A CloudOps engineer is working on cost savings for a company. The CloudOps engineer notices multiple unused Elastic IP addresses. The addresses are spread across different accounts and AWS Regions in an organization in AWS Organizations.
The CloudOps engineer must administer and track the addresses based on security domains. The CloudOps engineer must be able to view the history of assigned addresses.
Which solution will meet these requirements?
A. Enable AWS Config with an IP address tracking rule.
B. Use Amazon CloudWatch with custom IP metrics to view addresses by account and Region.
C. Enable Amazon VPC IP Address Manager for Organizations integrations.
D. In AWS Systems Manager Inventory, enable a resource data sync to Amazon S3 for IP tracking.
Show Answer
Correct Answer: C
Explanation: Amazon VPC IP Address Manager (IPAM) with AWS Organizations integration provides centralized management of IP addresses, including public IPv4 addresses such as Elastic IPs, across multiple AWS accounts and Regions. IPAM supports organizing addresses by business or security domains using scopes and pools, identifies unused Elastic IP addresses, and maintains historical IP address assignment information. The other options do not provide centralized cross-account IP address administration with history tracking.
Question 32
A development team wants to match events on Amazon EventBridge where the state of an Amazon EC2 machine is not "terminated".
An example event is as follows:
Which event pattern should the development team use to find relevant events?
A. {"detail": {"state": ["not equals-ignore-case": "terminated"]}}
B. {"detail": {"state": ["! equals-ignore-case": "terminated"]}}
C. {"detail": {"state": ["equals-ignore-case": "terminated"]}}
D. {"detail": {"state": [{"anything-but": {"equals-ignore-case": "terminated"}}]}}
Show Answer
Correct Answer: D
Explanation: Amazon EventBridge event patterns support the anything-but operator for negation. To perform a case-insensitive negated match, equals-ignore-case is nested inside anything-but. This matches any EC2 state except 'terminated', regardless of letter case.
Question 33
A company is managing a website with a global user base hosted on Amazon EC2 with an Application Load Balancer (ALB). To reduce the load on the web servers, a CloudOps engineer configures an Amazon CloudFront distribution with the ALB as the origin. After a week of monitoring the solution, the CloudOps engineer notices that requests are still being served by the ALB and there is no change in the web server load.
What are possible causes for this problem? (Choose two.)
A. CloudFront does not have the ALB configured as the origin access identity.
B. The DNS is still pointing to the ALB instead of the CloudFront distribution.
C. The ALB security group is not permitting inbound traffic from CloudFront.
D. The default, minimum, and maximum Time to Live (TTL) are set to 0 seconds on the CloudFront distribution.
E. The target groups associated with the ALB are configured for sticky sessions.
Show Answer
Correct Answer: B, D
Explanation: If DNS still points directly to the ALB, client requests bypass CloudFront entirely, so the ALB continues serving all traffic. If the CloudFront cache behavior has default, minimum, and maximum TTLs set to 0 seconds, CloudFront forwards every request to the origin without caching, so origin load does not decrease. Origin Access Identity applies to Amazon S3 origins, not ALBs. ALB security groups blocking CloudFront would cause failures rather than unchanged origin load, and sticky sessions do not prevent CloudFront from caching cacheable content.
Question 34
A company uses a large number of Linux based Amazon EC2 instances to run business operations such as ordering, fulfillment, and billing. The company uses AWS Systems Manager to manage the EC2 instances. The company wants to ensure that the Systems Manager Agent (SSM Agent) is always up to date with the latest version.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Enable the Auto update SSM Agent setting in Systems Manager Fleet Manager.
B. Subscribe to SSM Agent notifications on Github. Configure the subscription events to invoke an Amazon SNS topic. Configure the SNS topic to run a custom AWS Lambda function to update the SSM Agent by using the Systems Manager Run Command API.
C. Enable the Auto update SSM Agent setting in Systems Manager Patch Manager.
D. Subscribe to SSM Agent notifications on Github. Configure the subscription events to invoke an Amazon SNS topic. Configure the topic to run a custom AWS Lambda function to update the SSM Agent by using a Systems Manager Automation document.
