A company uses default settings to create an AWS Lambda function. The function needs to access an Amazon RDS database that is in a private subnet of a VPC. The function has the correct IAM permissions to access the database. The private subnet has appropriate routing configurations and is accessible from within the VPC. However, the Lambda function is unable to connect to the RDS instance.
What is the likely reason the Lambda function cannot connect to the RDS instance?
A. The company did not set the RDS instance as the destination for the Lambda function in the function configuration.
B. The Lambda function configuration did not deploy the function in the same VPC that contains the RDS instance.
C. The VPC where the Lambda function is deployed is not peered with the VPC where the RDS instance is deployed.
D. The security group for the Lambda function does not allow outbound access to the RDS instance.
Show Answer
Correct Answer: B
Explanation: By default, AWS Lambda functions are not attached to a customer's VPC. An Amazon RDS instance in a private subnet is reachable only through network connectivity within that VPC (or connected networks). IAM permissions alone do not provide network access. The Lambda function must be configured to run in the appropriate VPC and subnets with suitable security groups. Option A is not an AWS configuration concept, C is unnecessary if both resources are intended to be in the same VPC, and D is unlikely with default security groups because outbound is typically allowed by default.
Question 42
A company has an Amazon S3 bucket that has server-side encryption with AWS KMS keys (SSE-KMS) enabled. Several applications read from the S3 bucket for daily reporting. The company clears the data in the S3 bucket weekly when the company moves the data into a data warehouse.
As more applications read from the S3 bucket, the cost of KMS-related transactions is increasing. A CloudOps engineer needs to reduce the KMS costs without removing S3 encryption and without losing access to existing objects.
Which solution will meet these requirements with the LEAST operational overhead?
A. Enable S3 Bucket Keys on the S3 bucket. Specify the existing KMS key.
B. Change the encryption type on the S3 bucket to server-side encryption with customer-provided keys (SSE-C).
C. Use Amazon CloudFront to cache the objects in the S3 bucket and to serve the objects to the applications.
D. Configure the applications to connect to the S3 bucket through an S3 access point.
Show Answer
Correct Answer: A
Explanation: Amazon S3 Bucket Keys reduce AWS KMS request traffic for SSE-KMS objects by using a bucket-level key cached by S3, significantly lowering KMS costs while retaining SSE-KMS encryption. Existing objects remain accessible, and enabling Bucket Keys requires minimal operational effort. SSE-C changes the encryption model and key management, CloudFront does not address KMS request costs for S3 encryption in this scenario, and S3 Access Points only simplify access management.
Question 43
A company plans to deploy a database on an Amazon Aurora MySQL DB cluster. The database will store data for a demonstration environment. The data must be reset on a daily basis.
What is the MOST operationally efficient solution that meets these requirements?
A. Create a manual snapshot of the DB cluster after the data has been populated. Create an Amazon EventBridge rule to invoke an AWS Lambda function on a daily basis. Configure the function to restore the snapshot and then delete the previous DB cluster.
B. Enable the Backtrack feature during the creation of the DB cluster. Specify a target backtrack window of 48 hours. Create an Amazon EventBridge rule to invoke an AWS Lambda function on a daily basis. Configure the function to perform a backtrack operation.
C. Export a manual snapshot of the DB cluster to an Amazon S3 bucket after the data has been populated. Create an Amazon EventBridge rule to invoke an AWS Lambda function on a daily basis. Configure the function to restore the snapshot from Amazon S3.
D. Set the DB cluster backup retention period to 2 days. Create an Amazon EventBridge rule to invoke an AWS Lambda function on a daily basis. Configure the function to restore the DB cluster to a point in time and then delete the previous DB cluster.
Show Answer
Correct Answer: B
Explanation: Amazon Aurora Backtrack is designed to quickly rewind an Aurora MySQL cluster to an earlier point in time without restoring from snapshots. For a demo environment that must be reset daily, enabling Backtrack and scheduling a daily backtrack operation is the most operationally efficient approach. Restoring snapshots or performing point-in-time restores creates new clusters and requires more operational overhead. Exporting snapshots to S3 cannot be restored directly into Aurora.
