Free AWS DOP-C02 Practice Questions & Answers 2026 Part3

Question #1

A company is using AWS CodeDeploy to deploy an application to Amazon EC2 instances in an Auto Scaling group. The company configures the Auto Scaling group by using an EC2 launch template that references a custom AMI that has the CodeDeploy agent installed. The company updates the AMI weekly, and all EC2 instances are replaced with new instances that are launched from the updated AMI. The company requires each EC2 instance to be tagged with an application tag that identifies the application that is deployed on the instance. Currently, the company manually tags the EC2 instances.To deploy the application, the company creates a CodeDeploy application and a deployment group. The company sets a custom resource tag in the deployment group and configures the deployment group to target the Auto Scaling group. The company must ensure that each instance in the Auto Scaling group is tagged with the appropriate application tag.Which solution will meet this requirement?

A. onfigure the process that creates the custom AMI to tag the AMI with the custom resource tag

B. reate a tag specification in the EC2 launch template and set the resource type to instances

C. reate a tag specification in the EC2 launch template and set the resource type to applications

D. onfigure the CodeDeploy deployment group to include a tag specification that applies the custom resource tag

View answer

Correct Answer: B

Question #2

A company wants to set up a continuous delivery pipeline. The company stores application code in a private GitHub repository. The company needs to deploy the application components to Amazon Elastic Container Service (Amazon ECS), Amazon EC2, and AWS Lambda. The pipeline must support manual approval actions.Which solution will meet these requirements?

A. Use AWS CodePipeline with Amazon ECS, Amazon EC2, and Lambda as deploy providers

B. Use AWS CodePipeline with AWS CodeDeploy as the deploy provider

C. Use AWS CodePipeline with AWS Elastic Beanstalk as the deploy provider

D. Use AWS CodeDeploy with GitHub integration to deploy the application

View answer

Correct Answer: B

Question #3

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #4

An ecommerce company is receiving reports that its order history page is experiencing delays in reflecting the processing status of orders. The order processing system consists of an AWS Lambda function that uses reserved concurrency. The Lambda function processes order messages from an Amazon Simple Queue Service (Amazon SQS) queue and inserts processed orders into an Amazon DynamoDB table. The DynamoDB table has auto scaling enabled for read and write capacity.Which actions should a DevOps engineer take to resolve this delay? (Choose two.)

A. Check the ApproximateAgeOfOldestMessage metric for the SQS queue

B. Check the ApproximateAgeOfOldestMessage metric for the SQS queue Configure a redrive policy on the SQS queue

C. Check the NumberOfMessagesSent metric for the SQS queue

D. Check the WriteThrottleEvents metric for the DynamoDB table

E. Check the Throttles metric for the Lambda function

View answer

Correct Answer: AD

Question #5

A company's web app publishes JSON logs with transaction status to CloudWatch Logs. The company wants a dashboard showing the number of successful transactions with the least operational overhead. Which solution meets this? CloudWatch metric filters can parse logs directly to create metrics without additional infrastructure. Metric filters combined with CloudWatch dashboards provide the simplest and most operationally efficient solution. Options A, B, and D add complexity with additional services (OpenSearch, Lambda, Kinesis). References: CloudWatch Logs Metric Filters CloudWatch Dashboards

A. Create an OpenSearch cluster and subscription filter to send logs; create OpenSearch dashboard with queries for success

B. Create a CloudWatch subscription filter with Lambda to parse logs and publish custom metrics; create CloudWatch dashboard with metric graph

C. Create a CloudWatch metric filter on the log group with a pattern matching success; create CloudWatch dashboard with metric graph

D. Create a Kinesis data stream subscribed to the log group; filter logs by success; send to Lambda; Lambda publishes custom metrics; dashboard uses metric graph

View answer

Correct Answer: C

Question #6

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #7

A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user-agent header that is sent with all requests to the API.After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user-agent header and response code.Which additional set of actions should the DevOps engineer take to gather the required metrics?

A. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group

B. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group

C. Configure the ALB access logs to write to an Amazon CloudWatch Logs log group

D. Configure AWS X-Ray integration on the Lambda function

View answer

Correct Answer: A

Question #8

A company's application is currently deployed to a single AWS Region. Recently, the company opened a new office on a different continent. The users in the new office are experiencing high latency. The company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and uses Amazon DynamoDB as the database layer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. A DevOps engineer is tasked with minimizing application response times and improving availability for users in both Regions.Which combination of actions should be taken to address the latency issues? (Choose three.)

A. Create a new DynamoDB table in the new Region with cross-Region replication enabled

B. Create new ALB and Auto Scaling group global resources and configure the new ALB to direct traffic to the new Auto Scaling group

C. Create new ALB and Auto Scaling group resources in the new Region and configure the new ALB to direct traffic to the new Auto Scaling group

D. Create Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB

E. Create Amazon Route 53 aliases, health checks, and failover routing policies to route to the ALB

F. Convert the DynamoDB table to a global table

View answer

Correct Answer: CDF

Question #9

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #10

An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months. Its product currently runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. All data is stored in an Amazon Aurora database instance.When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region.How should the company meet these requirements with the LEAST amount of application changes?

A. Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer information and purchases

B. Use Amazon DynamoDB global tables for the product catalog and regional tables for the customer information and purchases

C. Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer information and purchases

D. Use Aurora for the product catalog and Amazon DynamoDB global tables for the customer information and purchases

View answer

Correct Answer: C

Question #11

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #12

A company has many applications. Different teams in the company developed the applications by using multiple languages and frameworks. The applications run on premises and on different servers with different operating systems. Each team has its own release protocol and process. The company wants to reduce the complexity ofthe release and maintenance of these applications.The company is migrating its technology stacks, including these applications, to AWS. The company wants centralized control of source code, a consistent and automatic delivery pipeline, and as few maintenance tasks as possible on the underlying infrastructure.What should a DevOps engineer do to meet these requirements?

A. Create one AWS CodeCommit repository for all applications

B. Create one AWS CodeCommit repository for each of the applications

C. Create one AWS CodeCommit repository for each of the applications

D. Create one AWS CodeCommit repository for each of the applications

View answer

Correct Answer: D

Question #13

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #14

A space exploration company receives telemetry data from multiple satellites. Small packets of data are received through Amazon API Gateway and are placed directly into an Amazon Simple Queue Service (Amazon SQS) standard queue. A custom application is subscribed to the queue and transforms the data into a standard format.Because of inconsistencies in the data that the satellites produce, the application is occasionally unable to transform the data. In these cases, the messages remain in the SQS queue. A DevOps engineer must develop a solution that retains the failed messages and makes them available to scientists for review and future processing.Which solution will meet these requirements?

A. onfigure AWS Lambda to poll the SQS queue and invoke a Lambda function to check whether the queue messages are valid

B. onvert the SQS standard queue to an SQS FIFO queue

C. reate an SQS dead-letter queue

D. onfigure API Gateway to send messages to different SQS virtual queues that are named for each of the satellites

View answer

Correct Answer: C

Question #15

A company uses Amazon RDS for Microsoft SQL Server as its primary database and must ensure cross- Region high availability with RPO < 1 min and RTO < 10 min.Which solution meets these requirements?

A. se single-AZ with Backup and restore

B. se Multi-AZ cluster with snapshots copied cross-Region

C. se single-AZ RDS + DMS continuous replication

D. se RDS Multi-AZ DB cluster with cross-Region read replicas

View answer

Correct Answer: D

Question #16

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #17

A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user-agent header that is sent with all requests to the API.After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user-agent header and response code.Which additional set of actions should the DevOps engineer take to gather the required metrics?

A. odify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group

B. odify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group

C. onfigure the ALB access logs to write to an Amazon CloudWatch Logs log group

D. onfigure AWS X-Ray integration on the Lambda function

View answer

Correct Answer: A

Question #18

A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)

A. elegate AWS Firewall Manager to a security account

B. elegate Amazon GuardDuty to a security account

C. reate an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

D. reate an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

E. onfigure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

View answer

Correct Answer: AC

Question #19

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #20

A video-sharing company stores its videos in Amazon S3. The company has observed a sudden increase in video access requests, but the company does not know which videos are most popular. The company needs to identify the general access pattern for the video files. This pattern includes the number of users who access a certain file on a given day, as well as the number of pull requests for certain files.How can the company meet these requirements with the LEAST amount of effort?