Show Answer
Correct Answer: A
Explanation: Fleet Manager provides a built-in automatic SSM Agent update capability that creates and manages the necessary State Manager association to keep the SSM Agent current with minimal operational effort. The GitHub/SNS/Lambda options add unnecessary custom infrastructure, and Patch Manager is for OS/application patching rather than the native SSM Agent auto-update feature.
Question 35
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company needs an AWS Lambda function to perform a custom recovery procedure on the application server when the application returns an HTTP 500 status code.
A CloudOps engineer needs to design a solution that detects HTTP 500 status codes and runs the Lambda function reliably when errors are detected.
Which solution will meet these requirements?
A. Configure an Amazon CloudWatch alarm on the HTTPCode_Target_5XX_Count ALB target group metric. Set the alarm action to run the Lambda function.
B. Deploy a new Lambda function that continuously scans the ALB access logs in Amazon S3 to detect HTTP 500 status codes and then invokes the existing lambda function.
C. Enable AWS CloudTrail on the application instances. Configure Amazon CloudWatch Logs metric filters to detect HTTP 500 status codes and run the Lambda function.
D. Create an Amazon EventBridge rule for all ALB request events that invokes the Lambda function. Configure the Lambda function to filter for HTTP 500 status codes internally.
Show Answer
Correct Answer: A
Explanation: The ALB publishes the HTTPCode_Target_5XX_Count metric to Amazon CloudWatch. A CloudWatch alarm can monitor this metric and use a Lambda function as the alarm action, providing a managed and reliable way to trigger custom recovery when target-generated HTTP 500 errors occur. The other options rely on log scanning, CloudTrail (which does not capture HTTP response codes), or EventBridge events that do not exist for individual ALB requests.
Question 36
A retail company runs a web application. The application uses an Application Load Balancer (ALB) to distribute traffic across multiple Amazon EC2 instances in two Availability Zones. The application experiences high traffic during flash sales. The company needs to ensure even distribution of requests across all healthy instances. Additionally, the company requires session persistence for shopping cart functionality.
Which configuration will meet these requirements with the LEAST administrative effort?
A. Configure the ALB target group to use the round robin algorithm. Enable stickiness and cross-zone load balancing.
B. Switch the ALB to a Network Load Balancer. Modify the target group to use the least outstanding requests algorithm. Enable stickiness. Disable cross-zone load balancing.
C. Configure the ALB target group to use the weighted round robin algorithm. Implement session persistence by using AWS Lambda functions to store session data in Amazon DynamoDB.
D. Configure the ALB listener with path-based routing to direct shopping cart requests to a dedicated target group with sticky sessions. Use the round robin algorithm without stickiness for a second target group.
Show Answer
Correct Answer: A
Explanation: An Application Load Balancer supports round robin request distribution, target group stickiness for session persistence, and cross-zone load balancing to distribute requests evenly across healthy targets in all enabled Availability Zones. This satisfies the requirements with native ALB features and the least administrative effort. The other options either use an inappropriate load balancer, add unnecessary custom components, or do not ensure stickiness across all application traffic.
Question 37
A company hosts an ecommerce website on a fleet of Nitro-based Amazon EC2 Linux instances. During a recent sales event, some customers reported HTTP timeout errors.
To help identify the root cause of the errors, a CloudOps engineer needs more detailed network metrics from the Elastic Network Adapter (ENA) driver. The CloudOps engineer must obtain the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
Which solution will provide these metrics with the MOST operational efficiency?
A. Install the Amazon CloudWatch agent on the instances. Filter by the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
B. Install the collectd daemon and the Amazon CloudWatch agent on the EC2 instances. Filter by the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
C. Enable VPC Flow Logs. Filter by the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
D. Enable Performance Insights for the instances. Use Amazon CloudWatch to view the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
Show Answer
Correct Answer: A
Explanation: The Amazon CloudWatch agent can collect ENA ethtool metrics from Nitro-based EC2 instances, including conntrack_allowance_available and conntrack_allowance_exceeded, and publish them to CloudWatch. This is the most operationally efficient approach because it requires only the CloudWatch agent. collectd is unnecessary for these ENA metrics, VPC Flow Logs do not expose ENA driver conntrack allowance metrics, and Performance Insights is an RDS feature, not applicable to EC2 instances.