Question 44
A CloudOps engineer must troubleshoot performance issues for a web application that is delivered through Amazon CloudFront. The metrics show a consistently low cache hit ratio that leads to many requests being forwarded to the origin.
Which configuration will increase the cache hit ratio?
A. Modify the origin's Cache-Control header to max-age=0.
B. Reduce the TTL for cached objects.
C. Reduce the number of request headers, query strings, and cookies included in the cache key.
D. Configure signed URLs or signed cookies to restrict access to content.
Show Answer
Correct Answer: C
Explanation: A low CloudFront cache hit ratio is commonly caused by an overly specific cache key. Including unnecessary request headers, query strings, or cookies creates many unique cache entries and reduces cache reuse. Reducing these cache key components increases the likelihood that requests match cached objects. Option A (max-age=0) effectively disables caching, B reduces cache lifetime and generally lowers hit ratio, and D controls access rather than improving cache efficiency.
Question 45
A company uses an organization in AWS Organizations to manage a multi-account AWS environment. The company creates a new Amazon EBS backed Amazon Machine Image (AMI). The company shares the AMI across the organization. Employees must use the AMI to launch all new Linux-based Amazon EC2 instances across the entire organization.
In one of the company's application accounts, an employee uses the new AMI to launch a new workload. The EC2 instance launches, but it is terminated immediately.
What the MOST likely reason that the instance did not fully boot?
A. The user who launched the instance does not have ec2:RunInstances permissions within the application account.
B. The company encrypted the AMI by using an AWS KMS key that the user who launched the EC2 instance does not have access to.
C. There is a service control policy (SCP) that denies the user who launched the EC2 instance access to launch instances in the application account.
D. The user launched the EC2 instance into a subnet that does not have access to the internet.
Show Answer
Correct Answer: B
Explanation: An EC2 instance that launches and then immediately transitions to the terminated state commonly indicates a launch-time failure rather than a networking issue. If the AMI is EBS-backed and encrypted with a customer-managed AWS KMS key, the launching principal and EC2 service must be able to use that KMS key to create and decrypt the EBS volumes. Without the necessary KMS permissions, the root volume cannot be created/decrypted, so the instance cannot boot and is terminated. The other options would typically prevent the launch request entirely (missing RunInstances permission or an SCP deny) or would not cause immediate termination (no internet access).
Question 46
A company has scientists who upload large data objects to an Amazon S3 bucket. The scientists upload the objects as multipart uploads. The multipart uploads often fail because of poor end-client connectivity.
The company wants to optimize storage costs that are associated with the data. A CloudOps engineer must implement a solution that presents metrics for incomplete uploads. The solution also must automatically delete any incomplete uploads after 7 days.
Which solution will meet these requirements?
A. Review the Incomplete Multipart Upload Bytes metric in the S3 Storage Lens dashboard. Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.
B. Implement S3 Intelligent-Tiering to move data into lower-cost storage classes after 7 days. Create an S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.
C. Access the S3 console. Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function to delete any incomplete multipart uploads after 7 days.
D. Use the S3 analytics storage class analysis tool to identify and measure incomplete multipart uploads. Configure an S3 bucket policy to enforce restrictions on multipart uploads to delete incomplete multipart uploads after 7 days.
Show Answer
Correct Answer: A
Explanation: Amazon S3 Storage Lens provides the 'Incomplete Multipart Upload Bytes' metric to identify storage consumed by incomplete multipart uploads. An S3 Lifecycle rule with the AbortIncompleteMultipartUpload action can automatically abort and remove incomplete multipart uploads after a specified number of days, such as 7. The other options reference features that do not provide this capability or incorrectly attribute lifecycle behavior to other services.
Question 47
A CloudOps engineer needs to ensure that AWS resources across multiple AWS accounts are tagged consistently. The company uses an organization in AWS Organizations to centrally manage the accounts. The company wants to implement cost allocation tags to accurately track the costs that are allocated to each business unit.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Organizations tag policies to enforce mandatory tagging on all resources. Enable cost allocation tags in the AWS Billing and Cost Management console.
B. Configure AWS CloudTrail events to invoke an AWS Lambda function to detect untagged resources and to automatically assign tags based on predefined rules.
