Q: 11
A company is using an organization in AWS Organizations to manage multiple AWS accounts. The
company's development team wants to use AWS Lambda functions to meet resiliency requirements
and is rewriting all applications to work with Lambda functions that are deployed in a VPC. The
development team is using Amazon Elastic Pile System (Amazon EFS) as shared storage in Account A
in the organization.
The company wants to continue to use Amazon EPS with Lambda Company policy requires all
serverless projects to be deployed in Account B.
A DevOps engineer needs to reconfigure an existing EFS file system to allow Lambda functions to
access the data through an existing EPS access point.
Which combination of steps should the DevOps engineer take to meet these requirements? (Select
THREE.)
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Q: 12
A company's application development team uses Linux-based Amazon EC2 instances as bastion
hosts. Inbound SSH access to the bastion hosts is restricted to specific IP addresses, as defined in the
associated security groups. The company's security team wants to receive a notification if the
security group rules are modified to allow SSH access from any IP address.
What should a DevOps engineer do to meet this requirement?
Options
Discussion
A tbh. Official guide and practice tests cover these EventBridge + CloudTrail scenarios a lot.
A since EventBridge can directly catch CloudTrail events like AuthorizeSecurityGroupIngress when rules change. That'll let you notify via SNS right when SSH is opened to the world. Seen similar Qs before, pretty sure it's A.
Be respectful. No spam.
Q: 13
A company deploys its corporate infrastructure on AWS across multiple AWS Regions and Availability
Zones. The infrastructure is deployed on Amazon EC2 instances and connects with AWS loT
Greengrass devices. The company deploys additional resources on on-premises servers that are
located in the corporate headquarters.
The company wants to reduce the overhead involved in maintaining and updating its resources. The
company's DevOps team plans to use AWS Systems Manager to implement automated management
and application of patches. The DevOps team confirms that Systems Manager is available in the
Regions that the resources are deployed m Systems Manager also is available in a Region near the
corporate headquarters.
Which combination of steps must the DevOps team take to implement automated patch and
configuration management across the company's EC2 instances loT devices and on-premises
infrastructure? (Select THREE.)
Options
Discussion
D imo, but does "automated management" mean periodic scheduling or just triggering patches when needed? That changes which to pick.
Be respectful. No spam.
Q: 14
A company is developing an application that will generate log events. The log events consist of five
distinct metrics every one tenth of a second and produce a large amount of data The company needs
to configure the application to write the logs to Amazon Time stream The company will configure a
daily query against the Timestream table.
Which combination of steps will meet these requirements with the FASTEST query performance?
(Select THREE.)
Options
Discussion
Its ADF, but memory store period can't be longer than magnetic so E is out if you check the docs.
Be respectful. No spam.
Q: 15
A company has many AWS accounts. During AWS account creation the company uses automation to
create an Amazon CloudWatch Logs log group in every AWS Region that the company operates in.
The automaton configures new resources in the accounts to publish logs to the provisioned log
groups in their Region.
The company has created a logging account to centralize the logging from all the other accounts. A
DevOps engineer needs to aggregate the log groups from all the accounts to an existing Amazon S3
bucket in the logging account.
Which solution will meet these requirements in the MOST operationally efficient manner?
Options
Discussion
Depends if each region needs isolated flow to avoid cross-region latency. If that's the rule (which logs usually want), it's C.
Be respectful. No spam.
Q: 16
To run an application, a DevOps engineer launches an Amazon EC2 instance with public IP addresses
in a public subnet. A user data script obtains the application artifacts and installs them on the
instances upon launch. A change to the security classification of the application now requires the
instances to run with no access to the internet. While the instances launch successfully and show as
healthy, the application does not seem to be installed.
Which of the following should successfully install the application while complying with the new rule?
Options
Discussion
C tbh, because VPC endpoint for S3 lets instances download artifacts securely with no internet. But does the artifact repo only support S3? If it were on a different service, this might not work and B could be needed.
Be respectful. No spam.
Q: 17
A company has chosen AWS to host a new application. The company needs to implement a multi-
account strategy. A DevOps engineer creates a new AWS account and an organization in AWS
Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a
landing zone by using AWS Control Tower.
The DevOps engineer must implement a solution that automatically deploys resources for new
accounts that users create through AWS Control Tower Account Factory. When a user creates a new
account, the solution must apply AWS CloudFormation templates and SCPs that are customized for
the OU or the account to automatically deploy all the resources that are attached to the account. All
the OUs are enrolled in AWS Control Tower.
Which solution will meet these requirements in the MOST automated way?
Options
Discussion
D vs B here. Pretty sure it's D because Customizations for AWS Control Tower is meant for automating these deployments automatically on new account creation, with CodeCommit making it seamless. Saw similar suggestion in the official guide and labs.
Be respectful. No spam.
Q: 18
A company manages a web application that runs on Amazon EC2 instances behind an Application
Load Balancer (ALB). The EC2 instances run in an Auto Scaling group across multiple Availability
Zones. The application uses an Amazon RDS for MySQL DB instance to store the dat
a. The company has configured Amazon Route 53 with an alias record that points to the ALB.
A new company guideline requires a geographically isolated disaster recovery (DR> site with an RTO
of 4 hours and an RPO of 15 minutes.
Which DR strategy will meet these requirements with the LEAST change to the application stack?
Options
Discussion
B tbh, this setup feels right based on official guide and practice test questions.
Be respectful. No spam.
Q: 19
A development team uses AWS CodeCommit, AWS CodePipeline, and AWS CodeBuild to develop
and deploy an application. Changes to the code are submitted by pull requests. The development
team reviews and merges the pull requests, and then the pipeline builds and tests the application.
Over time, the number of pull requests has increased. The pipeline is frequently blocked because of
failing tests. To prevent this blockage, the development team wants to run the unit and integration
tests on each pull request before it is merged.
Which solution will meet these requirements?
Options
Discussion
B is wrong, D. If the requirement was about the best way to enforce pre-merge tests (like a gating rule), would that change which AWS service or method you'd pick? The official guide covers this distinction.
Be respectful. No spam.
Q: 20
A company runs an application on one Amazon EC2 instance. Application metadata is stored in
Amazon S3 and must be retrieved if the instance is restarted. The instance must restart or relaunch
automatically if the instance becomes unresponsive.
Which solution will meet these requirements?
Options
Discussion
C/D? Since EC2 Auto Recovery handles system failure but not app-level issues, but OpsWorks feels a bit heavyweight for just restart plus S3.
Be respectful. No spam.
Question 11 of 20 · Page 2 / 2