DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

Free AWS DOP-C02 Practice Questions & Answers 2026 Part1

Are you preparing for the AWS DOP-C02 certification exam? SPOTO offers the AWS DOP-C02 Premium File; all questions are aligned with the latest exam content and come with expert-provided answers. Our question banks cover the latest question types, core concepts, and detailed explanations, helping you familiarize yourself with the exam format and difficulty level. Whether you are reviewing core concepts or simulating a real exam environment, these resources will rapidly boost your confidence and readiness.
For over two decades, SPOTO has successfully helped numerous IT professionals secure their ideal positions at Fortune 500 companies. Download now to start practicing efficiently and ensure a high score on the actual exam. Don't miss this opportunity to pass your certification exam with ease!
Take other online exams
Question #1
A company is using AWS CodeBuild to build an application. Company policy requires all build artifacts to be encrypted at rest. The company must limit access to the artifacts to IAM users in an operations IAM group that have permission to assume an operations IAM role.Which solution will meet these requirements?
A. Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket
B. Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket
C. Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket that has S3 default encryption enabled
D. Add a post-build command to the CodeBuild build specification to call the AWS Key Management Service (AWS KMS) Encrypt API operation and pass the artifact to AWS KMS for encryption with a specified KMS key
View answer
Correct Answer: c

View The Updated DOP-C02 Exam Questions

SPOTO Provides 100% Real DOP-C02 Exam Questions for You to Pass Your DOP-C02 Exam!

Contact Us Get DOP-C02 Practice Test
Question #2
A DevOps team has an application that stores critical company assets in an existing Amazon S3 bucket. The team uses a single AWS Region. A new company policy requires the team to deploy the application to multiple Regions. The assets must always be accessible. Users must use the same endpoint to access the assets.Which combination of steps should the team take to meet these requirements in the MOST operationally efficient way?(Select THREE.)
A. Use AWS CloudFormation StackSets to create a new S3 bucket that has versioning enabled in each required Region
B. Use AWS CloudFormation StackSets to create a new S3 bucket that has versioning enabled in each required Region
C. Create an Amazon CloudFront distribution
D. Create an Amazon CloudFront distribution
E. Create an Amazon Route 53 alias record
F. Create an Amazon Route 53 alias record
View answer
Correct Answer: bcf
Question #3
A company uses Amazon Elastic Container Service (Amazon ECS) with an Amazon EC2 launch type. The company requires all log data to be centralized on Amazon CloudWatch. The company ' s ECS tasks include a LogConfiguration object that specifies a value of awslogs for the log driver name.The company ' s ECS tasks failed to deploy. An error message indicates that a missing permission causes the failure. The company confirmed that the IAM role used to launch container instances includes the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions.Which solution will fix the problem?
A. emove the logs:CreateLogStream permission from the policy applied to the IAM role
B. dd an IAM trust policy to the IAM role that establishes Amazon ECS as a trusted service
C. dd the logs:PutDestination permission to the policy applied to the IAM role
D. dd an IAM trust policy to the IAM role that establishes CloudWatch as a trusted service
View answer
Correct Answer: B
Question #4
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?
A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule
B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule
C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule
D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256
View answer
Correct Answer: D
Question #5
A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?
A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only
B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access
C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"
D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only
View answer
Correct Answer: D
Question #6
A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?
A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair
B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group
C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair
D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair
View answer
Correct Answer: C
Question #7
A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?
A. Failed deploy and build actions across all the pipelines
B. All rejected or failed approval actions across all the pipelines
C. All the events across all pipelines
D. Approval actions across all the pipelines
View answer
Correct Answer: B
Question #8
A company hosts its staging website using an Amazon EC2 instance backed with Amazon EBS storage. The company wants to recover quickly with minimal data losses in the event of network connectivity issues or power failures on the EC2 instance.Which solution will meet these requirements?
A. Add the instance to an EC2 Auto Scaling group with the minimum, maximum, and desired capacity set to 1
B. Add the instance to an EC2 Auto Scaling group with a lifecycle hook to detach the EBS volume when the EC2 instance shuts down or terminates
C. Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric and select the EC2 action to recover the instance
D. Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric and select the EC2 action to reboot the instance
View answer
Correct Answer: C
Question #9
A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?
A. Enable Amazon CodeGuru Profiler
B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
C. Enable Amazon CodeGuru Profiler
D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
View answer
Correct Answer: B
Question #10
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?
A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule
B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule
C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule
D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256
View answer
Correct Answer: D
Question #11
A DevOps engineer needs to apply a core set of security controls to an existing set of AWS accounts. The accounts are in an organization in AWS Organizations. Individual teams will administer individual accounts by using the AdministratorAccess AWS managed policy. For all accounts. AWS CloudTrail and AWS Config must be turned on in all available AWS Regions. Individual account administrators must not be able to edit or delete any of the baseline resources. However, individual account administrators must be able to edit or delete theirown CloudTrail trails and AWS Config rules.Which solution will meet these requirements in the MOST operationally efficient way?
A. Create an AWS CloudFormation template that defines the standard account resources
B. Enable AWS Control Tower
C. Designate an AWS Config management account
D. Create an AWS CloudFormation template that defines the standard account resources
View answer
Correct Answer: D
Question #12
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?
