السؤال #1

A large enterprise is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon RDS for Oracle DB instance and Amazon DynamoDB. There are separate environments tor development testing and production. What is the MOST secure and flexible way to obtain password credentials during deployment?

A. Retrieve an access key from an AWS Systems Manager securestring parameter to access AWS services

B. Launch the EC2 instances with an EC2 1AM role to access AWS services Retrieve the database credentials from AWS Secrets Manager

C. Retrieve an access key from an AWS Systems Manager plaintext parameter to access AWS services

D. Launch the EC2 instances with an EC2 1AM role to access AWS services Store the database passwords in an encrypted config file with the application artifacts

عرض الإجابة

اجابة صحيحة: A

السؤال #2

A company uses AWS CodeArtifact to centrally store Python packages. The CodeArtifact repository is configured with the following repository policy. A development team is building a new project in an account that is in an organization in AWS Organizations. The development team wants to use a Python library that has already been stored in the CodeArtifact repository in the organization. The development team uses AWS CodePipeline and AWS CodeBuild to build the new application. The CodeBuild job that the develo

A. Create an Amazon S3 gateway endpoint Update the route tables for the subnets that are running the CodeBuild job

B. Update the repository policy's Principal statement to include the ARN of the role that the CodeBuild project uses

C. Share the CodeArtifact repository with the organization by using AWS Resource Access Manager (AWS RAM)

D. Update the role that the CodeBuild project uses so that the role has sufficient permissions to use the CodeArtifact repository

E. Specify the account that hosts the repository as the delegated administrator for CodeArtifact in the organization

عرض الإجابة

اجابة صحيحة: C

السؤال #3

A company has 20 service learns Each service team is responsible for its own microservice. Each service team uses a separate AWS account for its microservice and a VPC with the 192 168 0 0/22 CIDR block. The company manages the AWS accounts with AWS Organizations. Each service team hosts its microservice on multiple Amazon EC2 instances behind an Application Load Balancer. The microservices communicate with each other across the public internet. The company's security team has issued a new guideline that al

A. Create a new AWS account in AWS Organizations Create a VPC in this account and use AWS Resource Access Manager to share the private subnets of this VPC with the organization Instruct the service teams to launch a ne

B. Network Load Balancer (NLB) and EC2 instances that use the shared private subnets Use the NLB DNS names for communication between microservices

C. Create a Network Load Balancer (NLB) in each of the microservice VPCs Use AWS PrivateLink to create VPC endpoints in each AWS account for the NLBs Create subscriptions to each VPC endpoint in each of the other AWS accounts Use the VPC endpoint DNS names for communication between microservices

D. Create a Network Load Balancer (NLB) in each of the microservice VPCs Create VPC peering connections between each of the microservice VPCs Update the route tables for each VPC to use the peering links Use the NLB DNS names for communication between microservices

E. Create a new AWS account in AWS Organizations Create a transit gateway in this account and use AWS Resource Access Manager to share the transit gateway with the organizatio

F. In each of the microservice VPC G

عرض الإجابة

اجابة صحيحة: C

السؤال #4

A company has an on-premises application that is written in Go. A DevOps engineer must move the application to AWS. The company's development team wants to enable blue/green deployments and perform A/B testing. Which solution will meet these requirements?

A. Deploy the application on an Amazon EC2 instance, and create an AMI of the instanc

B. Use the AMI to create an automatic scaling launch configuration that is used in an Auto Scaling grou

C. Use Elastic Load Balancing to distribute traffi

D. When changes are made to the application, a new AMI will be created, which will initiate an EC2 instance refresh

E. Use Amazon Lightsail to deploy the applicatio

F. Store the application in a zipped format in an Amazon S3 bucke G

عرض الإجابة

اجابة صحيحة: B

السؤال #5

A company has developed an AWS Lambda function that handles orders received through an API. The company is using AWS CodeDeploy to deploy the Lambda function as the final stage of a CI/CD pipeline. A DevOps engineer has noticed there are intermittent failures of the ordering API for a few seconds after deployment. After some investigation the DevOps engineer believes the failures are due to database changes not having fully propagated before the Lambda function is invoked How should the DevOps engineer over

A. Add a BeforeAllowTraffic hook to the AppSpec file that tests and waits for any necessary database changes before traffic can flow to the new version of the Lambda function

B. Add an AfterAlIowTraffic hook to the AppSpec file that forces traffic to wait for any pending database changes before allowing the new version of the Lambda function to respond

C. Add a BeforeAllowTraffic hook to the AppSpec file that tests and waits for any necessary database changes before deploying the new version of the Lambda function

D. Add a validateService hook to the AppSpec file that inspects incoming traffic and rejects the payload if dependent services such as the database are not yet ready

عرض الإجابة

اجابة صحيحة: D

السؤال #6

A company has multiple accounts in an organization in AWS Organizations. The company's SecOps team needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if any account in the organization turns off the Block Public Access feature on an Amazon S3 bucket. A DevOps engineer must implement this change without affecting the operation of any AWS accounts. The implementation must ensure that individual member accounts in the organization cannot turn off the notification. Which solution w

A. Designate an account to be the delegated Amazon GuardDuty administrator accoun

B. Turn on GuardDuty for all accounts across the organizatio

C. In the GuardDuty administrator account, create an SNS topi

D. Subscribe the SecOps team's email address to the SNS topi

E. In the same account, create an Amazon EventBridge rule that uses an event pattern for GuardDuty findings and a target of the SNS topic

F. Create an AWS CloudFormation template that creates an SNS topic and subscribes the SecOps team’s email address to the SNS topi G

عرض الإجابة

اجابة صحيحة: AD

السؤال #7

A company wants to ensure that their EC2 instances are secure. They want to be notified if any new vulnerabilities are discovered on their instances and they also want an audit trail of all login activities on the instances. Which solution will meet these requirements'?

