A company runs an application on Amazon EC2 instances. The instances are in three Availability Zones behind an Auto Scaling group and an Application Load Balancer (ALB). The ALB maps to an Amazon Route 53 alias record.
Amazon CloudWatch metrics show healthy instances in all three Availability Zones. However, instances in only two of the Availability Zones receive traffic.
Which solution will resolve this issue?
A. Enable cross-zone load balancing on the ALB.
B. Ensure that all the required subnets are correctly associated with the ALB.
C. Disable cross-zone load balancing on the ALB.
D. Update the ALB's DNS mapping in Route 53 to use a CNAME record instead of an alias.
Show Answer
Correct Answer: B
Explanation: The ALB can route traffic only through the Availability Zones enabled for it. Ensure the ALB is associated with a subnet in each of the three required Availability Zones. Cross-zone load balancing and the Route 53 record type do not enable an omitted Availability Zone.
Question 18
A company runs an application on a fleet of Amazon EC2 Windows instances in a Multi-AZ deployment. The company needs a solution that will give the instances access to shared files.
The solution must be highly available, must use native Windows storage capabilities, and must maximize consistency for all file requests.
Which solution will meet these requirements?
A. Create an Amazon FSx for Windows File Server Multi-AZ file system. Map file shares on the instances by using the file system's DNS name.
B. Grant the instances access to a shared Amazon S3 bucket. Use Windows Task Scheduler to synchronize the contents of the S3 bucket locally to each instance periodically.
C. Create an Amazon EFS file system that uses the EFS Standard storage class. Mount the file system to the instances by using the file system's DNS name and the EFS mount helper.
D. Create a new Amazon EBS Multi-Attach volume. Attach the EBS volume as an additional drive to each instance.
Show Answer
Correct Answer: A
Explanation: Amazon FSx for Windows File Server Multi-AZ provides highly available, native Windows SMB file shares with synchronous replication and strong consistency semantics suitable for shared Windows application data. It integrates with Windows using DNS-mapped shares. S3 is object storage and periodic sync is not consistent. Amazon EFS does not provide native Windows SMB access. Amazon EBS Multi-Attach is only supported for specific Linux clustered file systems, not Windows shared storage.
Question 18
A CloudOps engineer must ensure that all of a company's Amazon S3 buckets have versioning enabled.
Which solution will meet this requirement?
A. Enable AWS Config. Set up the s3-bucket-versioning-enabled AWS Config managed rule. Specify the configuration changes trigger type. Configure an automatic remediation action that uses an AWS Lambda function to enable versioning on noncompliant S3 buckets.
B. Enable AWS Config. Set up the s3-bucket-versioning-enabled AWS Config managed rule. Specify the configuration changes trigger type. Configure an automatic remediation action that uses the AWS-ConfigureS3BucketVersioning AWS Systems Manager Automation runbook to enable versioning on noncompliant S3 buckets.
C. Enable Amazon GuardDuty. Use GuardDuty to identify S3 buckets that have versioning disabled. Create an Amazon EventBridge rule that sends the GuardDuty findings to AWS Systems Manager Automation. Specify the AWS-ConfigureS3BucketVersioning Systems Manager Automation runbook to enable versioning on noncompliant S3 buckets.
D. Enable Amazon GuardDuty. Use GuardDuty to identify S3 buckets that have versioning disabled. Create an Amazon EventBridge rule that sends the GuardDuty findings to a target AWS Lambda function. Configure the Lambda function to enable versioning on noncompliant S3 buckets.
Show Answer
Correct Answer: B
Explanation: AWS Config’s `s3-bucket-versioning-enabled` managed rule detects buckets without versioning. An automatic remediation using the `AWS-ConfigureS3BucketVersioning` Systems Manager Automation runbook can enable versioning on those noncompliant buckets. GuardDuty does not provide this configuration-compliance detection.
Question 19
A company runs on-premises workloads that need to use AWS hosted DNS services. The company requires high availability for DNS queries to ensure continuous DNS resolution for critical applications.
Which solution will meet these requirements?