A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule
B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule
C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule
D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256
View answer
Correct Answer: D
Question #13
A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. New EC2 instances are launched and terminated each hour in the account. The account also includes existing EC2 instances that have been running for longer than a week.The company's security policy requires all running EC2 instances to use an EC2 instance profile. If an EC2 instance does not have an instance profile attached, the EC2 instance must use a default instance profile that has no IAM permissions assigned.A DevOps engineer reviews the account and discovers EC2 instances that are running without an instance profile. During the review, the DevOps engineer also observes that new EC2 instances are being launched without an instance profile.Which solution will ensure that an instance profile is attached to all existing and future EC2 instances in the Region?
A. Configure an Amazon EventBridge rule that reacts to EC2 RunInstances API calls
B. Configure the ec2-instance-profile-attached AWS Config managed rule with a trigger type of configuration changes
C. Configure an Amazon EventBridge rule that reacts to EC2 StartInstances API calls
D. Configure the iam-role-managed-policy-check AWS Config managed rule with a trigger type of configuration changes
View answer
Correct Answer: B
Question #14
A company uses AWS Storage Gateway in file gateway mode in front of an Amazon S3 bucket that is used by multiple resources. In the morning when business begins, users do not see the objects processed by a third party the previous evening. When a DevOps engineer looks directly at the S3 bucket, the data is there, but it is missing in Storage Gateway.Which solution ensures that all the updated third-party files are available in the morning?
A. onfigure a nightly Amazon EventBridge event to invoke an AWS Lambda function to run the RefreshCache command for Storage Gateway
B. nstruct the third party to put data into the S3 bucket using AWS Transfer for SFTP
C. odify Storage Gateway to run in volume gateway mode
D. se S3 Same-Region Replication to replicate any changes made directly in the S3 bucket to Storage Gateway
View answer
Correct Answer: A
Question #15
A company runs an application on one Amazon EC2 instance. Application metadata is stored in Amazon S3 and must be retrieved if the instance is restarted. The instance must restart or relaunch automatically if the instance becomes unresponsive.Which solution will meet these requirements?
A. Create an Amazon CloudWatch alarm for the StatusCheckFailed metric
B. Configure AWS OpsWorks, and use the auto healing feature to stop and start the instance
C. Use EC2 Auto Recovery to automatically stop and start the instance in case of a failure
D. Use AWS CloudFormation to create an EC2 instance that includes the UserData property for the EC2 resource
View answer
Correct Answer: B
Question #16
A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function. On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long cold-start times of 8-10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured.Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total.A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day.Which solution will meet these requirements?
A. Configure provisioned concurrency on the Lambda function with a concurrency value of 1
B. Configure reserved concurrency on the Lambda function with a concurrency value of 0
C. Configure provisioned concurrency on the Lambda function
D. Configure reserved concurrency on the Lambda function
View answer
Correct Answer: C
Question #17
A company uses AWS Systems Manager to manage a fleet of Amazon Linux EC2 instances that have SSM Agent installed. All EC2 instances are configured to use Instance Metadata Service Version 2 (IMDSv2) and are running in the same AWS account and AWS Region. Company policy requires developers to use only Amazon Linux.The company wants to ensure that all new EC2 instances are automatically managed by Systems Manager after creation.Which solution will meet these requirements with the MOST operational efficiency?
A. nsure that AWS Config is set up
B. reate an EC2 instance role that has a trust policy that allows Amazon EC2 to assume the role
C. reate an IAM role that has a trust policy that allows Systems Manager to assume the role
D. onfigure Systems Manager Patch Manager
View answer
Correct Answer: C
Question #18
A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?
A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3
B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs
C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place
D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3
View answer
Correct Answer: D
Question #19
A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?
A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair
B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group
C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair
D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair
View answer
Correct Answer: C
Question #20
A development team uses AWS CodeCommit, AWS CodePipeline, and AWS CodeBuild to develop and deploy an application. Changes to the code are submitted by pull requests. The development team reviews and merges the pull requests, and then the pipeline builds and tests the application.Over time, the number of pull requests has increased. The pipeline is frequently blocked because of failing tests. To prevent this blockage, the development team wants to run the unit and integration tests on each pull request before it is merged.Which solution will meet these requirements?
A. Create a CodeBuild project to run the unit and integration tests
B. Create an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit Create a CodeBuild project to run the unit and integration tests
C. Create an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit
D. Create a CodeBuild project to run the unit and integration tests
View answer
Correct Answer: B
Question #21
A company has an application that runs on a fleet of Amazon EC2 instances. The application requires frequent restarts. The application logs contain error messages when a restart is required. The application logs are published to a log group in Amazon CloudWatch Logs.An Amazon CloudWatch alarm notifies an application engineer through an Amazon Simple Notification Service (Amazon SNS) topic when the logs contain a large number of restart-related error messages. The applicationengineer manually restarts the application on the instances after the application engineer receives a notification from the SNS topic.A DevOps engineer needs to implement a solution to automate the application restart on the instances without restarting the instances.Which solution will meet these requirements in the MOST operationally efficient manner?
A. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances
B. Create an AWS Lambda function that restarts the application on the instances
C. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances
D. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances
View answer
Correct Answer: D
Question #22
You have a playbook that includes a task to install a package for a service, put a configuration file for that package on the system and restart the service. The playbook is then run twice in a row. What would you expect Ansible to do on the second run?