A. Use AWS Systems Manager to detect vulnerabilities on the EC2 instances Install the Amazon Kinesis Agent to capture system logs and deliver them to Amazon S3

B. Use AWS Systems Manager to detect vulnerabilities on the EC2 instances Install the Systems Manager Agent to capture system logs and view login activity in the CloudTrail console

C. Configure Amazon CloudWatch to detect vulnerabilities on the EC2 instances Install the AWS Config daemon to capture system logs and view them in the AWS Config console

D. Configure Amazon Inspector to detect vulnerabilities on the EC2 instances Install the Amazon CloudWatch Agent to capture system logs and record them via Amazon CloudWatch Logs

عرض الإجابة

اجابة صحيحة: BD

السؤال #8

An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). A DevOps engineer is using AWS CodeDeploy to release a new version. The deployment fails during the AlIowTraffic lifecycle event, but a cause for the failure is not indicated in the deployment logs. What would cause this?

A. The appspe

B. yml file contains an invalid script that runs in the AllowTraffic lifecycle hook

C. The user who initiated the deployment does not have the necessary permissions to interact with the ALB

D. The health checks specified for the ALB target group are misconfigured

E. The CodeDeploy agent was not installed in the EC2 instances that are pad of the ALB target group

عرض الإجابة

اجابة صحيحة: D

السؤال #9

A development team wants to use AWS CloudFormation stacks to deploy an application. However, the developer IAM role does not have the required permissions to provision the resources that are specified in the AWS CloudFormation template. A DevOps engineer needs to implement a solution that allows the developers to deploy the stacks. The solution must follow the principle of least privilege. Which solution will meet these requirements?

A. Create an IAM policy that allows the developers to provision the required resource

B. Attach the policy to the developer IAM role

C. Create an IAM policy that allows full access to AWS CloudFormatio

D. Attach the policy to the developer IAM role

E. Create an AWS CloudFormation service role that has the required permission

F. Grant the developer IAM role a cloudformation:* actio G

عرض الإجابة

اجابة صحيحة: D

السؤال #10

A company has migrated its container-based applications to Amazon EKS and want to establish automated email notifications. The notifications sent to each email address are for specific activities related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate incoming log events and publish messages to the correct SNS topic. Which logging solution will support these requirements?

A. Enable Amazon CloudWatch Logs to log the EKS component

B. Create a CloudWatch subscription filter for each component with Lambda as the subscription feed destination

C. Enable Amazon CloudWatch Logs to log the EKS component

D. Create CloudWatch Logs Insights queries linked to Amazon EventBridge events that invoke Lambda

E. Enable Amazon S3 logging for the EKS component

F. Configure an Amazon CloudWatch subscription filter for each component with Lambda as the subscription feed destination

عرض الإجابة

اجابة صحيحة: B

السؤال #11

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account. The company has created an AWS Key Management Service (AWS KMS) key in the source account. Which additional steps should the DevOps engineer pe

A. In the source account, copy the unencrypted AMI to an encrypted AM

B. Specify the KMS key in the copy action

C. In the source account, copy the unencrypted AMI to an encrypted AM

D. Specify the default Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action

E. In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account

F. In the source account, modify the key policy to give the target account permissions to create a gran G

عرض الإجابة

اجابة صحيحة: AD

السؤال #12

A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as non-compliant. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is always present. Which solution will accomplish this?

A. Create an AWS CloudFormation template that defines an AWS Inspector rule to check whether EBS encryption is enable

B. Save the template to an Amazon S3 bucket that has been shared with all accounts within the compan

C. Update the account creation script pointing to the CloudFormation template in Amazon S3

D. Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CL

E. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization

F. Create an SCP in Organization G

عرض الإجابة

اجابة صحيحة: ADF

السؤال #13

A company has enabled all features for its organization in AWS Organizations. The organization contains 10 AWS accounts. The company has turned on AWS CloudTrail in all the accounts. The company expects the number of AWS accounts in the organization to increase to 500 during the next year. The company plans to use multiple OUs for these accounts. The company has enabled AWS Config in each existing AWS account in the organization. A DevOps engineer must implement a solution that enables AWS Config automatica

A. In the organization's management account, create an Amazon EventBridge rule that reacts to a CreateAccount API cal

B. Configure the rule to invoke an AWS Lambda function that enables trusted access to AWS Config for the organization

C. In the organization's management account, create an AWS CloudFormation stack set to enable AWS Confi

D. Configure the stack set to deploy automatically when an account is created through Organizations

E. In the organization's management account, create an SCP that allows the appropriate AWS Config API calls to enable AWS Confi

F. Apply the SCP to the root-level OU

عرض الإجابة

اجابة صحيحة: A

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان

عرض الإجابات بعد التقديم

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع! احصل الان

عرض الإجابات بعد التقديم

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان