
Explanation: Company-defined tags are user-defined cost allocation tags. To have these tags appear in billing and cost management reports, they must first be activated as user-defined cost allocation tags in the AWS Billing and Cost Management console. AWS-generated cost allocation tags are system-created tags, while Cost Categories and Cost and Usage Reports do not replace the requirement to activate user-defined tags for billing visibility.
Question 28
A company uses a custom Amazon Machine Image (AMI) as part of an EC2 Image Builder pipeline. A CloudOps engineer notices that the custom AMI will reach the end of its support lifespan in few months. The CloudOps engineer needs to update the EC2 Image Builder pipeline to use the latest AMI ID.
Which solution will meet this requirement?
A. Create a new version of the existing EC2 Image Builder recipe. Update the AMI ID details. Update the pipeline to use the new recipe version.
B. Disable the AMI in the lifecycle rules for the existing AMI. Update the existing EC2 Image Builder recipe with the latest AMI ID details. Rerun the pipeline.
C. Update the build component to use the latest AMI ID details.
D. Replace the AMI ID in the launch template for the pipeline.
Show Answer
Correct Answer: A
Explanation: EC2 Image Builder image recipe versions are immutable. To change the base AMI, you must create a new version of the image recipe with the updated parent AMI ID, then update the image pipeline to reference that new recipe version. Build components do not define the base AMI, launch templates are not used to select the recipe's parent image, and an existing recipe version cannot be edited.
Question 29
A company has many accounts in an organization in AWS Organizations. The company must automate resource provisioning from the organization's management account to the member accounts.
Which solution will meet this requirement?
A. Create an AWS CloudFormation change set. Deploy the change set to all member accounts.
B. Create an AWS CloudFormation nested stack. Deploy the nested stack to all member accounts.
C. Create an AWS CloudFormation stack set. Deploy the stack set to all member accounts.
D. Create an AWS SAM template. Deploy the template to all member accounts.
Show Answer
Correct Answer: C
Explanation: AWS CloudFormation StackSets are designed to deploy, manage, and update CloudFormation stacks across multiple AWS accounts and Regions from a central administrator account. StackSets integrate with AWS Organizations, enabling deployment to member accounts or organizational units. Change sets are for previewing changes to a single stack, nested stacks modularize templates within one stack, and AWS SAM is for serverless application templates rather than multi-account provisioning.
Question 30
A company has a software as a service (SaaS) application. The company has integrated the application with AWS services by using the AWS SDK and an IAM user's access key ID and secret access key.
The company needs to implement the principle of least privilege for the IAM user. The company must avoid the usage of permanent credentials.
Which solution will meet these requirements?
A. Migrate the application to use the AWS STS AssumeRoleWithSAML API operation.
B. Migrate the application to use the AWS STS AssumeRole API operation. Allow the IAM user to call only AWS STS.
C. Add a policy to the existing IAM user to scope the permissions to only the permissions that the user needs for the application.
D. Add an IAM group to scope the permissions to only the permissions that the user needs for the application. Add the IAM user to the IAM group.
Show Answer
Correct Answer: B
Explanation: Using AWS STS AssumeRole allows the application to exchange limited IAM user credentials for temporary credentials associated with an IAM role. Restricting the IAM user so it can only call STS avoids granting direct service permissions to the long-term credentials, and the role enforces least-privilege access. AssumeRoleWithSAML is for SAML federation, while simply scoping IAM user or group permissions still relies on permanent access keys.
$19
Get all 130 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.