A. Remove the old package and config file and reinstall and then restart the service
B. Take no action on the target host
C. Check if the package is installed, check if the file matches the source file, if not reinstall it; restart the service
D. Attempt to reinstall the package, copy the file and restart the service
View answer
Correct Answer: C
Question #23
A company wants to migrate its content sharing web application hosted on Amazon EC2 to a serverless architecture. The company currently deploys changes to its application by creating a new Auto Scaling group of EC2 instances and a new Elastic Load Balancer, and then shifting the traffic away using an Amazon Route 53 weighted routing policy.For its new serverless application, the company is planning to use Amazon API Gateway and AWS Lambda. The company will need to update its deployment processes to work with the new application. It will also need to retain the ability to test new features on a small number of users before rolling the features out to the entire user base.Which deployment strategy will meet these requirements?
A. Use AWS CDK to deploy API Gateway and Lambda functions
B. Use AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions
C. Use AWS Elastic Beanstalk to deploy API Gateway and Lambda functions
D. Use AWS OpsWorks to deploy API Gateway in the service layer and Lambda functions in a custom layer
View answer
Correct Answer: B
Question #24
A DevOps engineer is building a multistage pipeline with AWS CodePipeline to build, verify, stage, test, and deploy an application. A manual approval stage is required between the test stage and the deploy stage. The development team uses a custom chat tool with webhook support that requires near-real-time notifications.How should the DevOps engineer configure status updates for pipeline activity and approval requests to post to the chat tool?
A. reate an Amazon CloudWatch Logs subscription that filters on CodePipeline Pipeline Execution State Change
B. reate an AWS Lambda function that is invoked by AWS CloudTrail events
C. reate an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Change
D. odify the pipeline code to send the event details to the chat webhook URL at the end of each stage
View answer
Correct Answer: C
Question #25
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?
A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule
B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule
C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule
D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256
View answer
Correct Answer: D
Question #26
A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?
A. Auto Scaling groups can create new instances in a single AZ only
B. The EC2 instances have not been manually associated to the AL
C. The ALB should be replaced with a Network Load Balancer (NLB)
D. The new AZ has not been added to the ALB
View answer
Correct Answer: D
Question #27
A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?
A. Auto Scaling groups can create new instances in a single AZ only
B. The EC2 instances have not been manually associated to the AL
C. The ALB should be replaced with a Network Load Balancer (NLB)
D. The new AZ has not been added to the ALB
View answer
Correct Answer: D
Question #28
A company runs an application on Amazon EC2 instances. The company uses a series of AWS CloudFormation stacks to define the application resources. A developer performs updates by building and testing the application on a laptop and then uploading the build output and CloudFormation stack templates to Amazon S3. The developer's peers review the changes before the developer performs the CloudFormation stack update and installs a new version of the application onto the EC2 instances.The deployment process is prone to errors and is time-consuming when the developer updates each EC2 instance with the new application. The company wants to automate as much of the application deployment process as possible while retaining a final manual approval step before the modification of the application or resources.The company already has moved the source code for the application and the CloudFormation templates to AWS CodeCommit. The company also has created an AWS CodeBuild project to build and test the application.Which combination of steps will meet the company's requirements? (Choose two.)
A. Create an application group and a deployment group in AWS CodeDeploy
B. Create an application revision and a deployment group in AWS CodeDeploy
C. Use AWS CodePipeline to invoke the CodeBuild job, run the CloudFormation update, and pause for a manual approval step
D. Use AWS CodePipeline to invoke the CodeBuild job, create CloudFormation change sets for each of the application stacks, and pause for a manual approval step
E. Use AWS CodePipeline to invoke the CodeBuild job, create CloudFormation change sets for each of the application stacks, and pause for a manual approval step
View answer
Correct Answer: AD
Question #29
A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health.The DevOps engineer must implement an automated solution that uses Amazon EventBridge to remediate the notifications during the company's scheduled maintenance windows.How should the DevOps engineer configure an EventBridge rule to meet these requirements?
A. Configure an event source of AWS Health
B. Configure an event source of Systems Manager
C. Configure an event source of AWS Health
D. Configure an event source of EC2
View answer
Correct Answer: A
Question #30
A company runs a microservices application on Amazon EKS. Users report delays accessing an account summary feature during peak hours. CloudWatch metrics and logs show normal CPU and memory utilization on EKS nodes. The DevOps engineer cannot identify where delays occur within the microservices.
A. Deploy the AWS X-Ray daemon as a DaemonSet in the EKS cluster
B. Enable CloudWatch Container Insights for the EKS cluster
C. Create alarms based on existing CloudWatch metrics
D. Increase the timeout settings in the application code for network operations
View answer
Correct Answer: A
Question #31
A company hosts a security auditing application in an AWS account. The auditing application uses an IAM role to access other AWS accounts. All the accounts are in the same organization in AWS Organizations.A recent security audit revealed that users in the audited AWS accounts could modify or delete the auditing application's IAM role. The company needs to prevent any modification to the auditing application's IAM role by any entity other than a trusted administrator IAM role.Which solution will meet these requirements?
A. Create an SCP that includes a Deny statement for changes to the auditing application's IAM role
B. Create an SCP that includes an Allow statement for changes to the auditing application's IAM role by the trusted administrator IAM role
C. Create an IAM permissions boundary that includes a Deny statement for changes to the auditing application's IAM role
D. Create an IAM permissions boundary that includes a Deny statement for changes to the auditing application's IAM role
View answer
Correct Answer: A
Question #32
A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?
