A CloudOps engineer manages the security of accounts in an organization in AWS Organizations. The CloudOps engineer must implement a solution that applies a base configuration to all accounts when the accounts join the organization.
Which solution will meet this requirement with the LEAST operational overhead?
A. Create the configuration in an AWS CloudFormation template. Deploy the template to all accounts in the organization by using StackSets automatic deployments.
B. Turn on AWS Config in the organization's management account. Use multi-account, multi-Region data aggregation. Review results on the Aggregated Resources page.
C. Create an AWS Lambda function in the organization's management account to configure resources. Configure the Lambda function with cross-account access. Run the function when a new account is detected.
D. Create the configuration in an AWS CloudFormation template. Deploy the template to all accounts in the organization by using an AWS Lambda function that runs when a new account is detected.
Show Answer
Correct Answer: A
Explanation: CloudFormation StackSets with automatic deployments can apply a template to accounts as they are added to the targeted organizational unit, providing centralized rollout with minimal ongoing operational work. AWS Config aggregation only collects configuration data; the Lambda-based options require custom automation to detect and configure new accounts.
Question 28
A company uses a custom Amazon Machine Image (AMI) as part of an EC2 Image Builder pipeline. A CloudOps engineer notices that the custom AMI will reach the end of its support lifespan in few months. The CloudOps engineer needs to update the EC2 Image Builder pipeline to use the latest AMI ID.
Which solution will meet this requirement?
A. Create a new version of the existing EC2 Image Builder recipe. Update the AMI ID details. Update the pipeline to use the new recipe version.
B. Disable the AMI in the lifecycle rules for the existing AMI. Update the existing EC2 Image Builder recipe with the latest AMI ID details. Rerun the pipeline.
C. Update the build component to use the latest AMI ID details.
D. Replace the AMI ID in the launch template for the pipeline.
Show Answer
Correct Answer: A
Explanation: EC2 Image Builder image recipe versions are immutable. To change the base AMI, you must create a new version of the image recipe with the updated parent AMI ID, then update the image pipeline to reference that new recipe version. Build components do not define the base AMI, launch templates are not used to select the recipe's parent image, and an existing recipe version cannot be edited.
Question 28
A company has a large on-premises tape backup solution. The company has started to use AWS Storage Gateway. The company created a Tape Gateway to replace the existing on-premises hardware. The company's backup engineer noticed that some of the backup jobs that were supposed to write to AWS failed to run because of a "Not Enough Space" error.
The company does not want these failures to happen again. The company also wants to consistently have enough tape available on AWS.
What is the MOST operationally efficient way for a CloudOps engineer to meet these requirements?
A. Create an AWS Lambda function that runs on an hourly basis and checks how many tapes have available space. If the available tapes are below a certain threshold, provision more.
B. Install the Amazon CloudWatch agent on the on-premises system. Push the log files to a CloudWatch log group. Create an AWS Lambda function that creates more tapes when the "Not Enough Space" error appears. Create a metric filter and a metric alarm that launches the Lambda function.
C. Create an additional Tape Gateway with its own set of tapes. Configure Amazon SNS to send a notification to the backup engineer if the tapes that are associated with the primary Tape Gateway do not have available space.
D. Configure tape auto-create on the Tape Gateway. In the auto-create settings, configure a minimum number of tapes, an appropriate barcode prefix, and a tape pool.
Show Answer
Correct Answer: D
Explanation: Configure tape auto-create on the Tape Gateway with a minimum number of tapes, barcode prefix, and tape pool. The gateway will automatically create tapes to maintain the configured supply, preventing backup jobs from failing when existing tapes run out of space. This avoids the ongoing monitoring and custom automation required by the other options.
Question 29
A company has many accounts in an organization in AWS Organizations. The company must automate resource provisioning from the organization's management account to the member accounts.
Which solution will meet this requirement?
A. Create an AWS CloudFormation change set. Deploy the change set to all member accounts.
B. Create an AWS CloudFormation nested stack. Deploy the nested stack to all member accounts.
C. Create an AWS CloudFormation stack set. Deploy the stack set to all member accounts.
D. Create an AWS SAM template. Deploy the template to all member accounts.
Show Answer
Correct Answer: C
Explanation: AWS CloudFormation StackSets are designed to deploy, manage, and update CloudFormation stacks across multiple AWS accounts and Regions from a central administrator account. StackSets integrate with AWS Organizations, enabling deployment to member accounts or organizational units. Change sets are for previewing changes to a single stack, nested stacks modularize templates within one stack, and AWS SAM is for serverless application templates rather than multi-account provisioning.
Question 29
A company runs a non-production application on an Amazon EC2 instance. The application logs all error messages to a log file on the local file system. All entries that are written to the log file start with the word "error."
A CloudOps engineer must implement a solution that gives the company the ability to search for all occurrences of the error during the previous year.
Which solution will meet this requirement?
A. Install the Amazon CloudWatch agent on the EC2 instance. Configure the agent to send logs to an Amazon CloudWatch Logs log group. Create a metric filter on the log group for all messages that include the word "error."
B. Install the Amazon CloudWatch agent on the EC2 instance. Configure the agent to send an Amazon SNS message to an Amazon CloudWatch Logs log group. Create a metric filter on the log group for all messages that include the word "error."
C. Configure the log file to post all messages to an Amazon SQS queue. Create an AWS Lambda function. Configure the Lambda function to determine whether the messages include the word "error."
D. Configure the log file to send all messages to an Amazon S3 bucket. Create an event notification on the S3 bucket to publish the contents of the messages to an Amazon SQS queue.
