A global company runs a critical primary workload in the us-east-1 Region. The company wants to ensure business continuity with minimal downtime in case of a workload failure. The company wants to replicate the workload to a second AWS Region.
A CloudOps engineer needs a solution that achieves a recovery time objective (RTO) of less than 10 minutes and a zero recovery point objective (RPO) to meet service level agreements.
Which solution will meet these requirements?
A. Implement a pilot light architecture that provides real-time data replication in the second Region. Configure Amazon Route 53 health checks and automated DNS failover.
B. Implement a warm standby architecture that provides regular data replication in a second Region. Configure Amazon Route 53 health checks and automated DNS failover.
C. Implement an active-active architecture that provides real-time data replication across two Regions. Use Amazon Route 53 health checks and a weighted routing policy.
D. Implement a custom script to generate a regular backup of the data and store it in an S3 bucket that is in a second Region. Use the backup to launch the application in the second Region in the event of a workload failure.
Show Answer
Correct Answer: C
Explanation: A zero RPO requires continuous, real-time replication so no committed data is lost, and an RTO of less than 10 minutes requires an already-running deployment that can immediately continue serving traffic. An active-active multi-Region architecture with real-time replication and Amazon Route 53 health checks plus weighted routing best satisfies these requirements. Pilot light and warm standby generally do not provide zero RPO, and backup/restore has much higher RTO and nonzero RPO.
Question 52
A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic.
A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instance through SSH without exposing the instance to the internet.
Which solution will meet this requirement?
A. Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
B. Create a Systems Manager endpoint in the private subnet. Update the security group to allow SSH traffic from the private network where the Systems Manager endpoint is connected. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
C. Create an EC2 Instance Connect endpoint in the public subnet. Update the security group to allow SSH traffic from the private network. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
D. Create a Systems Manager endpoint in the public subnet. Create an IAM role that has the AmazonSSMManagedInstanceCore permission for the EC2 instance. Create an IAM group for privileged administrators. Assign the AmazonEC2ReadOnlyAccess IAM policy to the IAM group.
Show Answer
Correct Answer: A
Explanation: EC2 Instance Connect Endpoint enables SSH access to private EC2 instances without exposing them to the internet. The instance security group must allow inbound TCP/22 from the EC2 Instance Connect Endpoint. Systems Manager options shown are incorrect because they do not configure Session Manager access correctly and unnecessarily refer to SSH. The IAM permissions in the options are imperfect, but among the provided choices, the EC2 Instance Connect endpoint solution is the correct match.
Question 53
A CloudOps engineer needs to disable automatic backups for an Amazon RDS instance to optimize costs. When the CloudOps engineer attempts to disable the backups, the CloudOps engineer receives an error message that states the retention period must be between 1 and 35.
What is the likely cause of this issue?
A. The RDS instance has insufficient permissions to change the backup retention period.
B. Read replicas are configured for the RDS instance.
C. The RDS instance is using the default backup window.
D. The RDS instance is part of a Multi-AZ deployment.
Show Answer
Correct Answer: B
Explanation: Amazon RDS does not allow automated backups to be disabled (backup retention period set to 0) when the DB instance has read replicas. Read replicas depend on automated backups, so the retention period must remain between 1 and 35 days. Multi-AZ deployments, backup windows, or IAM permissions do not produce this specific retention-period constraint.
Question 54
A company is implementing Cross-Region Replication (CRR) for the company’s Amazon S3 buckets. The S3 buckets are in the us-east-1 Region. The company uses server-side encryption with Amazon S3 managed keys (SSE-S3) to secure the data in the buckets.
A CloudOps engineer creates a new AWS account to store backups in S3 buckets. All backup buckets are in the us-west-2 Region. The CloudOps engineer enables versioning on the source buckets and the destination buckets. The CloudOps engineer creates an IAM role in the source account for s3.amazonaws.com. The CloudOps engineer grants the IAM role permissions to perform read actions in the source buckets, replicate actions in the destination buckets, and encrypt actions that use the destination bucket's key. The destination bucket policy allows the IAM role to perform replicate and read actions.
After the replication configuration is complete, the CloudOps engineer notices that objects are not replicating.
What is the likely reason the objects are not replicating?
A. The IAM role and bucket policies must have the ObjectOwnerOverrideToBucketOwner permission.
B. The objects in the source buckets and destination buckets must be encrypted by multi-Region keys.
C. Gateway VPC endpoints for Amazon S3 must be created in the source accounts and the destination account.
D. The destination buckets must use server-side encryption with AWS KMS keys (SSE-KMS).
Show Answer
Correct Answer: A
Explanation: The source objects use SSE-S3, which is fully supported by S3 Cross-Region Replication and does not require SSE-KMS or multi-Region KMS keys. For cross-account replication where the destination bucket owner should own the replicated objects, the replication role and bucket policy must allow the s3:ObjectOwnerOverrideToBucketOwner permission when ownership override is used. The scenario also incorrectly mentions KMS encrypt permissions despite SSE-S3, pointing away from KMS as the root cause.
Sources:
https://aws.amazon.com/s3/features/replication
Question 55
A CloudOps engineer creates a new VPC that contains a private subnet, a security group that allows all outbound traffic, and an endpoint for Amazon EC2 Instance Connect in a private subnet. The CloudOps engineer associates the security group with EC2 Instance Connect.
The CloudOps engineer launches an EC2 instance from an Amazon Linux Amazon Machine Image (AMI) in the private subnet. The CloudOps engineer associates the instance with the same subnet that the security group uses. The CloudOps engineer launches the EC2 instance without an SSH key pair.
The CloudOps engineer tries to connect to the instance by using the EC2 Instance Connect endpoint. However, the connection fails.
How can the CloudOps engineer connect to the instance?
A. Create an inbound rule in the security group to allow HTTPS traffic on port 443 from the private subnet.
B. Create an inbound rule in the security group to allow SSH traffic on port 22 from the private subnet.
C. Create an IAM instance profile that allows AWS Systems Manager Session Manager to access the EC2 instance. Associate the instance profile with the instance.
D. Recreate the EC2 instance. Associate an SSH key pair with the instance.
Show Answer
Correct Answer: B
Explanation: An EC2 Instance Connect Endpoint tunnels an SSH connection to the target instance, but the instance must still allow inbound SSH (TCP port 22) from the endpoint within the VPC. A security group with only outbound rules is insufficient. Port 443 is used to reach the Instance Connect Endpoint service, not the instance itself. Session Manager is a different access mechanism, and recreating the instance with a key pair is unnecessary because EC2 Instance Connect injects a temporary public key for authentication.
Question 56
A company's website runs on an Amazon EC2 Linux instance. The website needs to serve PDF files from an Amazon S3 bucket. All public access to S3 bucket is blocked at the account level. The company needs to allow website users to download the PDF files.
Which solution will meet these requirements with the LEAST administrative effort?
A. Create an IAM role that has a policy that allows s3:list* and s3:get* permissions. Assign the role to the EC2 instance. Assign a company employee to download requested PDF file to the EC2 instance and to deliver the files to website users. Create an AWS Lambda function to periodically delete local files.
B. Create an Amazon CloudFront distribution that uses an origin access control (OAC) that points to the S3 bucket. Apply a bucket policy to the bucket to allow connections from the CloudFront distribution. Assign a company employee to provide a download URL that contains the distribution URL and the object path to users when users request PDF files.
C. Change the S3 bucket permissions to allow public access on the source S3 bucket. Assign a company employee to provide a PDF file URL to users when users request the PDF files.
D. Deploy an EC2 instance that has an 1AM instance profile to a public subnet. Use a signed URL from the EC2 instance to provide temporary access to the S3 bucket for website users.
Show Answer
Correct Answer: D
Explanation: The intended AWS best practice is to keep the S3 bucket private and use an IAM role on the EC2 instance so the website application can generate Amazon S3 presigned URLs for specific PDF objects. Users download the files through temporary signed URLs without making the bucket public. Although the option incorrectly mentions deploying an EC2 instance and 'signed URL from the EC2 instance' rather than explicitly saying the application generates S3 presigned URLs, it is the closest correct solution. Option C violates the requirement because account-level S3 Block Public Access is enabled. Option A requires copying objects to EC2 and ongoing cleanup. Option B uses CloudFront OAC correctly to keep the bucket private, but the described manual employee workflow is not the least administrative effort compared with application-generated presigned URLs.
Question 57
A developer enables versioning on an Amazon S3 bucket. When the developer attempts to perform a write operation on the bucket, the developer encounters an HTTP 404 NoSuchKey error.
A CloudOps engineer must resolve this issue.
Which solution will meet this requirement?
A. Disable versioning on the S3 bucket and retry the write operation.
B. Modify the bucket policy to allow write operations on versioned objects.
C. Wait at least 15 minutes after enabling versioning, and then perform the write operation.
D. Enable S3 Transfer Acceleration on the bucket.
Show Answer
Correct Answer: C
Explanation: After enabling versioning on an Amazon S3 bucket, AWS notes that it can take a short propagation period (up to about 15 minutes) for the change to fully take effect. During this interval, write operations can return unexpected errors such as 404 NoSuchKey. Waiting for propagation and retrying the write resolves the issue. Disabling versioning does not address the propagation delay, bucket policy issues would typically produce 403 AccessDenied rather than 404 NoSuchKey, and Transfer Acceleration is unrelated.
Question 58
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs to send specific events from all the accounts in the organization to a new receiver account so an AWS Lambda function can process the events.
A CloudOps engineer needs to configure Amazon EventBridge to route the events to a target event bus in the us-west-2 Region in the new receiver account. The CloudOps engineer creates rules in the sender accounts and the receiver account that match the specified events. The rules do not specify an account parameter in the event pattern. The CloudOps engineer creates IAM roles in the sender accounts to allow PutEvents actions on the target event bus.
The first test events that originate from the us-east-1 Region are not being processed by the Lambda function in the receiving account.
What is the likely reason the events are not processed?
A. Interface VPC endpoints for EventBridge are required in the sender accounts and receiver accounts.
B. The target Lambda function is in a different AWS Region, which is not supported by EventBridge.
C. The resource-based policy on the target event bus must be modified to allow PutEvents API calls from the sender accounts.
D. The rule in the receiving account must specify {"account": ("sender-account-id"!) in its event pattern and must include the receiving account I
Show Answer
Correct Answer: C
Explanation: For cross-account EventBridge event delivery, the sender needs permission to call PutEvents and the target event bus must also have a resource-based policy that allows the sender accounts (or the organization) to put events. Cross-Region routing is supported, VPC interface endpoints are optional, and the receiving rule does not need to include the account field unless filtering by account is desired.
Question 59
A company generates hundreds of images and uploads the images to an Amazon S3 bucket. The company manually copies the images to an always-on Amazon EC2 instance for processing. It usually takes between 30 seconds and 120 seconds to process each image.
A CloudOps engineer wants to automate the image processing solution to process the images as soon as they arrive in the S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
A. Configure S3 Event Notifications to invoke the EC2 instance when images are uploaded to the S3 bucket. Run the image processing solution on the EC2 instance to process the images.
B. Configure S3 Event Notifications to invoke an Amazon EventBridge rule. Configure the EventBridge rule to start a preconfigured AWS Glue ETL job to process images.
C. Configure S3 Event Notifications to invoke an AWS Lambda function that runs image processing logic when new images are uploaded on the source S3 bucket.
D. Configure S3 Event Notifications to invoke a task on an Amazon Elastic Container Service (Amazon ECS) container that is backed by EC2 instances when the images are uploaded to the S3 bucket. Configure the ECS task to process the images.
Show Answer
Correct Answer: C
Explanation: AWS Lambda can be invoked directly by Amazon S3 Event Notifications and is well suited for event-driven processing that takes up to a few minutes. A processing time of 30–120 seconds is within Lambda's maximum execution time. This removes the need for an always-on EC2 instance and is the most cost-effective option for processing images as they arrive. Option A is invalid because S3 cannot directly invoke an EC2 instance. AWS Glue is intended for ETL workloads rather than image processing, and ECS backed by EC2 requires managing compute capacity and is generally less cost-effective for this event-driven workload.
Question 60
A CloudOps engineer is using AWS Compute Optimizer to generate recommendations for a fleet of Amazon EC2 instances. Some of the instances use newly released instance types, while other instances use older instance types.
After the analysis is complete, the CloudOps engineer notices that some of the EC2 instances are missing from the Compute Optimizer dashboard.
What is the likely cause of this issue?
A. The missing instances have insufficient historical Amazon CloudWatch metric data for analysis.
B. Compute Optimizer does not support the instance types of the missing instances.
C. Compute Optimizer already considers the missing instances to be optimized.
D. The missing instances are running a Windows operating system.
Show Answer
Correct Answer: B
Explanation: AWS Compute Optimizer only evaluates supported EC2 instance types. Instances using unsupported types, including some newly released types before support is added (and certain older unsupported families), will not appear in recommendations. Instances with insufficient metrics or already optimized status are typically still shown with the corresponding status, and Windows instances are supported.
$19
Get all 130 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.