A company wants to automate the processing of photos that upload to an Amazon S3 bucket.
A CloudOps engineer must invoke a 2-minute processing workflow immediately when a new photo uploads. The CloudOps engineer must initiate the workflow by using a native S3 notification destination.
Which solution will meet these requirements with the LEAST operational overhead?
A. Send an Amazon S3 event notification to an Amazon SQS queue to invoke an AWS Lambda function for processing.
B. Configure an Amazon S3 event notification to invoke an AWS Lambda function upon each object upload.
C. Configure an Amazon S3 event notification to publish events to an Amazon EventBridge bus that routes events to an AWS Lambda function.
D. Configure an Amazon S3 event notification to notify an AWS Step Functions state machine to start the transformation process.
Show Answer
Correct Answer: B
Explanation: Amazon S3 can invoke a Lambda function directly through an object-created event notification. Lambda supports execution times up to 15 minutes, so it can handle the 2-minute workflow without an intermediary service, minimizing operational overhead.
Question 13
A company has a new security policy that requires all Amazon EBS volumes to be encrypted at rest. The company needs to use a custom key policy to manage access to the encryption keys. The company must rotate the keys once each year.
Which solution will meet these requirements with the LEAST operational overhead?
D. Create AWS KMS symmetric customer managed keys by using imported key material. Rotate the keys on a yearly basis.
Show Answer
Correct Answer: A
Explanation: Amazon EBS encryption uses AWS KMS symmetric keys, not asymmetric keys. The requirement for a custom key policy means the company must use customer managed KMS keys rather than AWS owned keys. Automatic rotation is supported for symmetric customer managed keys and rotates annually with minimal operational effort. Imported key material does not support automatic rotation and would require manual management.
Question 13
A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company's risk team must receive immediate notification about any delete events.
Which solution will meet these requirements?
A. Enable S3 server access logging for audit logs. Set up an Amazon SNS notification for the S3 bucket. Select DeleteObject for the event type for the alert system.
B. Enable S3 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObject event.
C. Use Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon SNS notification for the alert system.
D. Use Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.
Show Answer
Correct Answer: A
Explanation: Enable S3 server access logging to record bucket requests, and configure an S3 event notification for delete events to publish to Amazon SNS. The risk team can then receive notifications when an object is deleted; the daily polling options are not immediate.
Question 14
To comply with regulations, a CloudOps engineer needs to back up an Amazon EC2 Amazon Machine Image (AMI) to an Amazon S3 bucket. If the CloudOps engineer restores the AMI from the bucket in the future, the AMI must use the same AMI image ID as the original AMI.
Which solution will meet this requirement?
A. Create a copy of the AMI. Specify the destination S3 bucket. Set the launch permissions to implicit.
B. Archive the snapshot that is associated with the AMI. Specify the S3 bucket as the archive destination.
C. Create a store image task. Specify the image ID and the destination S3 bucket.
D. Use the AWS CLI copy-image command. Specify the image ID and the destination S3 bucket.
Show Answer
Correct Answer: C
Explanation: The only AWS feature that backs up an AMI directly to an Amazon S3 bucket is the CreateStoreImageTask API. However, AWS does not preserve the original AMI ID when the image is restored; a restored AMI receives a new AMI ID. Therefore, while option C is the correct mechanism for storing an AMI in S3, the stated requirement of restoring with the same AMI ID cannot be met by AWS.
Sources:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-store-restore.html
https://repost.aws/questions/QUam7wlMUpSFiD5qgD24WcVQ/i-want-to-move-ami
Question 14
A company uses an AWS Cloud Formation template to provision an Amazon EC2 instance and an Amazon RDS DB instance. A CloudOps engineer must update the template to ensure that the DB instance is created before the EC2 instance is launched.
What should the CloudOps engineer do to meet this requirement?
A. Add a wait condition to the template. Update the EC2 instance user data script to send a signal after the EC2 instance is started.
B. Add the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource.
C. Change the order of the resources in the template so that the RDS resource is listed before the EC2 instance resource.
D. Create multiple templates. Use AWS CloudFormation StackSets to wait for one stack to complete before the second stack is created.
Show Answer
Correct Answer: B
Explanation: CloudFormation can create independent resources in parallel. Adding `DependsOn` to the EC2 instance and specifying the RDS resource’s logical ID ensures the DB instance is created before CloudFormation creates the EC2 instance.
Question 15
A CloudOps engineer manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member accounts. The CloudOps engineer must prevent all teams, including their administrators, from using Amazon DynamoDB. The solution must not affect the ability of the teams to access other AWS services.
Which solution will meet these requirements?
A. In all member accounts, configure IAM policies that deny access to all DynamoDB resources for all users, including the root user.