A. Activate S3 server access logging

B. Activate S3 server access logging

C. Invoke an AWS Lambda function for every S3 object access event

D. Record an Amazon CloudWatch Logs log message for every S3 object access event

View answer

Correct Answer: B

Question #21

A company wants to use AWS CloudFormation for infrastructure deployment. The company has strict tagging and resource requirements and wants to limit the deployment to two Regions. Developers will need to deploy multiple versions of the same application.Which solution ensures resources are deployed in accordance with company policy?

A. Create AWS Trusted Advisor checks to find and remediate unapproved CloudFormation StackSets

B. Create a CloudFormation drift detection operation to find and remediate unapproved CloudFormation StackSets

C. Create CloudFormation StackSets with approved CloudFormation templates

D. Create AWS Service Catalog products with approved CloudFormation templates

View answer

Correct Answer: D

Question #22

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #23

An Amazon EC2 instance is running in a Virtual Private Cloud (VPC) and needs to download an object from a restricted Amazon S3 bucket. When the DevOps engineer tries to download, the object an AccessDenied error is received.What are the possible causes for this error? (Choose two.)

A. The S3 bucket default encryption is enabled

B. There is an error in the S3 bucket policy

C. The object has been moved to Amazon Glacier

D. There is an error in the IAM role con guration

E. S3 versioning is enabled

View answer

Correct Answer: BD

Question #24

A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint.The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window.What should a DevOps engineer do to meet these requirements?

A. dd a reader instance to the Aurora cluster

B. dd a reader instance to the Aurora cluster

C. urn on the Multi-AZ option on the Aurora cluster

D. urn on the Multi-AZ option on the Aurora cluster

View answer

Correct Answer: A

Question #25

A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production.The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group.How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?

A. Tag the Amazon EC2 instances depending on the deployment group

B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify which deployment group the instance is part of

C. Create a CodeDeploy custom environment variable for each environment

D. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance is part of to configure the log level settings

View answer

Correct Answer: B

Question #26

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #27

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #28

A DevOps Engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using the S3 cross-region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account. Which actions should be performed to enable this replication? (Choose three.)

A. Create a replication IAM role in the source account

B. Create a replication IAM role in the target account

C. Add statements to the source bucket policy allowing the replication IAM role to replicate objects

D. Add statements to the target bucket policy allowing the replication IAM role to replicate objects

E. Create a replication rule in the source bucket to enable the replication

F. Create a replication rule in the target bucket to enable the replication

View answer

Correct Answer: ADE

Question #29

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #30

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #31

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #32

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #33

A DevOps engineer wants to nd a solution to migrate an application from on premises to AWS. The application is running on Linux and needs to run on speci c versions of Apache Tomcat, HAProxy, and Varnish Cache to function properly. The application's operating system-level parameters require tuning. The solution must include a way to automate the deployment of new application versions. The infrastructure should be scalable and faulty servers should be replaced automatically.Which solution should the DevOps engineer use?

A. Upload the application as a Docker image that contains all the necessary software to Amazon ECR

B. Upload the application code to an AWS CodeCommit repository with a saved con guration le to con gure and install the software

C. Upload the application code to an AWS CodeCommit repository with a set of

D. Upload the application code to an AWS CodeCommit repository with an appspec

View answer

Correct Answer: D

Question #34

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #35

A company plans to stop using Amazon EC2 key pairs for SSH access, and instead plans to use AWS Systems Manager Session Manager. To further enhance security, access to Session Manager must take place over a private network only.Which combinations of actions will accomplish this? (Choose two.)

A. Allow inbound access to TCP port 22 in all associated EC2 security groups from the VPC CIDR range

B. Attach an IAM policy with the necessary Systems Manager permissions to the existing IAM instance pro le

C. Create a VPC endpoint for Systems Manager in the desired Region

D. Deploy a new EC2 instance that will act as a bastion host to the rest of the EC2 instance eet

E. Remove any default routes in the associated route tables

View answer

Correct Answer: BC

Question #36

A company has an application that is using a MySQL-compatible Amazon Aurora Multi-AZ DB cluster as the database. A cross-Region read replica has been created for disaster recovery purposes. A DevOps engineer wants to automate the promotion of the replica so it becomes the primary database instance in the event of a failure.Which solution will accomplish this?

