A company uses memory-optimized Amazon EC2 instances behind a Network Load Balancer (NLB) to run an application. The company launched the EC2 instances from an AWS provided Red Hat Enterprise Linux (RHEL) Amazon Machine Image (AMI).
A CloudOps engineer must monitor RAM utilization in 5-minute intervals. The CloudOps engineer must ensure that the EC2 instances scale in and out appropriately based on incoming load.
Which solution will meet these requirements?
A. Configure detailed monitoring for the EC2 instances. Configure the Amazon CloudWatch agent on the EC2 instances. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_active metric.
B. Configure detailed monitoring for the EC2 instances. Use the mem_used_percent metric that the detailed monitoring feature provides. Create an IAM role that allows the CloudWatch agent to upload data. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
C. Configure basic monitoring for the EC2 instances. Configure the Amazon CloudWatch agent on the EC2 instances. Create an IAM role that allows the CloudWatch agent to upload data. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
D. Configure basic monitoring for the EC2 instances. Use the standard mem_used_percent metric for monitoring. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
Show Answer
Correct Answer: C
Explanation: Amazon EC2 does not publish memory utilization metrics to CloudWatch by default. RAM metrics such as mem_used_percent require the CloudWatch agent and an IAM role that allows the agent to publish custom metrics. The requirement is 5-minute intervals, which basic monitoring already provides, so detailed monitoring is unnecessary. An Auto Scaling policy can then use the custom mem_used_percent metric.
Question 62
A company runs a workload in an Amazon VPC. The company configures Amazon CloudWatch Logs for the workload. The company needs a solution to automatically detect unusual API activity and security events in the company's AWS account.
Which solution will meet this requirement?
A. Use Amazon Inspector to scan VPC flow logs.
B. Use Amazon GuardDuty to monitor CloudWatch logs.
C. Implement AWS CloudTrail Insights.
D. Use AWS Config automatic anomaly detection.
Show Answer
Correct Answer: C
Explanation: AWS CloudTrail Insights automatically detects unusual API activity by establishing a baseline of normal API call volume and error rates from CloudTrail management events, then generating Insights events when anomalies occur. Amazon Inspector assesses vulnerabilities, GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs for threats but does not monitor CloudWatch Logs as stated, and AWS Config tracks resource configurations rather than API activity anomalies.
Question 63
A company uses hundreds of Amazon EC2 On-Demand Instances and Spot Instances to run production and non-production workloads. The company installs and configures the AWS Systems Manager Agent (SSM Agent) on the EC2 instances.
During a recent instance patch operation, some instances were not patched because the instances were either busy or down. The company needs to generate a report that lists the current patch version of all instances.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Use Systems Manager Inventory to collect patch versions. Generate a report of all instances.
B. Use Systems Manager Run Command to remotely collect patch version information. Generate a report of all instances.
C. Use AWS Config to track EC2 instance configuration changes by using output from the SSM Agents. Create a custom rule to check for patch versions. Generate a report of all unpatched instances.
D. Use AWS Config to monitor the patch status of the EC2 instances by using output from the SSM Agents. Create a configuration compliance rule to check whether patches are installed. Generate a report of all instances.
Show Answer
Correct Answer: A
Explanation: Systems Manager Inventory collects metadata from managed instances, including installed patches and application inventory, via the SSM Agent and stores it centrally for reporting. It does not require running a new command against every instance at report time, making it suitable even if some instances were unavailable during a patch operation. Run Command requires managed instances to be online to execute commands. AWS Config focuses on configuration/compliance evaluation rather than reporting current patch versions for all instances.
Question 64
A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific security requirements.
The company must not deploy any EC2 instances in the ap-southeast-2 Region. The company must completely block root user actions in all member accounts. The company must prevent any user from deleting AWS CloudTrail logs, including administrators.
The company requires a centrally managed solution that the company can automatically apply to all existing and future accounts.
Which solution will meet these requirements?
A. Create AWS Config rules with remediation actions in each account to detect policy violations. Implement IAM permissions boundaries for the account root users.
B. Enable AWS Security Hub across the organization. Create custom security standards to enforce the security requirements. Use AWS CloudFormation StackSets to deploy the standards to all the accounts in the organization. Set up Security Hub automated remediation actions.
C. Use AWS Control Tower for account governance. Configure Region deny controls. Use service control policies (SCPs) to restrict root user access.
D. Configure AWS Firewall Manager with security policies to meet the security requirements. Use an AWS Config aggregator with organization-wide conformance packs to detect security policy violations.
Show Answer
Correct Answer: C
Explanation: AWS Control Tower provides centralized governance for existing and new accounts in an AWS Organization. Region deny controls prevent use of disallowed Regions such as ap-southeast-2. Service control policies (SCPs) can be applied organization-wide to block root user actions in member accounts and deny CloudTrail log deletion actions for all principals, including administrators. SCPs are preventive controls and automatically apply to existing and future accounts through the organization.
Question 65
A financial services company stores customer images in an Amazon S3 bucket in the us-east-1 Region. To comply with regulations, the company must ensure that all existing objects are replicated to an S3 bucket in a second AWS Region. If an object replication fails, the company must be able to retry replication for the object.
Which solution will meet these requirements?
A. Configure Amazon S3 Cross-Region Replication (CRR). Use Amazon S3 live replication to replicate existing objects.
B. Configure Amazon S3 Cross-Region Replication (CRR). Use S3 Batch Replication to replicate existing objects.
C. Configure Amazon S3 Cross-Region Replication (CRR). Use S3 Replication Time Control (S3 RTC) to replicate existing objects.
