QUESTION 141
A company runs a microservices application on Amazon Elastic Kubernetes Service (Amazon EKS). Users recently reported significant delays while accessing an account summary feature, particularly during peak business hours. A DevOps engineer used Amazon CloudWatch metrics and logs to troubleshoot the issue. The logs indicated normal CPU and memory utilization on the EKS nodes. The DevOps engineer was not able to identify where the delays occurred within the microservices architecture. The DevOps engineer needs to increase the observability of the application to pinpoint where the delays are occurring. Which solution will meet these requirements?

A. Deploy the AWS X-Ray daemon as a DaemonSet in the EKS cluster. Use the X-Ray SDK to instrument the application code. Redeploy the application.
B. Enable CloudWatch Container Insights for the EKS cluster. Use the Container Insights data to diagnose the delays.
C. Create alarms based on the existing CloudWatch metrics. Set up an Amazon Simple Notification Service (Amazon SNS) topic to send email alerts.
D. Increase the timeout settings in the application code for network operations to allow more time for operations to finish.

Correct Answer: A

QUESTION 142
A company is developing an ecommerce application on AWS. The company wants to make sure that the application can handle sudden increases in traffic. The company uses AWS CodePipeline for its CI/CD process. The company must implement a solution to integrate automated load testing into the CI/CD pipeline to validate the application’s performance. The solution must perform production deployment only if the performance exceeds a threshold. Which solution will meet these requirements with the LEAST operational overhead?

A. Deploy the application by using AWS Elastic Beanstalk. Enable load balancing. Use Elastic Beanstalk to deploy tools for load tests. Run the tests during each deployment, and roll back the deployment if performance thresholds are unmet. Create an AWS Lambda function to monitor test metrics. Set up alarms for performance thresholds. Configure Amazon EventBridge to return an error if a test fails and to proceed with production deployment if a test passes.
B. Implement AWS Fargate tasks to run tools for load tests. Use Amazon Elastic Container Service (Amazon ECS) to manage the test containers. Create AWS Lambda functions to analyze the test results. Integrate the functions with CodePipeline by using custom actions to initiate and evaluate the tests. Program the functions to return an error if a test fails and to proceed with production deployment if a test passes.
C. Launch Amazon EC2 instances to run tools for load tests. Store test scripts in a GitHub repository. Use AWS Step Functions to orchestrate the tests and result analysis in the CodePipeline workflow. Use Amazon EventBridge to invoke an AWS Lambda function based on the test results. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.
D. Use AWS CodeBuild to run tools for load tests, store the test artifacts in Amazon S3, and configure a CodePipeline stage to invoke the CodeBuild project. Use Amazon CloudWatch to monitor the test metrics and to set up alarms for performance thresholds. Integrate an AWS Lambda function into the pipeline by using a custom action. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.

Correct Answer: D

QUESTION 143
A company has a web application that is hosted on Amazon EC2 instances. The company is deploying the application into multiple AWS Regions. The application consists of dynamic content such as WebSocket-based real-time product updates. The company uses Amazon Route 53 to manage all DNS records. Which solution will provide multi-Region access to the application with the LEAST latency?

A. Deploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Create a Route 53 A record with a latency-based routing policy. Add IP addresses of the ALBs as the value of the record.
B. Deploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Deploy an Amazon CloudFront distribution with an origin group that contains the ALBs as origins. Create a Route 53 alias record that points to the CloudFront distribution’s DNS address.
C. Deploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Create a Route 53 A record with a multivalue answer routing policy. Add IP addresses of the NLBs as the value of the record.
D. Deploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Deploy an AWS Global Accelerator standard accelerator with an endpoint group for each NLB. Create a Route 53 alias record that points to the accelerator’s DNS address.

Correct Answer: D

QUESTION 144
A DevOps engineer is creating a CI/CD pipeline to build container images. The engineer needs to store container images in Amazon Elastic Container Registry (Amazon ECR) and scan the images for common vulnerabilities. The CI/CD pipeline must be resilient to outages in upstream source container image repositories. Which solution will meet these requirements?

A. Create an ECR private repository in the private registry to store the container images and scan images when images are pushed to the repository. Configure a replication rule in the private registry to replicate images from upstream repositories.
B. Create an ECR public repository in the public registry to cache images from upstream source repositories. Create an ECR private repository to store images. Configure the private repository to scan images when images are pushed to the repository.
C. Create an ECR public repository in the public registry. Configure a pull through cache rule for the repository. Create an ECR private repository to store images. Configure the ECR private registry to perform basic scanning.
D. Create an ECR private repository in the private registry to store the container images. Enable basic scanning for the private registry, and create a pull through cache rule.