A. Configure a latency-based Amazon Route 53 CNAME with health checks so it points to both the primary and replica endpoints

B. Create an Aurora custom endpoint to point to the primary database instance

C. Create an AWS Lambda function to modify the application's AWS CloudFormation template to promote the replica, apply the template to update the stack, and point the application to the newly promoted instance

D. Store the Aurora endpoint in AWS Systems Manager Parameter Store

View answer

Correct Answer: D

Question #37

A company requires that its internally facing web application be highly available. The architecture is made up of one Amazon EC2 web server instance and one NAT instance that provides outbound internet access for updates and accessing public data.Which combination of architecture adjustments should the company implement to achieve high availability? (Choose two.)

A. Add the NAT instance to an EC2 Auto Scaling group that spans multiple Availability Zones

B. Create additional EC2 instances spanning multiple Availability Zones

C. Configure an Application Load Balancer in front of the EC2 instance

D. Replace the NAT instance with a NAT gateway in each Availability Zone

E. Replace the NAT instance with a NAT gateway that spans multiple Availability Zones

View answer

Correct Answer: BD

Question #38

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #39

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #40

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #41

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #42

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes. A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified. Which solution will meet these requirements?

A. Set up AWS Config in the account

B. Set up AWS Config in the account

C. Turn on AWS CloudTrail in the account

D. Turn on AWS CloudTrail in the account

View answer

Correct Answer: B

Question #43

A company has an application that runs on Amazon EC2 instances in an Auto Scaling group. The application processes a high volume of messages from an Amazon Simple Queue Service (Amazon SQS) queue.

A. Create an AWS Lambda function

B. Create an AWS Lambda function

C. Create a target tracking scaling policy for the Auto Scaling group

D. Create an AWS Lambda function that logs the ApproximateNumberOfMessagesVisible attribute of the SQS queue to a CloudWatch Logs log group

View answer

Correct Answer: C

Question #44

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #45

A company wants to use AWS CloudFormation for infrastructure deployment. The company has strict tagging and resource requirements and wants to limit the deployment to two Regions. Developers will need to deploy multiple versions of the same application.Which solution ensures resources are deployed in accordance with company policy?

A. Create AWS Trusted Advisor checks to find and remediate unapproved CloudFormation StackSets

B. Create a CloudFormation drift detection operation to find and remediate unapproved CloudFormation StackSets

C. Create CloudFormation StackSets with approved CloudFormation templates

D. Create AWS Service Catalog products with approved CloudFormation templates

View answer

Correct Answer: D

Question #46

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #47

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #48

A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.How can this issue be corrected in the MOST secure manner?

A. Add the bucket name to the AllowedBuckets section of the CodeBuild project settings

B. Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token

C. Remove unauthenticated access from the S3 bucket with a bucket policy

D. Remove unauthenticated access from the S3 bucket with a bucket policy

View answer

Correct Answer: C

Question #49

A company has its AWS accounts in an organization in AWS Organizations. AWS Config is manually configured in each AWS account. The company needs to implement a solution to centrally configure AWS Config for all accounts in the organization The solution also must record resource changes to a central account.Which combination of actions should a DevOps engineer perform to meet these requirements? (Choose two.)

A. Configure a delegated administrator account for AWS Config

B. Configure a delegated administrator account for AWS Config

C. Create an AWS CloudFormation template to create an AWS Config aggregator

D. Create an AWS Config organization aggregator in the organization's management account

E. Create an AWS Config organization aggregator in the delegated administrator account

View answer

Correct Answer: AE

Question #50

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #51

A DevOps engineer at a company is supporting an AWS environment in which all users use AWS IAM Identity Center (AWS Single Sign-On). The company wants to immediately disable credentials of any new IAM user and wants the security team to receive a notification.Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)

A. Create an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS CloudTrail

B. Create an Amazon EventBridge rule that reacts to an IAM GetLoginProfile API call in AWS CloudTrail

C. Create an AWS Lambda function that is a target of the EventBridge rule

D. Create an AWS Lambda function that is a target of the EventBridge rule

E. Create an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the EventBridge rule

F. Create an Amazon Simple Queue Service (Amazon SQS) queue that is a target of the Lambda function

View answer

Correct Answer: ACE

Question #52

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #53

A DevOps engineer is building a continuous deployment pipeline for a serverless application that uses AWS Lambda functions. The company wants to reduce the customer impact of an unsuccessful deployment. The company also wants to monitor for issues.Which deploy stage configuration will meet these requirements?