A. Deploy Amazon Route 53 Resolver inbound endpoints to multiple Availability Zones. Configure on-premises DNS resolvers to use the endpoint IP addresses in a failover configuration.
B. Use Amazon Route 53 latency-based routing to ensure that DNS queries from on-premises systems are directed to the closest resolver endpoint.
C. Configure an Amazon Route 53 private hosted zone. Associate the private hosted zone with the on-premises network.
D. Deploy Amazon Route 53 Resolver outbound endpoints to multiple Availability Zones. Associate the endpoints with the on-premises DNS resolvers.
Show Answer
Correct Answer: A
Explanation: Route 53 Resolver inbound endpoints allow DNS queries originating from on-premises networks to resolve records hosted in AWS (such as private hosted zones). Deploying inbound endpoints across multiple Availability Zones provides high availability, and configuring the on-premises DNS resolvers to use the endpoint IP addresses with failover ensures continued DNS resolution if one endpoint becomes unavailable. Latency-based routing is unrelated to Resolver endpoints, private hosted zones cannot be directly associated with on-premises networks, and outbound endpoints are for forwarding DNS queries from AWS to on-premises DNS servers, not the reverse.
Question 19
A CloudOps engineer needs to ensure that an Amazon RDS for PostgreSQL DB instance has available backups. The DB instance has automated backups turned on with a backup retention period of 7 days. However, no automated backups for the DB instance have been created in the past month.
What could be the cause of the lack of automated backups?
A. The Amazon S3 bucket that stores the backups is full.
B. The DB instance is in the STORAGE_FULL state.
C. The DB instance is not configured for Multi-AZ.
D. The backup retention period must be 30 days.
Show Answer
Correct Answer: B
Explanation: Automated backups can be suspended when an RDS DB instance is in the STORAGE_FULL state. A 7-day retention period is valid; Multi-AZ is not required, and AWS manages the backup storage rather than using a customer S3 bucket.
Question 20
A company has an application that processes events sequentially by using an Amazon SQS FIFO queue. The company needs a solution that automatically sends notifications to the SQS queue when new objects are uploaded to an Amazon S3 bucket. The solution must maintain message ordering.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS Lambda function that polls the objects by using the ListObjectsV2 command and detects new objects when the objects are added. Configure the Lambda function to add a message to the SQS queue when new objects are detected.
B. Create an event notification on the S3 bucket. Use the FIFO delivery option. Route the notifications to the existing SQS queue.
C. Create an Amazon SNS FIFO topic. Create an event notification on the S3 bucket. Configure the event to send messages to the SNS topic. Subscribe the existing SQS queue to the SNS topic.
D. Create an access point in Amazon S3 Access Points. Configure the access point to send new items to the existing SQS queue.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Event Notifications can be configured to send object-created events directly to an Amazon SQS FIFO queue using FIFO delivery support, preserving ordering semantics without custom polling or intermediary services. This is the lowest operational overhead. Lambda polling is inefficient, SNS adds an unnecessary component, and S3 Access Points do not provide event forwarding to SQS.
Question 20
A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in an Amazon EC2 Auto Scaling group. The application is accessed with a public URL.
A CloudOps engineer needs to implement a monitoring solution that checks the availability of the application and follows the same routes and actions as a customer. The CloudOps engineer must receive a notification if less than 95% of the monitoring runs find no errors.
Which solution will meet these requirements?
A. Create an Amazon CloudWatch Synthetics canary with a script that follows customer routes. Schedule the canary to run on a recurring schedule. Create a CloudWatch alarm that publishes a message to an Amazon SNS topic when the SuccessPercent metric is less than 95%.
B. Create Amazon Route 53 health checks that monitor the availability of the endpoint. Create Amazon CloudWatch alarms that publish a message to an Amazon SNS topic when the HealthCheckPercentageHealthy metric is less than 95%.
C. Create a single AWS Lambda function to check whether the endpoints are available for each customer path. Schedule the Lambda function by using Amazon EventBridge. Configure the Lambda function to publish a message to an Amazon SNS topic when an endpoint returns an error.