B. Create a service control policy (SCP) in the management account to deny all DynamoDB actions. Apply the SCP to the root of the organization.
C. In all member accounts, configure IAM policies that deny AmazonDynamoDBFullAccess to all users, including the root user.
D. Remove the default service control policy (SCP) in the management account. Create a replacement SCP that includes a single statement that denies all DynamoDB actions.
Show Answer
Correct Answer: B
Explanation: Service control policies (SCPs) set the maximum available permissions for member accounts in AWS Organizations. An SCP that explicitly denies all DynamoDB actions, attached at the organization root, applies to all member accounts and cannot be bypassed by IAM users, roles, or the member account root user. IAM policies cannot restrict the root user, and removing the default SCP is unnecessary and would not by itself implement the required restriction.
Question 15
A company stores critical files in an Amazon S3 bucket in the us-east-1 AWS Region. To comply with disaster recovery requirements, all new objects in the bucket must automatically replicate to a bucket in the us-west-2 Region.
Which solution will meet this requirement with the LEAST operational overhead?
A. Enable Cross-Region Replication (CRR) on the source bucket. Specify the destination bucket in the us-west-2 Region. Enable versioning on the source bucket.
B. Enable Cross-Origin Resource Sharing (CORS) on both the us-east-1 bucket and the us-west-2 bucket.
C. Create an AWS Lambda function that copies the object to the destination bucket. Configure an Amazon EventBridge rule to run the Lambda function for each object that is created.
D. Enable S3 Lifecycle policies to transition objects to a different storage class in the us-west-2 Region.
Show Answer
Correct Answer: A
Explanation: S3 Cross-Region Replication automatically copies new objects to a bucket in another Region and has the least operational overhead. Note that CRR requires versioning to be enabled on both the source and destination buckets; the option mentions only the source.
Question 16
A CloudOps engineer configured AWS Backup to capture snapshots from a single Amazon EC2 instance that has one Amazon EBS volume attached. On the first snapshot, the EBS volume has 10 GiB of data. On the second snapshot, the EBS volume still contains 10 GiB of data, but 4 GiB have changed. On the third snapshot, 2 GiB of data have been added to the volume, for a total of 12 GiB.
How much total storage is required to store these snapshots?
A. 12 GIB
B. 16 GiB
C. 26 GiB
D. 32 GIB
Show Answer
Correct Answer: B
Explanation: Amazon EBS snapshots are incremental after the first snapshot. The first snapshot stores 10 GiB. The second snapshot stores only the 4 GiB of changed blocks. The third snapshot stores only the 2 GiB of newly added blocks. Total snapshot storage is 10 + 4 + 2 = 16 GiB.
Question 16
A company has an Amazon EC2 instance that has high CPU utilization. The EC2 instance is a t3.large instance and is running a test web application. The company discovers that the web application would operate better on a compute optimized large instance.
What should a CloudOps engineer do to make this change?
A. Migrate the EC2 instance to a compute optimized instance by using AWS VM Import/Export.
B. Enable hibernation on the EC2 instance. Change the instance type to a compute optimized instance. Disable hibernation on the EC2 instance.
C. Stop the EC2 instance. Change the instance type to a compute optimized instance. Start the EC2 instance.
D. Change the instance type to a compute optimized instance while the EC2 instance is running.
Show Answer
Correct Answer: C
Explanation: Stop the EC2 instance, change its instance type to a compute-optimized large instance, and then start it again. An instance type change generally requires the instance to be stopped; hibernation and VM Import/Export are not needed.
Question 17
A CloudOps engineer is troubleshooting a VPC with public and private subnets that leverage custom network ACLs. Instances in the private subnet are unable to access the internet. There is an internet gateway attached to the public subnet. The private subnet has a route to a NAT gateway that is also attached to the public subnet. The Amazon EC2 instances are associated with the default security group for the VPC.
What is causing the issue in this scenario?
A. There Is a network ACL on the private subnet set to deny all outbound traffic.
B. There is no NAT gateway deployed in the private subnet of the VPC.
C. The default security group for the VPC blocks all inbound traffic to the EC2 instances.
D. The default security group for the VPC blocks all outbound traffic from the EC2 instances.
Show Answer
Correct Answer: A
Explanation: The VPC design described is otherwise correct: private subnet routes to a NAT gateway in a public subnet, and the public subnet has an internet gateway. A NAT gateway is supposed to reside in a public subnet, so option B is incorrect. The default VPC security group allows all outbound traffic and allows inbound traffic only from resources in the same security group, so options C and D are incorrect. Because the subnets use custom network ACLs, a restrictive outbound ACL (or missing required allow rules, including ephemeral return traffic) can prevent internet access. Among the choices, the network ACL denying outbound traffic is the matching root cause.
$19
Get all 194 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.