A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state
B. Increase the maximum instance count of the Auto Scaling group
C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state
D. Increase the maximum instance count of the Auto Scaling group
View answer
Correct Answer: A
Question #33
A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines.The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)
A. reate a new version of the common AMI with the CodeDeploy agent installed
B. reate a new version of the common AMI with the CodeDeploy agent installed
C. reate an application in CodeDeploy
D. reate an application in CodeDeploy
E. reate an application in CodeDeploy
View answer
Correct Answer: AD
Question #34
A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?
A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour
B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one
C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration
D. Use AWS Elastic Beanstalk with the con guration set to Immutable
View answer
Correct Answer: D
Question #35
A company has a web application that runs on AWS. The web tier uses an Amazon Elastic Container Service (Amazon ECS) deployment with the Fargate launch type behind an Application Load Balancer (ALB) and Amazon Route 53. The application uses an Amazon Keyspaces (for Apache Cassandra) database. The company stores container images in Amazon Elastic Container Registry (Amazon ECR). New image versions are pushed regularly.The company needs to implement a multi-Region recovery strategy with automatic failover to a secondary Region.Which solution will meet these requirements?
A. onfigure Amazon ECR private image replication to a new ECR private registry in the secondary Region
B. opy the current Amazon ECR private images to a new ECR private registry in the secondary Region
C. onfigure Amazon ECR private image replication to a new ECR private registry in the secondary Region
D. onfigure Amazon ECR private image replication to a new ECR private registry in the secondary Region
View answer
Correct Answer: A
Question #36
A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?
A. Enable Amazon CodeGuru Profiler
B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
C. Enable Amazon CodeGuru Profiler
D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
View answer
Correct Answer: B
Question #37
A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back.Which strategy will meet these requirements?
A. Add a stage to the CodePipeline pipeline between the source and deploy stages
B. Add a stage to the CodePipeline pipeline between the source and deploy stages
C. Add a hooks section to the CodeDeploy AppSpec file
D. Add a hooks section to the CodeDeploy AppSpec file
View answer
Correct Answer: C
Question #38
A company runs an application with an Amazon EC2 and on-premises con guration. A DevOps Engineer needs to standardize patching across both environments. Company policy dictates that patching only happens during non-business hours.Which combination of actions will meet these requirements? (Choose three.)
A. Add the physical machines into AWS Systems Manager using Systems Manager Hybrid Activations
B. Attach an IAM role to the EC2 instances, allowing them to be managed by AWS Systems Manager
C. Create IAM access keys for the on-premises machines to interact with AWS Systems Manager
D. Execute an AWS Systems Manager Automation document to patch the systems every hour
E. Use Amazon CloudWatch Events scheduled events to schedule a patch window
F. Use AWS Systems Manager Maintenance Windows to schedule a patch window
View answer
Correct Answer: ABF
Question #39
A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?
A. Enable Amazon CodeGuru Profiler
B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
C. Enable Amazon CodeGuru Profiler
D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
View answer
Correct Answer: B
Question #40
A company runs an application with an Amazon EC2 and on-premises configuration. A DevOps engineer needs to standardize patching across both environments. Company policy dictates that patching only happens during non-business hours.Which combination of actions will meet these requirements? (Choose three.)
A. Add the physical machines into AWS Systems Manager using Systems Manager Hybrid Activations
B. Attach an IAM role to the EC2 instances, allowing them to be managed by AWS Systems Manager
C. Create IAM access keys for the on-premises machines to interact with AWS Systems Manager
D. Run an AWS Systems Manager Automation document to patch the systems every hour
E. Use Amazon EventBridge scheduled events to schedule a patch window
F. Use AWS Systems Manager Maintenance Windows to schedule a patch window
View answer
Correct Answer: ABF
Question #41
A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization.Which combination of access changes will meet these requirements? (Choose three.)
A. Create a trust relationship that allows users in the member accounts to assume the management account IAM role
B. Create a trust relationship that allows users in the management account to assume the IAM roles of the member accounts
C. Create an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess managed policy
D. Create an IAM role in each member account to allow the sts:AssumeRole action against the management account IAM role's ARN
E. Create an IAM role in the management account that allows the sts:AssumeRole action against the member account IAM role's ARN
F. Create an IAM role in the management account that has access to the AmazonEC2ReadOnlyAccess managed policy
View answer
Correct Answer: BCE
Question #42
A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?
A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3
B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs
C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place
D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3
View answer
Correct Answer: D
Question #43
A company uses AWS Storage Gateway in file gateway mode in front of an Amazon S3 bucket that is used by multiple resources. In the morning when business begins, users do not see the objects processed by a third party the previous evening. When a DevOps engineer looks directly at the S3 bucket, the data is there, but it is missing in Storage Gateway.Which solution ensures that all the updated third-party files are available in the morning?
A. Configure a nightly Amazon EventBridge event to invoke an AWS Lambda function to run the RefreshCache command for Storage Gateway
B. Instruct the third party to put data into the S3 bucket using AWS Transfer for SFTP
C. Modify Storage Gateway to run in volume gateway mode
D. Use S3 Same-Region Replication to replicate any changes made directly in the S3 bucket to Storage Gateway
View answer
Correct Answer: A
Question #44
A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?
A. Enable Amazon CodeGuru Profiler
B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
C. Enable Amazon CodeGuru Profiler
D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
View answer
Correct Answer: B
Question #45
A company has an organization in AWS Organizations. The organization includes workload accounts that contain enterprise applications. The company centrally manages users from an operations account. No users can be created in the workload accounts. The company recently added an operations team and must provide the operations team members with administrator access to each workload account.Which combination of actions will provide this access? (Choose three.)