D. Create an AWS Lambda function for each customer path to check whether that specific endpoint is available. Schedule the Lambda functions by using Amazon EventBridge. Configure each Lambda function to publish a custom metric to Amazon CloudWatch for the endpoint status. Create CloudWatch alarms based on each custom metric to publish a message to an Amazon SNS topic when an alarm is in the ALARM state.
Show Answer
Correct Answer: A
Explanation: A CloudWatch Synthetics canary can run a scripted sequence of customer routes and actions on a schedule. Its SuccessPercent metric measures successful runs, so an alarm below 95% can notify an SNS topic.
Question 21
A company asks a CloudOps engineer to provision an additional environment for an application in four additional AWS Regions. The application is running on more than 100 Amazon EC2 instances in the us-east-1 Region, using fully configured Amazon Machine Images (AMIs). The company has an AWS CloudFormation template to deploy resources in us-east-1.
What should the CloudOps engineer do to provision the application in the MOST operationally efficient manner?
A. Copy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs.
B. Create a snapshot of the running instance. Copy the snapshot to the other Regions. Create an AMI from the snapshots. Update the CloudFormation template for each Region to use the new AMI.
C. Run the existing CloudFormation template in each additional Region based on the success of the template that is used currently in us-east-1.
D. Update the CloudFormation template to include the additional Regions in the Auto Scaling group. Update the existing stack in us-east-1.
Show Answer
Correct Answer: A
Explanation: AMIs are Region-specific. The most operationally efficient approach is to copy the existing fully configured AMI to each target Region and use a CloudFormation mapping (or another Region-aware mechanism) so the same template can reference the correct AMI ID in each Region. Creating snapshots and rebuilding AMIs adds unnecessary steps, running the template alone will fail without Region-available AMIs, and Auto Scaling groups cannot span multiple AWS Regions.
Question 21
A company's application consists of AWS Lambda functions that access an Amazon RDS instance. Occasionally, the application load creates an unexpectedly high volume of database connections. The high volume of connections causes the RDS instance to rapidly exhaust its compute resources, leading to downtime for users.
A CloudOps Administrator must make the application more resilient to increased load without making modifications to the application code.
Which solution will meet these requirements?
A. Use Amazon ElastiCache (Redis OSS) with Amazon RDS. Point the application to ElastiCache (Redis OSS).
B. Use Amazon RDS Proxy with Amazon RDS. Point the application to Amazon RDS Proxy.
C. Create a Lambda function with that invokes an Amazon EventBridge rule to scale the RDS instance based on usage.
D. Use Amazon ElastiCache (Memcached) with Amazon RDS. Point the application to ElastiCache (Memcached).
Show Answer
Correct Answer: B
Explanation: Amazon RDS Proxy pools and reuses database connections, helping absorb connection spikes from Lambda functions and protecting the RDS instance from being overwhelmed. The application can connect through the proxy endpoint instead of directly to RDS, without changing its application logic.
Question 22
A company experiences increased production incidents. A CloudOps engineer must provide developers with secure access to Amazon EC2 instances from the AWS Management Console. The developers must be able to successfully connect by using EC2 Instance Connect for real-time troubleshooting.
The EC2 instances are based on the latest Amazon Linux 2023 AMIs. The EC2 instances are publicly accessible. The EC2 instances have been properly configured with security groups that allow inbound SSH traffic. The developers will use the default ec2-user account to access the instances from the console.
Which step should the CloudOps engineer perform NEXT to ensure that the developers can successfully connect by using EC2 Instance Connect?
A. Create an IAM role with EC2 access. Attach the role to the EC2 instances.
B. Download and install the EC2 Instance Connect agent on the production instances.
C. Grant IAM permissions to the developers to use EC2 Instance Connect and describe the EC2 instances.
D. Enable AWS CloudTrail logging. Create a VPC endpoint for EC2 Instance Connect.
Show Answer
Correct Answer: C
Explanation: Amazon Linux 2023 AMIs already include EC2 Instance Connect support, so no additional agent installation is required. The instances are publicly accessible and SSH is allowed by security groups. The remaining requirement is that the developers have the necessary IAM permissions to send the EC2 Instance Connect public key and to describe instances when connecting from the AWS Management Console.
$19
Get all 194 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.