Show Answer
Correct Answer: A
Explanation: The CloudWatch agent can collect the EC2 log file and send it to CloudWatch Logs, where the log data can be retained for a year and searched for entries containing “error.” A metric filter can identify matching entries and produce a metric. The other options do not provide an appropriate way to collect and search the log contents.
Question 30
A company has a software as a service (SaaS) application. The company has integrated the application with AWS services by using the AWS SDK and an IAM user's access key ID and secret access key.
The company needs to implement the principle of least privilege for the IAM user. The company must avoid the usage of permanent credentials.
Which solution will meet these requirements?
A. Migrate the application to use the AWS STS AssumeRoleWithSAML API operation.
B. Migrate the application to use the AWS STS AssumeRole API operation. Allow the IAM user to call only AWS STS.
C. Add a policy to the existing IAM user to scope the permissions to only the permissions that the user needs for the application.
D. Add an IAM group to scope the permissions to only the permissions that the user needs for the application. Add the IAM user to the IAM group.
Show Answer
Correct Answer: B
Explanation: Using AWS STS AssumeRole allows the application to exchange limited IAM user credentials for temporary credentials associated with an IAM role. Restricting the IAM user so it can only call STS avoids granting direct service permissions to the long-term credentials, and the role enforces least-privilege access. AssumeRoleWithSAML is for SAML federation, while simply scoping IAM user or group permissions still relies on permanent access keys.
Question 30
A company has created a new video-on-demand (VOD) application. The application runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The company configured an Amazon CloudFront distribution and set the ALB as the origin. Because of increasing application demand, the company wants to move all video files to a central Amazon S3 bucket.
A CloudOps engineer needs to ensure that video files can be cached at edge locations after the company migrates the files to Amazon S3.
Which solution will meet this requirement?
A. Configure CloudFront to send the X-Forwarded-For header to the origin and to redirect video requests to Amazon S3 instead of the ALB.
B. Configure a new CloudFront cache behavior to route to Amazon S3 as a new origin, based on matching an URL path pattern.
C. Configure URL signing in the CloudFront distribution by using a custom policy. Ensure that video files are accessed through signed URLs only.
D. Configure a CloudFront origin group. Specify the required HTTP status codes to direct connection attempts to a secondary origin.
Show Answer
Correct Answer: B
Explanation: Add the S3 bucket as a separate CloudFront origin, then create a cache behavior with a path pattern matching video-file requests and route that behavior to the S3 origin. CloudFront will fetch the files from S3 and cache them at edge locations.
Question 31
A CloudOps engineer is working on cost savings for a company. The CloudOps engineer notices multiple unused Elastic IP addresses. The addresses are spread across different accounts and AWS Regions in an organization in AWS Organizations.
The CloudOps engineer must administer and track the addresses based on security domains. The CloudOps engineer must be able to view the history of assigned addresses.
Which solution will meet these requirements?
A. Enable AWS Config with an IP address tracking rule.
B. Use Amazon CloudWatch with custom IP metrics to view addresses by account and Region.
C. Enable Amazon VPC IP Address Manager for Organizations integrations.
D. In AWS Systems Manager Inventory, enable a resource data sync to Amazon S3 for IP tracking.
Show Answer
Correct Answer: C
Explanation: Amazon VPC IP Address Manager (IPAM) with AWS Organizations integration provides centralized management of IP addresses, including public IPv4 addresses such as Elastic IPs, across multiple AWS accounts and Regions. IPAM supports organizing addresses by business or security domains using scopes and pools, identifies unused Elastic IP addresses, and maintains historical IP address assignment information. The other options do not provide centralized cross-account IP address administration with history tracking.
Question 31
A company's ecommerce application is running on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. Customers report that the website is occasionally down. When the website is down, the website returns an HTTP 500 (server error) status message to customer browsers.
The Auto Scaling group's health check is configured for EC2 status checks, and the instances are healthy.
Which solution will resolve the problem?
A. Replace the ALB with a Network Load Balancer.
B. Add Elastic Load Balancing (ELB) health checks to the Auto Scaling group.
C. Update the target group configuration on the ALB. Enable session affinity (sticky sessions).
D. Install the Amazon CloudWatch agent on all the instances. Configure the agent to reboot the instances.
Show Answer
Correct Answer: B
Explanation: EC2 status checks only confirm that the instances and underlying infrastructure are functioning; they do not detect application-level failures. Configure the Auto Scaling group to use ELB health checks so it can identify instances that the ALB marks unhealthy and replace them.
Question 32
A company recently purchased Savings Plans. The company wants to receive email notification when the company's utilization drops below 90% for a given day.
Which solution will meet this requirement?
A. Create an Amazon CloudWatch alarm to monitor the Savings Plan check in AWS Trusted Advisor. Configure an Amazon SQS queue for email notification when the utilization drops below 90% for a given day.
B. Create an Amazon CloudWatch alarm to monitor the SavingsPlansUtilization metric under the AWS/SavingsPlans namespace in CloudWatch. Configure an Amazon SQS queue for email notification when the utilization drops below 90% for a given day.
C. Create a Savings Plans alert to monitor the daily utilization of the Savings Plans. Configure an Amazon SNS topic for email notification when the utilization drops below 90% for a given day.
D. Use AWS Budgets to create a Savings Plans budget to track the daily utilization of the Savings Plans. Configure an Amazon SNS topic for email notification when the utilization drops below 90% for a given day.
Show Answer
Correct Answer: D
Explanation: AWS Budgets supports Savings Plans utilization budgets with daily tracking and threshold notifications. Configure the budget to alert when utilization falls below 90%, and use an Amazon SNS topic to deliver the email notification.
$19
Get all 194 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.