A. Create a SysAdmin role in the operations account
B. Create a SysAdmin role in each workload account
C. Create an Amazon Cognito identity pool in the operations account
D. In the operations account, create an IAM user for each operations team member
E. In the operations account, create an IAM user group that is named SysAdmins
F. Create an Amazon Cognito user pool in the operations account
View answer
Correct Answer: BDE
Question #46
A company has many applications. Different teams in the company developed the applications by using multiple languages and frameworks. The applications run on premises and on different servers with different operating systems. Each team has its own release protocol and process. The company wants to reduce the complexity of the release and maintenance of these applications. The company is migrating its technology stacks, including these applications, to AWS. The company wants centralized control of source code, a consistent and automatic delivery pipeline, and as few maintenance tasks as possible on the underlying infrastructure.What should a DevOps engineer do to meet these requirements?
A. Create one AWS CodeCommit repository for all applications
B. Create one AWS CodeCommit repository for each of the applications Use AWS CodeBuild to build the applications one at a time
C. Create one AWS CodeCommit repository for each of the applications
D. Create one AWS CodeCommit repository for each of the applications
View answer
Correct Answer: D
Question #47
A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?
A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3
B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs
C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place
D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3
View answer
Correct Answer: D
Question #48
A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?
A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state
B. Increase the maximum instance count of the Auto Scaling group
C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state
D. Increase the maximum instance count of the Auto Scaling group
View answer
Correct Answer: A
Question #49
A company has an application that runs on a fleet of Amazon EC2 instances. The application requires frequent restarts. The application logs contain error messages when a restart is required. The application logs are published to a log group in Amazon CloudWatch Logs.An Amazon CloudWatch alarm notifies an application engineer through an Amazon Simple Notification Service (Amazon SNS) topic when the logs contain a large number of restart-related error messages. The applicationengineer manually restarts the application on the instances after the application engineer receives a notification from the SNS topic.A DevOps engineer needs to implement a solution to automate the application restart on the instances without restarting the instances.Which solution will meet these requirements in the MOST operationally efficient manner?
A. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances
B. Create an AWS Lambda function that restarts the application on the instances
C. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances
D. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances
View answer
Correct Answer: D
Question #50
You are running Amazon CloudTrail on an Amazon S3 bucket and look at your most recent log. You notice that the entries include the ListThings and CreateThings actions and wonder if your devices have been hacked. Based on these entries, what service would you be concerned may have been hacked?
A. Amazon Inspector
B. AWS IoT
C. AWS CodePipeline
D. Amazon Glacier
View answer
Correct Answer: B
Question #51
A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back.Which strategy will meet these requirements?
A. Add a stage to the CodePipeline pipeline between the source and deploy stages
B. Add a stage to the CodePipeline pipeline between the source and deploy stages
C. Add a hooks section to the CodeDeploy AppSpec file
D. Add a hooks section to the CodeDeploy AppSpec file
View answer
Correct Answer: C
Question #52
A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?
A. Auto Scaling groups can create new instances in a single AZ only
B. The EC2 instances have not been manually associated to the AL
C. The ALB should be replaced with a Network Load Balancer (NLB)
D. The new AZ has not been added to the ALB
View answer
Correct Answer: D
Question #53
A company runs an application on Amazon EC2 instances. The company uses a series of AWS CloudFormation stacks to define the application resources. A developer performs updates by building and testing the application on a laptop and then uploading the build output and CloudFormation stack templates to Amazon S3. The developer's peers review the changes before the developer performs the CloudFormation stack update and installs a new version of the application onto the EC2 instances.The deployment process is prone to errors and is time-consuming when the developer updates each EC2 instance with the new application. The company wants to automate as much of the application deployment process as possible while retaining a final manual approval step before the modification of the application or resources.The company already has moved the source code for the application and the CloudFormation templates to AWS CodeCommit. The company also has created an AWS CodeBuild project to build and test the application.Which combination of steps will meet the company's requirements? (Choose two.)
A. Create an application group and a deployment group in AWS CodeDeploy
B. Create an application revision and a deployment group in AWS CodeDeploy
C. Use AWS CodePipeline to invoke the CodeBuild job, run the CloudFormation update, and pause for a manual approval step
D. Use AWS CodePipeline to invoke the CodeBuild job, create CloudFormation change sets for each of the application stacks, and pause for a manual approval step
E. Use AWS CodePipeline to invoke the CodeBuild job, create CloudFormation change sets for each of the application stacks, and pause for a manual approval step
View answer
Correct Answer: AD
Question #54
A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)
A. Filter the data through AWS X-Ray to visualize the data
B. Filter the data through Amazon QuickSight to visualize the data
C. Query the data with Amazon Athena
D. Query the data with Amazon Redshift
E. Use AWS Glue as the persistent metadata store
F. Use Amazon S3 as the persistent metadata store
View answer
Correct Answer: BCE
Question #55
A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?
A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair
B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group
C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair
D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair
View answer
Correct Answer: C
Question #56
A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint.The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window.What should a DevOps engineer do to meet these requirements?
A. Add a reader instance to the Aurora cluster
B. Add a reader instance to the Aurora cluster
C. Turn on the Multi-AZ option on the Aurora cluster
D. Turn on the Multi-AZ option on the Aurora cluster
View answer
Correct Answer: A
Question #57
A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?
