A company has an Amazon S3 bucket where users upload feedback items. The company also has an Amazon API Gateway REST API that processes feedback notifications.
The company needs a solution that automatically calls the API Gateway REST API when new feedback items are uploaded to the S3 bucket.
Which solution will meet these requirements?
A. Configure an event notification for the S3 bucket with API Gateway as the destination. Use the s3:ObjectAcl:Put event.
B. Configure an event notification for the S3 bucket with Amazon EventBridge as the destination. Configure an EventBridge rule that monitors for the S3 event and calls the API Gateway REST API.
C. Create a Lambda@Edge function that calls the API Gateway REST API when a new feedback item is uploaded. Configure an event notification for the S3 bucket with the Lambda@Edge function as the destination.
D. Create an Amazon SQS queue. Configure an event notification for the S3 bucket with the SQS queue as the destination. Configure Amazon SQS to push new events to the API Gateway REST API.
Show Answer
Correct Answer: B
Explanation: Enable Amazon EventBridge notifications for the S3 bucket, then create an EventBridge rule matching object-upload events and configure the rule to invoke the API Gateway REST API. S3 bucket notifications do not directly target API Gateway, and SQS does not natively push messages to an API Gateway REST API.
Question 23
A company's developers deploy applications to multiple AWS accounts. The developers are able to create any AWS resource within the AWS accounts.
A security team wants to audit the resources that the developers created in the company's AWS accounts.
Which solution will meet this requirement?
A. Create an AWS account for the security team. Configure AWS Audit Manager in the security team's account. Create an Audit Manager assessment. Include the company's AWS accounts in the assessment scope. Generate an assessment report for the security team.
B. Configure an AWS Config recorder in each AWS account. In the security team's AWS account, create an AWS Config aggregator. Authorize the aggregator in every AWS account. Use Amazon Quick Suite and Amazon Athena to generate a report for the security team.
C. Create a trail in AWS CloudTrail in every AWS account. Create an Amazon RDS DB instance in the security team's account. Configure CloudTrail in every account to write logs to the DB instance. Use Amazon Quick Suite to query the DB instance and generate a report for the security team.
D. Enable AWS Trusted Advisor in every AWS account. Create a scheduled Amazon EventBridge rule to periodically refresh the Trusted Advisor checks. Use the Trusted Advisor console to generate a report for the security team.
Show Answer
Correct Answer: B
Explanation: AWS Config records resource configurations across accounts. A central AWS Config aggregator in the security account collects configuration data from all authorized accounts, providing a centralized inventory for auditing resources created by developers. Athena and Amazon QuickSight can be used to query and report on the aggregated configuration data. Audit Manager focuses on compliance assessments, CloudTrail logs should not be delivered to RDS, and Trusted Advisor is not an inventory/auditing service.
Question 23
An ecommerce company runs a microservices application on Amazon ECS. Customers sometimes experience high latency when the customers attempt to complete a purchase through the application.
A CloudOps engineer needs a solution to track individual transactions across multiple services to identify where latency is occurring. The solution must require minimal code changes and must provide a visual representation of service dependencies.
Which solution will meet these requirements?
A. Set up the AWS X-Ray daemon as a sidecar container. Instrument the application code by using the X-Ray SDK. Use the service map to visualize request flows to identify latency.
B. Configure an Amazon CloudWatch agent on ECS containers as a sidecar container. Create custom metrics for each service. Set up CloudWatch dashboards to monitor response times.
C. Use Amazon VPC Flow Logs to collect logs for microservices that run on the ECS container. Monitor network traffic, and use the service map to identify latency between microservices.
D. Use Amazon CloudWatch Container Insights as a sidecar container to collect container metrics. Monitor response times, and visualize request flows to identify latency.
Show Answer
Correct Answer: A
Explanation: AWS X-Ray traces individual requests across services and provides a service map that visualizes dependencies and helps locate latency. On ECS, the X-Ray daemon can run as a sidecar; the application must be instrumented with the X-Ray SDK. CloudWatch metrics and Container Insights provide operational metrics, while VPC Flow Logs show network traffic—not end-to-end transaction traces or application service dependencies.