C. Use AWS Config to evaluate tagging compliance. Use AWS Budgets to apply tags for cost allocation.
D. Use AWS Service Catalog to provision only pre-tagged resources. Use AWS Trusted Advisor to enforce tagging across the organization.
Show Answer
Correct Answer: A
Explanation: AWS Organizations tag policies provide centralized governance for tagging across multiple AWS accounts with minimal operational overhead by standardizing and enforcing tag keys and values. To use tags for cost reporting, the relevant cost allocation tags must also be activated in AWS Billing and Cost Management. The other options require custom automation or misuse services that do not enforce or apply cost allocation tags.
Question 48
A company runs a web-based application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. Users from around the world access the application. Users from outside North America report high latency and inconsistent application performance. The company must improve latency and application performance for all global users.
Which solution will meet this requirement?
A. Use AWS Global Accelerator in front of the ALB.
B. Deploy a Network Load Balancer (NLB) in front of the AL
C. Replace the ALB with a Network Load Balancer (NLB).
D. Configure Amazon Route 53 health checks to failover between AWS Regions based on latency thresholds.
Show Answer
Correct Answer: A
Explanation: AWS Global Accelerator improves performance for global users by routing traffic onto the AWS global network to the optimal regional endpoint (the ALB), reducing latency and improving consistency without requiring a multi-Region deployment. Replacing or adding an NLB does not address global internet path latency, and Route 53 failover is for availability rather than performance.
Question 49
A company has multiple Amazon EC2 instances that run the Ubuntu operating system (OS). The company must patch the OS regularly. A CloudOps engineer installs patches manually every week. The company adds new EC2 instances that run Ubuntu continuously. The CloudOps engineer needs to automate the patching process.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Create an AWS Lambda function to connect to the EC2 instances by using SSH and to install the patches. Configure the Lambda function to run every week.
B. Install the AWS Systems Manager Agent (SSM Agent) on the EC2 instances. Configure Systems Manager Patch Manager to install patches on the instances every week.
C. Use AWS Systems Manager Inventory to identify unpatched EC2 instances and to install OS patches.
D. Create an Amazon EventBridge rule that has a cron expression to install the patches every week. Configure the EventBridge rule to target the EC2 instances. Configure an action to run OS updates on the targeted instances.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Patch Manager is the managed service designed to automate OS patching for EC2 instances, including Ubuntu. By ensuring the SSM Agent is installed and managed instances are registered, Patch Manager can schedule recurring weekly patch installation and automatically applies to newly added managed instances, making it the most operationally efficient solution. Inventory only reports software state, EventBridge cannot directly install OS patches on EC2 instances without additional automation, and a custom Lambda-over-SSH solution is unnecessarily complex and less scalable.
Question 50
A CloudOps engineer wants to configure observability of specific metrics for a public website that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The CloudOps engineer wants to observe latency, traffic, errors, and saturation metrics. The CloudOps engineer wants to define service level objectives (SLOs) and to monitor service level indicators (SLIs). The CloudOps engineer also wants to correlate metrics, logs, and traces to support faster time to issue resolution.
Which solution will meet these requirements with the LEAST operational effort?
A. Use Amazon CloudWatch Application Signals to automatically collect and monitor the specified metrics for the EKS workloads.
B. Configure AWS Distro for OpenTelemetry for the website to generate metrics. Use Amazon Managed Service for Prometheus to collect the specified metrics. Use Amazon Managed Grafana to visualize metrics.
C. Configure Amazon CloudWatch RUM and CloudWatch Synthetics canaries to automatically collect and monitor the specified metrics for the EKS workloads.
D. Configure Amazon CloudWatch Application Insights to detect common application performance problems and anomalies and to monitor the specified metrics for the EKS workloads.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch Application Signals is designed to provide application observability with minimal operational effort. It automatically collects the golden signals (latency, traffic, errors, and saturation), supports SLOs and SLIs, and correlates metrics, logs, and traces for applications running on Amazon EKS. The other options require more manual instrumentation and configuration (OpenTelemetry, Prometheus, Grafana), focus on end-user monitoring and synthetic testing (RUM/Synthetics), or provide application health insights without the built-in SLO/SLI and golden-signal capabilities of Application Signals.
$19
Get all 130 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.