A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state
B. Increase the maximum instance count of the Auto Scaling group
C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state
D. Increase the maximum instance count of the Auto Scaling group
View answer
Correct Answer: A
Question #58
A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user-agent header that is sent with all requests to the API.After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user-agent header and response code.Which additional set of actions should the DevOps engineer take to gather the required metrics?
A. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group
B. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group
C. Configure the ALB access logs to write to an Amazon CloudWatch Logs log group
D. Configure AWS X-Ray integration on the Lambda function
View answer
Correct Answer: A
Question #59
A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as non-compliant. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is always present.Which solution will accomplish this?
A. Create an AWS CloudFormation template that defines an AWS Inspector rule to check whether EBS encryption is enabled
B. Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI
C. Create an SCP in Organizations
D. Deploy an IAM role to all accounts from a single trusted account
View answer
Correct Answer: B
Question #60
A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?
A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content
B. Update the weighted DNS record entry that points to the S3 bucket
C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB
D. Remove the weighted DNS record entry that points to the S3 bucket from the example
View answer
Correct Answer: D
Question #61
A DevOps engineer is working on a data archival project that requires the migration of on-premises data to an Amazon S3 bucket. The DevOps engineer develops a script that incrementally archives on-premises data that is older than 1 month to Amazon S3. Data that is transferred to Amazon S3 is deleted from the on-premises location The script uses the S3 PutObject operation. During a code review the DevOps engineer notices that the script does not verity whether the data was successfully copied to Amazon S3. The DevOps engineer must update the script to ensure that data is not corrupted during transmission. The script must use MD5 checksums to verify data integrity before the on-premises data is deleted. Which solutions for the script will meet these requirements'? (Select TWO.) https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html
A. Check the returned response for the Versioned Compare the returned Versioned against the MD5 checksum
B. Include the MD5 checksum within the Content-MD5 parameter
C. Include the checksum digest within the tagging parameter as a URL query parameter
D. Check the returned response for the ETag
E. Include the checksum digest within the Metadata parameter as a name-value pair After upload use the S3 HeadObject operation to retrieve metadata from the object
View answer
Correct Answer: BD
Question #62
A company has migrated its container-based applications to Amazon EKS and want to establish automated email notifications. The notifications sent to each email address are for specific activities related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate incoming log events and publish messages to the correct SNS topic.Which logging solution will support these requirements?
A. Enable Amazon CloudWatch Logs to log the EKS components
B. Enable Amazon CloudWatch Logs to log the EKS components
C. Enable Amazon S3 logging for the EKS components
D. Enable Amazon S3 logging for the EKS components
View answer
Correct Answer: A
Question #63
A company's developers use Amazon EC2 instances as remote workstations. The company is concerned that users can create or modify EC2 security groups to allow unrestricted inbound access.A DevOps engineer needs to develop a solution to detect when users create unrestricted security group rules. The solution must detect changes to security group rules in near real time, remove unrestricted rules, and send email notifications to the security team. The DevOps engineer has created an AWS Lambda function that checks for security group ID from input, removes rules that grant unrestricted access, and sends notifications through Amazon Simple Notification Service (Amazon SNS).What should the DevOps engineer do next to meet the requirements?
A. Configure the Lambda function to be invoked by the SNS topic
B. Create an Amazon EventBridge scheduled rule to invoke the Lambda function
C. Create an Amazon EventBridge event rule that has the default event bus as the source
D. Create an Amazon EventBridge custom event bus that subscribes to events from all AWS services
View answer
Correct Answer: C
Question #64
A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?
A. Failed deploy and build actions across all the pipelines
B. All rejected or failed approval actions across all the pipelines
C. All the events across all pipelines
D. Approval actions across all the pipelines
View answer
Correct Answer: B
Question #65
A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?
A. Auto Scaling groups can create new instances in a single AZ only
B. The EC2 instances have not been manually associated to the AL
C. The ALB should be replaced with a Network Load Balancer (NLB)
D. The new AZ has not been added to the ALB
View answer
Correct Answer: D
Question #66
A company has an application that is using a MySQL-compatible Amazon Aurora Multi-AZ DB cluster as the database. A cross-Region read replica has been created for disaster recovery purposes. A DevOps engineer wants to automate the promotion of the replica so it becomes the primary database instance in the event of a failure.Which solution will accomplish this?
A. Con gure a latency-based Amazon Route 53 CNAME with health checks so it points to both the primary and replica endpoints
B. Create an Aurora custom endpoint to point to the primary database instance
C. Create an AWS Lambda function to modify the application's AWS Cloud Formation template to promote the replica, apply the template to update the stack, and point the application to the newly promoted instance
D. Store the Aurora endpoint in AWS Systems Manager Parameter Store
View answer
Correct Answer: D
Question #67
A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user-agent header that is sent with all requests to the API.After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user-agent header and response code.Which additional set of actions should the DevOps engineer take to gather the required metrics?
A. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group
B. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group
C. Configure the ALB access logs to write to an Amazon CloudWatch Logs log group
D. Configure AWS X-Ray integration on the Lambda function
View answer
Correct Answer: A
Question #68
A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?
A. Failed deploy and build actions across all the pipelines
B. All rejected or failed approval actions across all the pipelines
C. All the events across all pipelines
D. Approval actions across all the pipelines
View answer
Correct Answer: B
Question #69
A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?