Question 24
A CloudOps engineer needs to quickly resolve issues in an application that runs in a production environment on Amazon EC2 instances. The application uses an Amazon RDS database. To resolve the issues, the CloudOps engineer needs a centralized solution to collect and query logs for both the EC2 instances and the RDS database.
Which solution will meet these requirements?
A. Install and configure the Amazon CloudWatch agent on the EC2 instances to forward ERROR log events to Amazon CloudWatch Logs. Configure the RDS database to export log events to CloudWatch Logs. Use CloudWatch Logs Insights to query the logs.
B. Install and configure the Amazon CloudWatch agent on the EC2 instances to forward INFO log events to an Amazon S3 bucket. Install the CloudWatch agent on the RDS database. Forward ERROR log events to the S3 bucket. Configure S3 Event Notifications to invoke AWS Lambda functions to analyze the logs.
C. Install and configure the Amazon CloudWatch agent on the EC2 instances to forward ERROR log events to Amazon CloudWatch Logs. Use the Logs & events menu to examine log events for the RDS database. Use CloudWatch Logs Insights to query logs only for the EC2 instances.
D. Install and configure the AWS X-Ray agent on the EC2 instances to forward INFO, DEBUG, and latency log events to Amazon CloudWatch Logs. Configure the RDS database to export log events to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the logs.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch Logs provides a centralized log collection and querying solution. Install the CloudWatch agent on EC2 instances to send application/system logs to CloudWatch Logs, configure Amazon RDS to export supported database logs directly to CloudWatch Logs, and use CloudWatch Logs Insights to query across the collected logs. The other options are incorrect because RDS does not support installing the CloudWatch agent (B), do not centralize/query RDS logs with Logs Insights (C), or misuse AWS X-Ray, which is for distributed tracing rather than log forwarding (D).
Question 24
A company uses AWS Organizations to manage its AWS accounts. The company is implementing a CostCenter tag for business units to track costs and prevent noncompliant actions.
The company needs to prevent users from launching Amazon EC2 instances with a CostCenter tag unless the tag has specified values.
Which solution will meet this requirement with the LEAST administrative effort?
A. Create a service control policy (SCP) for the CostCenter tag in Organizations. Define the specified values in the policy. Attach the policy to all the company's organizational units (OUs).
B. Configure inventory collection for the EC2 instances in AWS Systems Manager Inventory. Attach the CostCenter tag to the managed instances.
C. Create an Amazon Machine Image (AMI) for each of the company's business units. Include a user data script that tags instances when they are launched.
D. Create an Amazon EventBridge rule that invokes an AWS Lambda function when a user launches an EC2 instance. Configure the Lambda function to apply the appropriate CostCenter tag for each user's IAM role or to terminate the instance if the tag lacks the specified values.
Show Answer
Correct Answer: A
Explanation: An SCP can centrally deny EC2 launch requests that include a CostCenter tag with a value outside the approved set. Attaching the policy to the relevant OUs enforces the rule across their accounts with the least administrative effort.
Question 25
A company is hosting a public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The company needs the website to support HTTPS connections.
Which solution will meet this requirement?
A. Replace the ALB with a Network Load Balancer.
B. Use AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate. Configure the ALB to use the certificate.
C. Import a public SSL/TLS certificate into AWS KMS. Configure the ALB to retrieve the certificate from AWS KMS.
D. Attach a public SSL/TLS certificate to the target group that is associated with the ALB.
Show Answer
Correct Answer: B
Explanation: Application Load Balancers terminate HTTPS using an SSL/TLS certificate attached to an HTTPS listener. AWS Certificate Manager (ACM) is the standard service to provision and manage public certificates for use with ALBs. AWS KMS does not store or serve TLS certificates for ALBs, target groups do not have certificates attached, and replacing the ALB with an NLB is unnecessary to support HTTPS.
Question 25
A company hosts its website on Amazon EC2 instances in the us-east-1 Region. The company is preparing to extend its website into the eu-central-1 Region, but the database must remain only in us-east-1. After deployment, the EC2 instances in eu-central-1 are unable to connect to the database in us-east-1.
What is the MOST operationally efficient solution that will resolve this connectivity issue?
A. Create a VPC peering connection between the two Regions. Add the private IP address range of the instances to the inbound rule of the database security group.
B. Create a VPC peering connection between the two Regions. Add the security group of the instances in eu-central-1 to the outbound rule of the database security group.