Question 38
A CloudOps engineer has an Amazon S3 bucket and a new AWS Lambda function. The CloudOps engineer tries to configure a new event notification from the S3 bucket to the Lambda function by using the Lambda console. The configuration fails and returns the following error: "Unable to validate the following destination configurations."
The engineer confirms that the new Lambda function and the function's IAM role are correctly configured.
What is the cause of this error?
A. The maximum number of S3 event notification destinations has been exceeded for the S3 bucket.
B. The S3 bucket owner needs to grant the Lambda function explicit cross-account permissions by using a resource policy.
C. The new Lambda function's resource-based policy is missing the lambda:InvokeFunction permission for Amazon S3.
D. The S3 bucket has an existing stale event notification that points to a deleted or permission-deficient resource.
Show Answer
Correct Answer: D
Explanation: Amazon S3 validates all configured event notification destinations when a notification configuration is created or updated. If the bucket contains an existing stale notification that references a deleted resource or a destination with invalid permissions, validation fails with 'Unable to validate the following destination configurations,' even if the new Lambda function and its execution role are correctly configured. While Lambda does require a resource-based policy allowing S3 to invoke it, the scenario states the new function is correctly configured, making a stale existing notification the most likely cause.
Sources:
https://www.secexams.com/exams/Amazon/aws-certified-cloudops-engineer-associate-soa-c03/view/18
Question 39
A CloudOps engineer needs to configure a caching layer for a read-heavy application that uses an Amazon RDS for PostgreSQL database. The application exists across three AWS Regions. Read and write activities occur in the primary Region. In the two secondary Regions, read-only activity occurs on RDS for PostgreSQL cross-Region read replicas.
The cache in each Region must consist of the same data to provide a consistent user experience across Regions.
Which solution for the caching layer will meet these requirements?
A. Set up an Amazon ElastiCache (Redis OSS) global datastore. Include a read and write cluster in the primary Region. Include a read-only cluster in each secondary Region.
B. Set up an Amazon ElastiCache (Memcached) global database. Include a read and write cluster in the primary Region. Include a read-only cluster in each secondary Region.
C. Set up query caching on the RDS for PostgreSQL database in the primary Region. Configure query cache replication to the secondary RDS cross-Region replicas.
D. Set up an Amazon ElastiCache (Memcached) cluster with cluster mode enabled in all three Regions. Set up ElastiCache cross-Region replication from the primary Region to the secondary Regions.
Show Answer
Correct Answer: A
Explanation: Amazon ElastiCache for Redis OSS Global Datastore is designed to replicate cache data across Regions. It supports a single writable primary cluster and read-only secondary clusters in other Regions, providing a consistent cache close to users. Memcached does not support global datastore or cross-Region replication, and PostgreSQL does not provide the described query cache replication feature.
Question 40
A CloudOps engineer is unable to launch Amazon EC2 instances into a VPC because there are no available private IPv4 addresses in the VPC.
Which combination of actions must the CloudOps engineer take to launch the instances? (Choose two.)
A. Associate a secondary IPv4 CIDR block with the VPC.
B. Associate a primary IPv6 CIDR block with the VPC.
C. Create a new subnet for the VP
D. Modify the CIDR block of the VPC.
E. Modify the CIDR block of the subnet that is associated with the instances.
Show Answer
Correct Answer: A, C
Explanation: If a VPC has exhausted available private IPv4 addresses, you can expand its address space by associating a secondary IPv4 CIDR block. You cannot modify an existing VPC CIDR block or resize an existing subnet CIDR block. After adding the secondary CIDR, you must create a new subnet from that new address range to launch instances into it. Adding IPv6 does not solve the lack of private IPv4 addresses.
$19
Get all 130 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.