A. Use AWS Systems Manager Con guration Compliance
B. Use custom Java code running on an EC2 instance
C. Use AWS Con g
D. Use AWS CloudTrail
View answer
Correct Answer: C
Question #70
A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines.The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)
A. Create a new version of the common AMI with the CodeDeploy agent installed
B. Create a new version of the common AMI with the CodeDeploy agent installed
C. Create an application in CodeDeploy
D. Create an application in CodeDeploy
E. Create an application in CodeDeploy
View answer
Correct Answer: AD
Question #71
A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?
A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair
B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group
C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair
D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair
View answer
Correct Answer: C
Question #72
A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?
A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair
B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group
C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair
D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair
View answer
Correct Answer: C
Question #73
An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?
A. In the CloudFormation template, add an AWS Config rule
B. In the CloudFormation template, add an EC2 launch template resource
C. In the CloudFormation template, add an EC2 launch template resource
D. In the CloudFormation template, add CloudFormation init metadata
View answer
Correct Answer: D
Question #74
A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?
A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state
B. Increase the maximum instance count of the Auto Scaling group
C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state
D. Increase the maximum instance count of the Auto Scaling group
View answer
Correct Answer: A
Question #75
A DevOps team manages an API running on-premises that serves as a backend for an Amazon API Gateway endpoint. Customers have been complaining about high response latencies, which the development team has verified using the API Gateway latency metrics in Amazon CloudWatch. To identify the cause, the team needs to collect relevant data without introducing additional latency.Which actions should be taken to accomplish this? (Choose two.)
A. Install the CloudWatch agent server side and configure the agent to upload relevant logs to CloudWatch
B. Enable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and upload those segments to X-Ray during each request
C. Enable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and use the X-Ray daemon to upload segments to X-Ray
D. Modify the on-premises application to send log information back to API Gateway with each request
E. Modify the on-premises application to calculate and upload statistical data relevant to the API service requests to CloudWatch metrics
View answer
Correct Answer: AC
Question #76
A company wants to use AWS CloudFormation for infrastructure deployment. The company has strict tagging and resource requirements and wants to limit the deployment to two Regions. Developers will need to deploy multiple versions of the same application. Which solution ensures resources are deployed in accordance with company policy?
A. Create AWS Trusted Advisor checks to nd and remediate unapproved CloudFormation StackSets
B. Create a CloudFormation drift detection operation to nd and remediate unapproved CloudFormation StackSets
C. Create CloudFormation StackSets with approved CloudFormation templates
D. Create AWS Service Catalog products with approved CloudFormation templates
View answer
Correct Answer: D
Question #77
A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?
A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only
B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access
C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"
D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only
View answer
Correct Answer: D
Question #78
An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?
A. In the CloudFormation template, add an AWS Config rule
B. In the CloudFormation template, add an EC2 launch template resource
C. In the CloudFormation template, add an EC2 launch template resource
D. In the CloudFormation template, add CloudFormation init metadata
View answer
Correct Answer: D
Question #79
A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?
A. Failed deploy and build actions across all the pipelines
B. All rejected or failed approval actions across all the pipelines
C. All the events across all pipelines
D. Approval actions across all the pipelines
View answer
Correct Answer: B
Question #80
A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.Which solution will accomplish this?
A. Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old
B. Configure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic
C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old
D. Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old
View answer
Correct Answer: C
Question #81
An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?
A. In the CloudFormation template, add an AWS Config rule
B. In the CloudFormation template, add an EC2 launch template resource
C. In the CloudFormation template, add an EC2 launch template resource
D. In the CloudFormation template, add CloudFormation init metadata
View answer
Correct Answer: D
Question #82
A company hosts a security auditing application in an AWS account. The auditing application uses an IAM role to access other AWS accounts. All the accounts are in the same organization in AWS Organizations.A recent security audit revealed that users in the audited AWS accounts could modify or delete the auditing application's IAM role. The company needs to prevent any modification to the auditing application's IAM role by any entity other than a trusted administrator IAM role.Which solution will meet these requirements?
A. Create an SCP that includes a Deny statement for changes to the auditing application's IAM role
B. Create an SCP that includes an Allow statement for changes to the auditing application's IAM role by the trusted administrator IAM role
C. Create an IAM permissions boundary that includes a Deny statement for changes to the auditing application's IAM role
D. Create an IAM permissions boundary that includes a Deny statement for changes to the auditing application's IAM role
View answer
Correct Answer: A
Question #83
A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?
A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour
B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one
C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration
D. Use AWS Elastic Beanstalk with the con guration set to Immutable
View answer
Correct Answer: D
Question #84
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?
A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule
B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule
C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule
D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256
View answer
Correct Answer: D
Question #85
A company uses an organization in AWS Organizations to manage its AWS accounts. The company's automation account contains a CI/CD pipeline that creates and configures new AWS accounts. The company has a group of internal service teams that provide services to accounts in the organization. The service teams operate out of a set of services accounts. The service teams want to receive an AWS CloudTrail event in their services accounts when the CreateAccount API call creates a new account. How should the company share this CloudTrail event with the service accounts? Comprehensive and Detailed Explanation From Exact Extract of DevOps Engineer documents only: Use cross-account EventBridge by configuring a rule in the source (automation) account to send events to the target accounts' default event buses, and grant permissions on the target default event buses to accept events from the source account. This is the standard cross-account event routing model.
A. Create an Amazon EventBridge rule in the automation account to send account creation events to the default event bus in the services accounts
B. Create a custom Amazon EventBridge event bus in the services accounts
C. Create a custom Amazon EventBridge event bus in the automation account and the services accounts
D. Create a custom Amazon EventBridge event bus in the automation account
View answer
Correct Answer: A
Question #86
A company runs an Amazon EKS cluster and must implement comprehensive logging for the control plane and nodes. The company must analyze API requests and monitor container performance.Which solution will meet these requirements with the LEAST operational overhead?