A. Use an AWS Serverless Application Model (AWS SAM) template to define the serverless application

B. Use AWS CloudFormation to publish a new stack update, and include Amazon CloudWatch alarms on all resources

C. Use AWS CloudFormation to publish a new version on every stack update, and include Amazon CloudWatch alarms on all resources

D. Use AWS CodeBuild to add sample event payloads for testing to the Lambda functions

View answer

Correct Answer: A

Question #54

A DevOps engineer is deploying a new version of a company's application in an AWS CodeDeploy deployment group associated with its Amazon EC2 instances.After some time, the deployment fails. The engineer realizes that all the events associated with the speci c deployment ID are in a Skipped status, and code was not deployed in the instances associated with the deployment group.What are valid reasons for this failure? (Choose two.)

A. The networking con guration does not allow the EC2 instances to reach the internet via a NAT gateway or internet gateway, and the CodeDeploy endpoint cannot be reached

B. The IAM user who triggered the application deployment does not have permission to interact with the CodeDeploy endpoint

C. The target EC2 instances were not properly registered with the CodeDeploy endpoint

D. An instance pro le with proper permissions was not attached to the target EC2 instances

E. The appspec

View answer

Correct Answer: AD

Question #55

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #56

A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint. The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window. What should a DevOps engineer do to meet these requirements?

A. Add a reader instance to the Aurora cluster

B. Add a reader instance to the Aurora cluster

C. Turn on the Multi - AZ option on the Aurora cluster

D. Turn on the Multi - AZ option on the Aurora cluster

View answer

Correct Answer: C

Question #57

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #58

A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back.Which strategy will meet these requirements?

A. dd a stage to the CodePipeline pipeline between the source and deploy stages

B. dd a stage to the CodePipeline pipeline between the source and deploy stages

C. dd a hooks section to the CodeDeploy AppSpec file

D. dd a hooks section to the CodeDeploy AppSpec file

View answer

Correct Answer: C

Question #59

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #60

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #61

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #62

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #63

A DevOps engineer needs to implement a blue/green deployment process for an application on AWS. The DevOps engineer must gradually shift the traffic between the environments.The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group. The application stores data on an Amazon RDS Multi-AZ DB instance. Amazon Route 53 provides external DNS.Which combination of steps should the DevOps engineer take to meet these requirements?(Select THREE.)

A. Create a second Auto Scaling group behind the same ALB

B. Create a second Auto Scaling group behind a second ALB

C. In Route 53, create a second alias record that points to the new environment

D. In Route 53, create a second alias record that points to the new environment

E. Configure the new EC2 instances to use the primary RDS DB instance

F. Configure the new EC2 instances to use the standby RDS DB instance

View answer

Correct Answer: bde

Question #64

A company has enabled all features for its organization in AWS Organizations. The organization contains 10 AWS accounts. The company has turned on AWS CloudTrail in all the accounts. The company expects the number of AWS accounts in the organization to increase to 500 during the next year. The company plans to use multiple OUs for these accounts.The company has enabled AWS Config in each existing AWS account in the organization. A DevOps engineer must implement a solution that enables AWS Config automatically for all future AWS accounts that are created in the organization.Which solution will meet this requirement?

A. In the organization's management account, create an Amazon EventBridge rule that reacts to a CreateAccount API call

B. In the organization's management account, create an AWS CloudFormation stack set to enable AWS Config

C. In the organization's management account, create an SCP that allows the appropriate AWS Config API calls to enable AWS Config

D. In the organization's management account, create an Amazon EventBridge rule that reacts to a CreateAccount API call

View answer

Correct Answer: B

Question #65

A company's application development team uses Linux-based Amazon EC2 instances as bastion hosts. Inbound SSH access to the bastion hosts is restricted to specific IP addresses, as defined in the associated security groups. The company's security team wants to receive a notification if the security group rules are modified to allow SSH access from any IP address.What should a DevOps engineer do to meet this requirement?