Correct Answer: D

QUESTION 145
A company uses a Git provider that is compatible with AMS Code services with credential authentication support as version control for application code. The company wants to package the code and make it available when it is merged. The packaged code must be available as an upstream source for future packaged code. Which combination of steps will meet these requirements? (Select TWO.)

A. Create an AWS Secrets Manager secret that holds the Git provider credentials. Create an AWS CodeBuild project that integrates with the Git repository by using the Secrets Manager secret and a corresponding webhook.
B. Create an AWS Parameter Store secure string parameter that holds the Git provider credentials. Create an AWS CodeBuild project that integrates with the Git repository by using the secure string parameter and a corresponding webhook.
C. Create an AWS Secrets Manager secret that holds the Git provider credentials. Create an AWS CodeBuild project that define a Secrets Manager environment variable in the buildspec. Use the environment variable to configure a mirror of the Git repository during the install phase.
D. Create an AWS CodeArtifact domain and repository. Configure the AWS CodeBuild project to package the CodeBuild project’s output artifact and upload the artifact to the CodeArtifact repository.
E. Create an Amazon S3 bucket. Configure the AWS CodeBuild project to package and upload the artifact to the S3 bucket.

Correct Answer: CD

QUESTION 146
A company uses AWS Lambda functions to create a serverless application. The company uses a pipeline in AWS CodePipeline to manage application deployment. Every Lambda function in the application is tagged with the application’s name. A DevOps engineer wants to use AWS Fault Injection Service (AWS FIS) to add invocation latency testing to the application in the existing pipeline. The DevOps engineer adds an experiment stage to the pipeline. Which solutions will meet this requirement? (Select TWO.)

A. Use AWS Step Functions to create a state machine. Use an AWS FIS experiment template ID as an input parameter. Add the state machine to an experiment stage in the pipeline as an action group. Select Step Functions as the action provider.
B. Add the AWS FIS template to an experiment stage in the pipeline as the action provider for an action group.
C. Create a Lambda function to invoke the AWS FIS experiment template by using experimentTemplateID as an input parameter. Configure the Lambda function to allow the fis:CreateExperimentTemplate action and the fis:List* action. Add the Lambda function to an experiment stage in the pipeline as an action group. Select the Lambda function as the action provider.
D. Use the aws: lambda:invocation-add-delay action to create an AWS FIS template. Use the application name tag to select the application’s Lambda functions.
E. Use the aws:lambda:invocation-http-integration-response action to create an AWS FIS template. Use the application name tag to select the application’s Lambda functions.

Correct Answer: AC

QUESTION 147
A company is migrating its web application to AWS. The application uses WebSocket connections for real-time updates and requires sticky sessions. A DevOps engineer must implement a highly available architecture for the application. The application must be accessible to users worldwide with the least possible latency. Which solution will meet these requirements with the LEAST operational overhead?

A. Deploy an Application Load Balancer (ALB). Deploy another ALB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the ALBs. Integrate the ALBs with Amazon Route 53 latency-based routing.
B. Deploy a Network Load Balancer (NLB). Deploy another NLB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the NLBs. Integrate the NLBs with Amaz Route 53 geolocation routing.
C. Deploy a Network Load Balancer (NLB) with cross-zone load balancing enabled. Configure the NLB with IP-based targets in multiple Availability Zones. Use Amazon CloudFront for global content delivery. Implement sticky sessions by using source IP address preservation on the NLB.
D. Deploy an Application Load Balancer (ALB) for HTTP traffic. Deploy a Network Load Balancer (NLB) in each of the company’s AWS Regions for WebSocket connections. Enable sticky sessions on the ALB. Configure the ALB to forward requests to the NLB.

Correct Answer: A

QUESTION 148
A company in a highly regulated industry is building an artifact by using AWS CodeBuild and AWS CodePipeline. The company must connect to an external authenticated API during the building process. The company’s DevOps engineer needs to encrypt the build outputs by using an AWS Key Management Service (AWS KMS) key. The external API credentials must be reset each month. The DevOps engineer has created a new key in AWS KMS. Which solution will meet these requirements?