A. Enable AWS CloudTrail for control plane logging and deploy Logstash on nodes
B. Enable control plane logging to CloudWatch and use CloudWatch Container Insights for node and pod metrics
C. Enable API server logging to S3 and deploy Kubernetes Event Exporter to nodes
D. Use AWS Distro for OpenTelemetry and stream logs to Amazon Redshift
View answer
Correct Answer: B
Question #87
A rapidly growing company wants to scale for developer demand for AWS development environments. Development environments are created manually in the AWS Management Console. The networking team uses AWS CloudFormation to manage the networking infrastructure, exporting stack output values for the Amazon VPC and all subnets. The development environments have common standards, such as Application Load Balancers, Amazon EC2 Auto Scaling groups, security groups, and Amazon DynamoDB tables.To keep up with demand, the DevOps engineer wants to automate the creation of development environments. Because the infrastructure required to support the application is expected to grow, there must be a way to easily update the deployed infrastructure. CloudFormation will be used to create a template for the development environments.Which approach will meet these requirements and quickly provide consistent AWS environments for developers?
A. Use Fn::ImportValue intrinsic functions in the Resources section of the template to retrieve Virtual Private Cloud (VPC) and subnet values
B. Use nested stacks to define common infrastructure components
C. Use nested stacks to define common infrastructure components
D. Use Fn::ImportValue intrinsic functions in the Parameters section of the root template to retrieve Virtual Private Cloud (VPC) and subnet values
View answer
Correct Answer: C
Question #88
A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user - agent header that is sent with all requests to the API. After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user - agent header and response code. Which additional set of actions should the DevOps engineer take to gather the required metrics?
A. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group
B. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group
C. Configure the ALB access logs to write to an Amazon CloudWatch Logs log group
D. Configure AWS X - Ray integration on the Lambda function
View answer
Correct Answer: B
Question #89
A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?
A. Failed deploy and build actions across all the pipelines
B. All rejected or failed approval actions across all the pipelines
C. All the events across all pipelines
D. Approval actions across all the pipelines
View answer
Correct Answer: B
Question #90
A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?
A. Failed deploy and build actions across all the pipelines
B. All rejected or failed approval actions across all the pipelines
C. All the events across all pipelines
D. Approval actions across all the pipelines
View answer
Correct Answer: B
Question #91
An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?
A. In the CloudFormation template, add an AWS Config rule
B. In the CloudFormation template, add an EC2 launch template resource
C. In the CloudFormation template, add an EC2 launch template resource
D. In the CloudFormation template, add CloudFormation init metadata
View answer
Correct Answer: D
Question #92
A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?
A. Enable Amazon CodeGuru Profiler
B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
C. Enable Amazon CodeGuru Profiler
D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer
View answer
Correct Answer: B
Question #93
A company is migrating from its on-premises data center to AWS. The company currently uses a custom on-premises Cl/CD pipeline solution to build and package software.
A. Update the C1ICD pipeline to create a VM image that contains newly packaged software
B. Create an AWS Identity and Access Management Roles Anywhere trust anchor
C. Create a new Amazon S3 bucket
D. For each public repository, create a CodeArutact repository that is configured with an external connection
E. Create a Codeartitact repository that is configured with a set of external connections to the public repositories
View answer
Correct Answer: BD
Question #94
An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?
A. In the CloudFormation template, add an AWS Config rule
B. In the CloudFormation template, add an EC2 launch template resource
C. In the CloudFormation template, add an EC2 launch template resource
D. In the CloudFormation template, add CloudFormation init metadata
View answer
Correct Answer: D
Question #95
A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?
A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair
B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group
C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair
D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair
View answer
Correct Answer: C
Question #96
A company wants to use AWS CloudFormation for infrastructure deployment. The company has strict tagging and resource requirements and wants to limit the deployment to two Regions. Developers will need to deploy multiple versions of the same application.Which solution ensures resources are deployed in accordance with company policy?
A. reate AWS Trusted Advisor checks to find and remediate unapproved CloudFormation StackSets
B. reate a Cloud Formation drift detection operation to find and remediate unapproved CloudFormation StackSets
C. reate CloudFormation StackSets with approved CloudFormation templates
D. reate AWS Service Catalog products with approved CloudFormation templates
View answer
Correct Answer: D
Question #97
A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?
A. Failed deploy and build actions across all the pipelines
B. All rejected or failed approval actions across all the pipelines
C. All the events across all pipelines
D. Approval actions across all the pipelines
View answer
Correct Answer: B
Question #98
A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.How can this issue be corrected in the MOST secure manner?
A. Add the bucket name to the AllowedBuckets section of the CodeBuild project settings
B. Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token
C. Remove unauthenticated access from the S3 bucket with a bucket policy
D. Remove unauthenticated access from the S3 bucket with a bucket policy
View answer
Correct Answer: C
Question #99
A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?
A. Use AWS Systems Manager Con guration Compliance
B. Use custom Java code running on an EC2 instance
C. Use AWS Con g
D. Use AWS CloudTrail
View answer
Correct Answer: C

View The Updated AWS Exam Questions

SPOTO Provides 100% Real AWS Exam Questions for You to Pass Your AWS Exam!

Get AWS Practice Test

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:
Contact Us


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.