C. Create a VPN connection between the two Regions. Add the private IP address range of the instances to the outbound rule of the database security group.
D. Create a VPN connection between the two Regions. Add the security group of the instances in eu-central-1 to the inbound rule of the database security group.
Show Answer
Correct Answer: A
Explanation: Use inter-Region VPC peering and configure the necessary routes between the VPCs. Then allow the EC2 instances’ private IP address range in the database security group’s inbound rules. Security groups are stateful, and a security group reference is not the right choice for this cross-Region setup.
Question 26
A company uses AWS Systems Manager to automate tasks across AWS accounts. The company uses monitoring tools to detect issues. The company creates a Systems Manager Automation runbook that runs an AWS Lambda function to remediate the issues.
Initially, the company runs the runbook manually. Now, the company wants to automate running the runbook whenever the monitoring tools detect issues.
Which solution will meet this requirement?
A. Configure the monitoring tools to publish findings to Amazon EventBridge. Create an EventBridge rule that invokes the runbook in response to events from the monitoring tools.
B. Configure the monitoring tools to send findings to an Amazon SNS topic. Subscribe the runbook to the SNS topic. Invoke the runbook when a message is received.
C. Configure the monitoring tools to write findings to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter that invokes the runbook when new log entries are detected.
D. Configure AWS Config to assess the resources and publish configuration changes to Amazon EventBridge. Create a rule to invoke the runbook in response to configuration change events.
Show Answer
Correct Answer: A
Explanation: Amazon EventBridge is the standard event bus for routing operational events from monitoring tools to automated targets. AWS Systems Manager Automation runbooks can be invoked directly by EventBridge rules, enabling automatic remediation when matching events are received. SNS cannot directly subscribe a runbook as described, CloudWatch Logs subscription filters are intended for log consumers rather than Automation runbooks, and AWS Config configuration change events do not generally represent arbitrary monitoring tool detections.
Question 26
A company hosts an application on AWS that uses a 5 TB Amazon RDS for MySQL database. The company performs frequent micro updates that cannot be interrupted. Sometimes structural changes to the database cause issues for the application. When an issue occurs, the company immediately receives a notification through automated monitoring.
The company wants to undo the problematic database changes as soon as possible. The company wants to transition from RDS for MySQL to an Amazon Aurora MySQL-Compatible Edition cluster.
Which solution will meet these requirements?
A. Create a DB cluster snapshot immediately before the update begins. If the update fails, restore the DB snapshot and modify the application to use the new DB cluster endpoint.
B. Create a database record in an Amazon Route 53 private zone that points to the cluster endpoint. Create a DB cluster snapshot immediately before the update begins. If the update fails, restore the DB snapshot and modify DNS accordingly.
C. Activate the backtrack feature in the Aurora cluster during the initial creation or restoration of the Aurora cluster from the RDS for MySQL database. Use backtrack to roll back the database to the point in time right before the update began.
D. Create an RDS Proxy in front of the Aurora cluster. If the update fails, restore the DB snapshot and modify the RDS Proxy to use the new DB cluster endpoint.
Show Answer
Correct Answer: C
Explanation: Aurora MySQL Backtrack can rewind the cluster to a point before the problematic change without restoring a snapshot or switching the application to a new endpoint. Enable Backtrack when creating or restoring the Aurora cluster, then use it to undo the change quickly.
Question 27
A company is attempting to manage its costs in the AWS Cloud. A CloudOps engineer needs specific company-defined tags that are assigned to resources to appear on the billing report.
What should the CloudOps engineer do to meet this requirement?
A. Activate the tags as AWS generated cost allocation tags.
B. Activate the tags as user-defined cost allocation tags.
C. Create a new cost category. Select the account billing dimension.
D. Create a new AWS Cost and Usage Report. Include the resource IDs.
Show Answer
Correct Answer: B
Explanation: Company-defined tags are user-defined cost allocation tags. To have these tags appear in billing and cost management reports, they must first be activated as user-defined cost allocation tags in the AWS Billing and Cost Management console. AWS-generated cost allocation tags are system-created tags, while Cost Categories and Cost and Usage Reports do not replace the requirement to activate user-defined tags for billing visibility.
$19
Get all 194 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.