A. Create an Amazon EventBridge rule with a source of aws

B. Enable Amazon GuardDuty and check the findings for security groups in AWS Security Hub

C. Create an AWS Config rule by using the restricted-ssh managed rule to check whether security groups disallow unrestricted incoming SSH traffic

D. Enable Amazon Inspector

View answer

Correct Answer: C

Question #66

A company runs an application with an Amazon EC2 and on-premises configuration. A DevOps engineer needs to standardize patching across both environments. Company policy dictates that patching only happens during non-business hours.Which combination of actions will meet these requirements? (Choose three.)

A. Add the physical machines into AWS Systems Manager using Systems Manager Hybrid Activations

B. Attach an IAM role to the EC2 instances, allowing them to be managed by AWS Systems Manager

C. Create IAM access keys for the on-premises machines to interact with AWS Systems Manager

D. Run an AWS Systems Manager Automation document to patch the systems every hour

E. Use Amazon EventBridge scheduled events to schedule a patch window

F. Use AWS Systems Manager Maintenance Windows to schedule a patch window

View answer

Correct Answer: ABF

Question #67

A company wants to ensure that their EC2 instances are secure. They want to be noti ed if any new vulnerabilities are discovered on their instances, and they also want an audit trail of all login activities on the instances.Which solution will meet these requirements?

A. Use AWS Systems Manager to detect vulnerabilities on the EC2 instances

B. Use AWS Systems Manager to detect vulnerabilities on the EC2 instances

C. Con gure Amazon CloudWatch to detect vulnerabilities on the EC2 instances

D. Con gure Amazon Inspector to detect vulnerabilities on the EC2 instances

View answer

Correct Answer: D

Question #68

A company recently migrated its legacy application from on-premises to AWS. The application is hosted on Amazon EC2 instances behind an Application LoadBalancer, which is behind Amazon API Gateway. The company wants to ensure users experience minimal disruptions during any deployment of a new version of the application. The company also wants to ensure it can quickly roll back updates if there is an issue. Which solution will meet these requirements with MINIMAL changes to the application?

A. Introduce changes as a separate environment parallel to the existing one

B. Introduce changes as a separate environment parallel to the existing one

C. Introduce changes as a separate target group behind the existing Application Load Balancer

D. Introduce changes as a separate target group behind the existing Application Load Balancer

View answer

Correct Answer: A

Question #69

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #70

A company has an AWS CodePipeline pipeline that is configured with an Amazon S3 bucket in the eu-west-1Region. The pipeline deploys an AWS Lambda application to the same Region. The pipeline consists of an AWS CodeBuild project build action and an AWS CloudFormation deploy action.The CodeBuild project uses the aws cloudformation package AWS CLI command to build an artifact that contains the Lambda function code's .zip file and the CloudFormation template. The CloudFormation deploy action references the CloudFormation template from the output artifact of the CodeBuild project's build action.The company wants to also deploy the Lambda application to the us-east-1 Region by using the pipeline in eu- west-1. A DevOps engineer has already updated the CodeBuild project to use the aws cloudformation package command to produce an additional output artifact for us-east-1.Which combination of additional steps should the DevOps engineer take to meet these requirements? (Choose two.)

A. Modify the CloudFormation template to include a parameter for the Lambda function code's zip file location

B. Create a new CloudFormation deploy action for us-east-1 in the pipeline

C. Create an S3 bucket in us-east-1

D. Create an S3 bucket in us-east-1

E. Modify the pipeline to include the S3 bucket for us-east-1 as an artifact store

View answer

Correct Answer: CE

Question #71

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #72

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #73

A company wants to use AWS development tools to replace its current bash deployment scripts. The company currently deploys a LAMP application to a group of Amazon EC2 instances behind an Application Load Balancer (ALB). During the deployments, the company unit tests the committed application, stops and starts services, unregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to maintain the same deployment functionality through the shift to using AWS services.Which solution will meet these requirements?