A. Store the API credentials in AWS Systems Manager Parameter Store. Update the key policy for the CodeBuild IAM service role to have access to the KMS key. Set CODEBUILD_KMS_KEY_ID as the new key ID.
B. Store the API credentials in AWS Systems Manager Parameter Store. Update the key policy for the CodePipeline IAM service role to have access to the KMS key. Add the key to the pipeline.
C. Store the API credentials in AWS Secrets Manager. Update the key policy for the CodeBuild IAM service role to have access to the KMS key. Set CODEBUILD_KMS_KEY_ID as the new key ID.
D. Store the API credentials in AWS Secrets Manager. Update the key policy for the CodePipeline IAM service role to have access to the KMS key. Add the key to the pipeline.

Correct Answer: C

QUESTION 149
A company has application code in an AWS CodeConnections compatible Git repository. The company wants to configure unit tests to run when pull requests are opened. The company wants to ensure that the test status is visible in pull requests when the tests are completed. The company wants to save output data files that the tests generate to an Amazon S3 bucket after the tests are finished. Which combination of solutions will meet these requirements? (Select THREE.)

A. Create an IAM service role to allow access to the resources that are required to run the tests.
B. Create a pipeline in AWS CodePipeline that has a test stage. Create a trigger to run the pipeline when pull requests are created or updated. Add a source action to report test results.
C. Create an AWS CodeBuild project to run the tests. Enable webhook triggers to run the tests when pull requests are created or updated. Enable build status reporting to report test results.
D. Create a buildspec.yml file that has a reports section to upload output files when the tests have finished running.
E. Create a buildspec.yml file that has an artifacts section to upload artifacts when the tests have finished running.
F. Create an appspec.yml file that has a files section to upload output files when the tests have finished running.

Correct Answer: ACE

QUESTION 150
A company uses a trunk-based development branching strategy. The company has two AWS CodePipeline pipelines that are integrated with a Git provider. The pull request pipeline has a branch filter that matches the feature branches. The main_branch pipeline has a branch filter that matches the main branch. When pull requests are merged into the main branch, the pull requests are deployed by using the main_branch pipeline. The company’s developers need test results for all submitted pull requests as quickly as possible from the pull request pipeline. The company wants to ensure that the main_branch pipeline’s test results finish and that each deployment is complete before the next pipeline execution. Which solution will meet these requirements?

A. Configure the pull request pipeline to use PARALLEL mode. Configure the main_branch pipeline to use QUEUED mode.
B. Configure the pull request pipeline to use SUPERSEDED mode. Configure the main _branch pipeline to use QUEUED mode.
C. Configure the pull request pipeline to use PARALLEL mode. Configure the main branch pipeline to use SUPERSEDED mode.
D. Configure the pull_request pipeline to use QUEUED mode. Configure the main_branch pipeline to use SUPERSEDED mode.

Correct Answer: B

QUESTION 151
A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region disaster recover (DR) strategy for the S3 objects. The DevOps engineer enables two-way replication between the S3 buckets. The company must be able to fail over to a second S3 bucket that is in a second AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes. Which combination of steps will meet these requirements in the MOST operationally efficient way? (Select THREE.)

A. Enable S3 Replication Time Control (S3 RTC) for each replication rule used in the configuration.
B. Create an S3 Multi-Region Access Point in an active-passive configuration.
C. Call the SubmitMultiRegionAccessPointRoutes operation in the Amazon S3 API when the company needs to fail over to the S3 bucket in the second Region.
D. Enable S3 Transfer Acceleration on both S3 buckets.
E. Configure a routing control in Amazon Route 53 Application Recovery Controller. Add both S3 buckets in an active-passive configuration.
F. Use an Amazon Route 53 Application Recovery Controller to shift traffic from the primary bucket to the failover bucket in the second Region.

Correct Answer: ABF

QUESTION 152
A company has an AWS account named PipelineAccount. The account manages a pipeline in AWS CodePipeline. The account uses an IAM role named CodePipeline_Service_Role and produces an artifact that is stored in an Amazon S3 bucket. The company uses a customer managed AWS KMS key to encrypt objects in the S3 bucket. A DevOps engineer wants to configure the pipeline to use an AWS CodeDeploy application in an AWS account named CodeDeployAccount to deploy the produced artifact. The DevOps engineer updates the KMS key policy to grant the CodeDeployAccount account permission to use the key. The DevOps engineer configures an IAM role named DevOps_Role in the CodeDeployAccount account that has access to the CodeDeploy resources that the pipeline requires. The DevOps engineer updates an Amazon EC2 instance role that operates within the CodeDeployAccount account to allow access to the S3 bucket and the KMS key that is in the PipelineAccount account. Which additional steps will meet these requirements?

A. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount| account to assume the role. Update the CodePipeline_Service_Role IAM role to grant permission to assume the DevOps_Role role.
B. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the DevOps_Role IAM role to grant permission to assume CodePipeline_ Service_ Role role.
C. Update the S3 bucket policy to grant the PipelineAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the PipelineAccount account to assume the role. Update the CodePipeline _Service_Role IAM to grant permission to assume the DevOps_Role role.
D. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. Configure the DevOps_Role IAM role to have an IAM trust policy that allows the CodeDeployAccount account to assume the role. Update the CodePipeline_ Service Role IAM role to grant permission to assume the DevOps_ Role role.

Correct Answer: D

QUESTION 153
A company runs a development environment website and database on an Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS) storage. The company wants to make the instance more resilient to underlying hardware issues. The company wants to automatically recover the EC2 instance if AWS determines the instance has lost network connectivity. Which solution will meet these requirements?

A. Add the EC2 instance to an Auto Scaling group. Set the minimum, maximum, and desired capacity to 1.
B. Add the EC2 instance to an Auto Scaling group. Configure a lifecycle hook to detach the EBS volume if the EC2 instance shuts down or terminates.
C. Create an Amazon CloudWatch alarm for the StatusCheckFailed System metric. Add an EC2 action to recover the instance when the alarm state is in ALARM.
D. Create an Amazon CloudWatch alarm for the NetworkOut metric. Add an EC2 action to recover the instance when the alarm state is in INSUFFICIENT_DATA.

Correct Answer: C

QUESTION 154
A company is running an application on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs to implement comprehensive logging for the control plane and the nodes. The company must analyze API requests to the Kubernetes control plane and must monitor container performance on the nodes. Which solution will meet these requirements with the LEAST operational overhead?

A. Enable AWS CloudTrail for control plane logging. Deploy Logstash as a ReplicaSet on the nodes to collect logs from the nodes. Use Amazon OpenSearch Service to store and analyze the logs for the control plane and the nodes.
B. Enable control plane logging for the EKS cluster. Send the logs to Amazon CloudWatch. Use CloudWatch Container Insights to collect logs for the nodes and the containers. Use CloudWatch Logs Insights to query and analyze the logs for the control plane and the nodes.
C. Enable API server control plane logging for the EKS cluster. Send the logs to Amazon S3. Deploy Kubernetes Event Exporter to the nodes to collect logs from the nodes. Send the logs to Amazon S3. Use Amazon Athena to query logs for the control plane and the nodes. Use Amazon QuickSight for visualization.
D. Use AWS Distro for OpenTelemetry to collect logs for the control plane and the nodes. Stream all the logs to Amazon Data Firehose. Use Amazon Redshift to analyze the aggregated log data for the control plane and the nodes.

Correct Answer: B

QUESTION 155
A DevOps team is deploying microservices for an application on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The cluster uses managed node groups. The DevOps team wants to enable auto scaling for the microservice Pods based on a specific CPU utilization percentage. The DevOps team has already installed the Kubernetes Metrics Server on the cluster. Which solution will meet these requirements in the MOST operationally efficient way?

A. Edit the Auto Scaling group that is associated with the worker nodes of the EKS cluster. Configure the Auto Scaling group to use a target tracking scaling policy to scale when the average CPU utilization of the Auto Scaling group reaches a specific percentage.
B. Deploy the Kubernetes Horizontal Pod Autoscaler (HPA) and the Kubernetes Vertical Pod Autoscaler (VPA) in the cluster. Configure the HPA to scale based on the target CPU utilization percentage. Configure the VPA to use the recommender mode setting.
C. Run the AWS Systems Manager AWS-UpdateEKSManagedNodeGroup Automation document. Modify the values for NodeGroupDesiredSize, NodeGroupMaxSize, and NodeGroupMinSize to be based on an estimate for the required node size.
D. Deploy the Kubernetes Horizontal Pod Autoscaler (HPA) and the Kubernetes Cluster Autoscaler in the cluster. Configure the HPA to scale based on the target CPU utilization percentage. Configure the Cluster Autoscaler to use the auto-discovery setting.