D. Use S3 Lifecycle rules to move objects to the destination bucket in a second Region.
Show Answer
Correct Answer: B
Explanation: S3 Cross-Region Replication replicates only new objects after replication is configured. To replicate existing objects, use S3 Batch Replication. S3 Batch Replication also supports retrying replication for objects that previously failed to replicate. S3 Replication Time Control provides an SLA for live replication of new objects, not backfilling existing objects. Lifecycle rules do not perform cross-Region replication.
Question 66
A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications.
A CloudOps engineer must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any account in the application OU. The restriction must apply only to accounts in the application OU.
Which solution will meet these requirements?
A. Create an IAM group that has a policy that allows the ec2:RunInstances action when the CostCenter-Project tag is present. Place all IAM users who need access to the application accounts in the IAM group.
B. Create a service control policy (SCP) that denies the oc2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the application OU.
C. Create an IAM role that has a policy that allows the oc2:RunInstances action when the CostCenter-Project tag is present. Attach the IAM role to the IAM users that are in the application OU accounts.
D. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the root OU.
Show Answer
Correct Answer: B
Explanation: A service control policy (SCP) can enforce organization-wide guardrails at the OU level. An SCP that denies ec2:RunInstances when the required CostCenter-Project tag is absent ensures no principal in accounts within the application OU can launch untagged EC2 instances. IAM groups or roles do not provide OU-wide enforcement, and attaching the SCP to the root would affect the entire organization rather than only the application OU.
Question 67
A company that runs multiple workloads on AWS wants to enhance its security posture by implementing DNS-based threat protection. The company must block DNS-based attacks.
Which solution will meet this requirement?
A. Deploy AWS Shield Advanced to filter and block malicious DNS queries. Set up domain filtering policies.
B. Use AWS WAF to inspect DNS traffic for malicious domains. Create custom rules to block known threats.
C. Configure Amazon Route 53 Resolver to forward DNS queries to Route 53 Resolver DNS Firewall Advanced to detect and filter threats.
D. Configure AWS Config to monitor DNS queries and DNS traffic patterns. Use an AWS Lambda function to prevent access to malicious domains.
Show Answer
Correct Answer: C
Explanation: Route 53 Resolver DNS Firewall is the AWS service designed to filter outbound DNS queries to known malicious domains and enforce DNS-based threat protection. AWS Shield Advanced provides DDoS protection rather than DNS query filtering, AWS WAF protects HTTP(S) applications instead of DNS traffic, and AWS Config is a compliance and configuration auditing service, not a DNS traffic inspection service.
Question 68
A CloudOps engineer is preparing to deploy an application to Amazon EC2 instances that are in an Auto Scaling group. The application requires dependencies to be installed. Application updates are issued weekly.
The CloudOps engineer needs to implement a solution to incorporate the application updates on a regular basis. The solution also must conduct a vulnerability scan during Amazon Machine Image (AMI) creation.
What is the MOST operationally efficient solution that meets these requirements?
A. Create a script that uses Packer. Schedule a cron job to run the script.
B. Install the application and its dependencies on an EC2 instance. Create an AMI of the EC2 instance.
C. Use EC2 Image Builder with a custom recipe to install the application and its dependencies.
D. Invoke the EC2 CreateImage API operation by using an Amazon EventBridge scheduled rule.
Show Answer
Correct Answer: C
Explanation: EC2 Image Builder is the managed AWS service designed to automate creation, testing, scanning, and distribution of AMIs. A custom image recipe can install the application and dependencies, the pipeline can run on a weekly schedule, and Image Builder supports vulnerability scanning during the image build process (for example, via Amazon Inspector integration). Packer with cron requires self-managed automation, manually creating an AMI is not operationally efficient, and CreateImage only snapshots an existing instance rather than building and validating updated images.
Question 69
A CloudOps engineer has successfully deployed a VPC with an AWS CloudFormation template The CloudOps engineer wants to deploy the same template across multiple accounts that are managed through AWS Organizations.
Which solution will meet this requirement with the LEAST operational overhead?
A. Assume the OrganizationAccountAccessRole IAM role from the management account. Deploy the template in each of the accounts.
B. Create an AWS Lambda function to assume a role in each account. Deploy the template by using the AWS CloudFormation CreateStack API call.
C. Create an AWS Lambda function to query for a list of accounts. Deploy the template by using the AWS CloudFormation CreateStack API call.
D. Use AWS CloudFormation StackSets from the management account to deploy the template in each of the accounts.
Show Answer
Correct Answer: D
Explanation: AWS CloudFormation StackSets are designed to deploy and manage CloudFormation stacks across multiple AWS accounts and Regions from a central administrator account, including accounts managed by AWS Organizations. This provides the least operational overhead compared to manually assuming roles or building custom Lambda automation.
Question 70
A company hosts a web application on an Amazon EC2 instance. The web server logs are published to Amazon CloudWatch Logs. The log events have the same structure and include the HTTP response codes that are associated with the user requests. The company needs to monitor the number of times that the web server returns an HTTP 404 response.
What is the MOST operationally efficient solution that meets these requirements?
A. Create a CloudWatch Logs metric filter that counts the number of times that the web server returns an HTTP 404 response.
B. Create a CloudWatch Logs subscription filter that counts the number of times that the web server returns an HTTP 404 response.
C. Create an AWS Lambda function that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.
D. Create a script that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.
Show Answer
Correct Answer: A
Explanation: CloudWatch Logs metric filters are designed to extract metric data from log events in real time. A metric filter can match HTTP 404 response codes and increment a custom CloudWatch metric, providing an operationally efficient way to monitor the count without custom code. Subscription filters are for streaming logs to downstream services, while Logs Insights queries via Lambda or scripts require scheduled execution and additional operational overhead.
$19
Get all 130 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.