A. Use AWS CodeBuild to test the application

B. Use AWS CodePipeline to move the application from the AWS CodeCommit repository to AWS CodeDeploy

C. Use AWS CodePipeline to move the application source code from the AWS CodeCommit repository to AWS CodeDeploy

D. Use AWS CodePipeline to trigger AWS CodeBuild to test the application

View answer

Correct Answer: D

Question #74

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #75

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.The company has created an AWS Key Management Service (AWS KMS) key in the source account.Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

A. In the source account, copy the unencrypted AMI to an encrypted AMI

B. In the source account, copy the unencrypted AMI to an encrypted AMI

C. In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service- linked role in the target account

D. In the source account, modify the key policy to give the target account permissions to create a grant

E. In the source account, share the unencrypted AMI with the target account

F. In the source account, share the encrypted AMI with the target account

View answer

Correct Answer: ADF

Question #76

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #77

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #78

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #79

A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as non-compliant. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is always present.Which solution will accomplish this?

A. Create an AWS CloudFormation template that defines an AWS Inspector rule to check whether EBS encryption is enabled

B. Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI

C. Create an SCP in Organizations

D. Deploy an IAM role to all accounts from a single trusted account

View answer

Correct Answer: B

Question #80

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #81

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #82

A development team uses AWS CodeCommit, AWS CodePipeline, and AWS CodeBuild to develop and deploy an application. Changes to the code are submitted by pull requests. The development team reviews and merges the pull requests, and then the pipeline builds and tests the application.Over time, the number of pull requests has increased. The pipeline is frequently blocked because of failing tests. To prevent this blockage, the development team wants to run the unit and integration tests on each pull request before it is merged.Which solution will meet these requirements?

A. Create a CodeBuild project to run the unit and integration tests

B. Create an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit Create a CodeBuild project to run the unit and integration tests

C. Create an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit

D. Create a CodeBuild project to run the unit and integration tests

View answer

Correct Answer: B

Question #83

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #84

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #85

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #86

A company has multiple accounts in an organization in AWS Organizations. The company's SecOps teamneeds to receive an Amazon Simple Notification Service (Amazon SNS) notification if any account in the organization turns off the Block Public Access feature on an Amazon S3 bucket. A DevOps engineer must implement this change without affecting the operation of any AWS accounts. The implementation must ensure that individual member accounts in the organization cannot turn off the notification.Which solution will meet these requirements?

A. Designate an account to be the delegated Amazon GuardDuty administrator account

B. Create an AWS CloudFormation template that creates an SNS topic and subscribes the SecOps team's email address to the SNS topic

C. Turn on AWS Config across the organization

D. Turn on Amazon Inspector across the organization

View answer

Correct Answer: C

Question #87

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #88

An IT team has built an AWS CloudFormation template so others in the company can quickly and reliably deploy and terminate an application. The template creates an Amazon EC2 instance with a user data script to install the application and an Amazon S3 bucket that the application uses to serve static webpages while it is running.All resources should be removed when the CloudFormation stack is deleted. However, the team observes that CloudFormation reports an error during stack deletion, and the S3 bucket created by the stack is not deleted.How can the team resolve the error in the MOST efficient manner to ensure that all resources are deleted without errors?

A. Add a DelelionPolicy attribute to the S3 bucket resource, with the value Delete forcing the bucket to be removed when the stack is deleted

B. Add a custom resource with an AWS Lambda function with the DependsOn attribute specifying the S3 bucket, and an IAM role

C. Identify the resource that was not deleted

D. Replace the EC2 and S3 bucket resources with a single AWS OpsWorks Stacks resource

View answer

Correct Answer: B

Question #89

A company has deployed an application in a production VPC in a single AWS account. The application is popular and is experiencing heavy usage. The company's security team wants to add additional security, such as AWS WAF, to the application deployment. However, the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary.The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional security. The DevOps engineer creates a VPC flow log for the production VPC.Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost- effectively?