Correct Answer: D

QUESTION 156
A company is using the AWS Cloud Development Kit (AWS CDK) to develop a microservices-based application. The company needs to create reusable infrastructure components for three environments: development, staging, and production. The components must include networking resources, database resources, and serverless compute resources. The company must implement a solution that provides consistent infrastructure across environments while offering the option for environment-specific customizations. The solution also must minimize code duplication. Which solution will meet these requirements with the LEAST development overhead?

A. Create custom Level 1 (L1) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create a single set of deployment stacks that takes the environment name as an argument upon instantiation. Deploy CDK applications for each environment.
B. Create custom Level 1 (L1) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create separate deployment stacks for each environment. Use the CDK context command to determine which stacks to run when deploying to each environment.
C. Create custom Level 3 (L3) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create a single set of deployment stacks that takes the environment name as an argument upon instantiation. Deploy CDK applications for each environment.
D. Create custom Level 3 (L3) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create separate deployment stacks for each environment. Use the CDK context command to determine which stacks to run when deploying to each environment.

Correct Answer: A

QUESTION 157
A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux. The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present. Which solution will meet these requirements?

A. Create an association in Systems Manager State Manager. Target all the managed nodes. Include the software in the association. Configure the association to use the Systems Manager document.
B. Set up AWS Config to record all the resources in the account. Create an AWS Config custom rule to determine if the software is installed on all the EC2 instances. Configure an automatic remediation action that uses the Systems Manager document for noncompliant EC2 instances.
C. Activate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances. Associate the findings with the Systems Manager document.
D. Create an Amazon EventBridge rule that uses AWS CloudTrail to detect the Runinstances API call. Configure inventory collection in Systems Manager Inventory to determine if the software is installed on the EC2 instances. Associate the Systems Manager inventory with the Systems Manager document.

Correct Answer: A

QUESTION 158
A DevOps engineer is planning to use the AWS Cloud Development Kit (AWS CDK) to manage infrastructure as code (IaC) for a microservices-based application. The DevOps engineer must create reusable components for common infrastructure patterns and must apply the same cost allocation tags across different microservices. Which solution will meet these requirements?

A. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the custom CDK construct library to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment- specific configurations.
B. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the custom CDK construct library to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configuration.
C. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the Service Catalog products to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment- specific configurations.
D. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the Services to add cost allocation tags to the whole app. Use the Service Catalog products to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.

Correct Answer: B

QUESTION 159
A company is using AWS CodeDeploy to deploy applications to a fleet of Amazon EC2 instances. During a recent deployment, several EC2 instances failed to update successfully. A DevOps engineer must investigate the root cause of the failures and must determine which specific deployment lifecycle events encountered errors. What is the MOST operationally efficient way to access and analyze the detailed deployment logs for troubleshooting?

A. Use SSH to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
B. Use AWS Systems Manager Session Manager to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
C. Create an Amazon S3 bucket to store CodeDeploy logs. Update the appspec.ymi file to copy logs to the S3 bucket. Query the S3 bucket by using Amazon Athena.
D. Send CodeDeploy agent logs to Amazon CloudWatch Logs by using the CloudWatch agent. Analyze the logs by using CloudWatch Logs Insights.

Correct Answer: D

QUESTION 160
A DevOps engineer must implement a solution that immediately terminates Amazon EC2 instances in Auto Scaling groups when cryptocurrency mining activity is detected. Which solution will meet these requirements with the LEAST development effort?

A. Configure Amazon Route 53 to send query logs directly to Amazon CloudWatch Logs. Create an AWS Lambda function that runs every 5 minutes and checks the query logs for domains related to cryptocurrency activity. If the domains are found, terminate the identified EC2 instances.
B. Configure VPC Flow Logs to send flow logs to an Amazon S3 bucket. Create an AWS Lambda function that runs every 5 minutes and invokes an Amazon Athena query to find IP addresses associated with cryptocurrency activity. If the IP addresses are found, terminate the identified EC2 instances.
C. Enable Amazon GuardDuty. Monitor EC2 findings. Create an Amazon EventBridge rule with GuardDuty as the event source. Create an AWS Lambda function that is triggered by the EventBridge rule. Configure the Lambda function to parse the event and terminate the identified EC2 instances.
D. Enable AWS Security Hub. Monitor EC2 findings. Create an Amazon EventBridge rule with Security Hub as the event source. Create an AWS Lambda function that is triggered by the EventBridge rule. Configure the Lambda function to parse the event and terminate the identified EC2 instances.

Correct Answer: C