A. Create a log group in Amazon CloudWatch Logs

B. Create an Amazon S3 bucket for log files

C. Create an Amazon S3 bucket for log files

D. Create a log group in Amazon CloudWatch Logs

View answer

Correct Answer: A

Question #90

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #91

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.The company has created an AWS Key Management Service (AWS KMS) key in the source account.Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

A. In the source account, copy the unencrypted AMI to an encrypted AMI

B. In the source account, copy the unencrypted AMI to an encrypted AMI

C. In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service- linked role in the target account

D. In the source account, modify the key policy to give the target account permissions to create a grant

E. In the source account, share the unencrypted AMI with the target account

F. In the source account, share the encrypted AMI with the target account

View answer

Correct Answer: ADF

Question #92

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #93

A development team uses AWS CodeCommit for version control for applications. The development team uses AWS CodePipeline, AWS CodeBuild. and AWS CodeDeploy for CI/CD infrastructure. In CodeCommit, the development team recently merged pull requests that did not pass long-running tests in the code base. The development team needed to perform rollbacks to branches in the codebase, resulting in lost time and wasted effort.A DevOps engineer must automate testing of pull requests in CodeCommit to ensure that reviewers more easily see the results of automated tests as part of the pull request review.What should the DevOps engineer do to meet this requirement?

A. Create an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event

B. Create an Amazon EventBridge rule that reacts to the pullRequestCreated event

C. Create an Amazon EventBridge rule that reacts to pullRequestCreated and pullRequestSourceBranchUpdated events

D. Create an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event

View answer

Correct Answer: C

Question #94

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #95

A company is hosting a web application in an AWS Region. For disaster recovery purposes, a second region is being used as a standby. Disaster recovery requirements state that session data must be replicated between regions in near-real time and 1% of requests should route to the secondary region to continuously verify system functionality. Additionally, if there is a disruption in service in the main region, traffic should be automatically routed to the secondary region, and the secondary region must be able to scale up to handle all traffic.How should a DevOps engineer meet these requirements?

A. In both regions, deploy the application on AWS Elastic Beanstalk and use Amazon DynamoDB global tables for session data

B. In both regions, launch the application in Auto Scaling groups and use DynamoDB for session data

C. In both regions, deploy the application in AWS Lambda, exposed by Amazon API Gateway, and use Amazon RDS for PostgreSQL with cross-region replication for session data

D. In both regions, launch the application in Auto Scaling groups and use DynamoDB global tables for session data

View answer

Correct Answer: A

Question #96

An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months. Its product currently runs onAmazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. All data is stored in an Amazon Aurora database instance.When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region.How should the company meet these requirements with the LEAST amount of application changes?

A. Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer information and purchases

B. Use Amazon DynamoDB global tables for the product catalog and regional tables for the customer information and purchases

C. Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer information and purchases

D. Use Aurora for the product catalog and Amazon DynamoDB global tables for the customer information and purchases

View answer

Correct Answer: C

Question #97

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #98

An ecommerce company is receiving reports that its order history page is experiencing delays in reflecting the processing status of orders. The order processing system consists of an AWS Lambda function that uses reserved concurrency. The Lambda function processes order messages from an Amazon Simple Queue Service (Amazon SQS) queue and inserts processed orders into an Amazon DynamoDB table. The DynamoDB table has auto scaling enabled for read and write capacity.Which actions should a DevOps engineer take to resolve this delay? (Choose two.)

A. Check the ApproximateAgeOfOldestMessage metric for the SQS queue

B. Check the ApproximateAgeOfOldestMessage metric for the SQS queue Configure a redrive policy on the SQS queue

C. Check the NumberOfMessagesSent metric for the SQS queue

D. Check the WriteThrottleEvents metric for the DynamoDB table

E. Check the Throttles metric for the Lambda function

View answer

Correct Answer: AD

Question #99

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #100

A production account has a requirement that any Amazon EC2 instance that has been logged in to manually must be terminated within 24 hours. All applications in the production account are using Auto Scaling groups with the Amazon CloudWatch Logs agent configured.How can this process be automated?

A. Create a CloudWatch Logs subscription to an AWS Step Functions application

B. Create an Amazon CloudWatch alarm that will be invoked by the login event

C. Create an Amazon CloudWatch alarm that will be invoked by the login event

D. Create a CloudWatch Logs subscription to an AWS Lambda function

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part3

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part3

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now