QUESTION 161
A company is developing a mobile app that requires extensive automated testing across multiple device types. The company is using AWS CodePipeline for its CI/CD pipeline. The company must implement a scalable testing solution that can handle increased test loads as the app grows. Which solution will meet these requirements with the LEAST management overhead?

A. Integrate AWS Device Farm with the pipeline to run the tests and scale as needed.
B. Deploy a fleet of Amazon EC2 instances with various mobile device emulators and auto scaling to run the tests. Create a custom AWS Lambda function to invoke EC2 test runs.
C. Implement a containerized testing solution that uses Amazon Elastic Container Service (Amazon ECS) with auto scaling. Configure the pipeline to invoke an AWS Lambda function to start the test runs on the ECS cluster.
D. Use AWS Lambda functions with custom runtime emulators to run the tests. Integrate the Lambda functions with the pipeline.

Correct Answer: A

QUESTION 162
A company frequently creates Docker images of an application. The company stores the images in Amazon Elastic Container Registry (Amazon ECR). The company creates both tagged images and untagged images. The company wants to implement a solution to automatically delete images that have not been updated for a long time and are not frequently used. The solution must retain at least a specified number of images. Which solution will meet these requirements with the LEAST operational overhead?

A. Use Amazon S3 Lifecycle policies on the ECR repository to automatically delete images based on image age or the absence of tags on the image.
B. Use Amazon ECR lifecycle policies to delete images based on age or the number of images that need to be to retained in the repository.
C. Configure an AWS Lambda function to run a schedule to delete images based on age or the number of images that need to be retained in the repository.
D. Use AWS Systems Manager to run a script by using the aws:executeScript action to automatically delete images based on image age or the absence of tags on the image.

Correct Answer: B

QUESTION 163
A company has an organization in AWS Organizations. The organization has all features enabled and has AWS CloudTrail trusted access configured for the management account. An Amazon Simple Notification Service (Amazon SNS) topic is configured for notifications. The company needs all AWS events in all AWS Regions in the organization to be recorded and retained in an audit account. The company needs near real-time notifications of any failed login attempts. A DevOps engineer has created an organization trail in the management account to log events for all Regions. Which solution will meet these requirements with the LEAST operational effort?

A. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account. In the audit account, create an Amazon EventBridge rule that reacts to failed login events in CloudTrail. Configure the EventBridge rule to notify the SNS topic.
B. Configure the trail to publish logs to a new Amazon S3 bucket in the management account. Configure an Amazon Athena table to read from the new S3 bucket. Create an AWS Lambda function hat queries the Athena table for failed login events and publishes the findings to the SNS topic. Create an Amazon EventBridge scheduled rule to invoke the Lambda function every 5 minutes.
C. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account and a new Amazon CloudWatch log group in the management account. Create a CloudWatch Logs metric filter on the log group to create a custom metric for failed logins. Configure a CloudWatch alarm that uses the custom metric and notifies the SNS topic.
D. Configure the trail to publish logs to a new Amazon CloudWatch log group in the audit account. Create an Amazon Kinesis data stream in the audit account. Configure a subscription filter on the log group to send the logs to the data stream. Use Amazon Managed Service for Apache Flink to filter the data stream for failed logins. Publish the results to the SNS topic.

Correct Answer: A

QUESTION 164
A company produces builds for an open source project every day. The company hosts the open source project in a public code repository that the company supports. The company manually invokes a pipeline in AWS CodePipeline to build artifacts for the project. The company wants to make the build artifacts publicly available on a website that the company hosts in an Amazon S3 bucket. Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AWS CodeBuild project. Set the public repository as the source. Use a webhook to rebuild when the company pushes a code change. Configure the artifacts section of the project to use the S3 bucket as the destination. Set up an appropriate path to store build outputs in the bucket. Disable artifact encryption.
B. Create an AWS CodeBuild project. Set the public repository as the source. Configure the artifacts section of the project to use the S3 bucket as the destination. Ensure that artifact encryption is enabled in the artifacts configuration. Configure an Amazon EventBridge rule to initiate the CodeBuild project on a daily schedule.
C. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Update the pipeline to run in response to pull requests to the public repository.
D. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Create an Amazon EventBridge rule to initiate the pipeline on a daily schedule.

Correct Answer: D

QUESTION 165
A global company uses Amazon S3 to host its product catalog website in the us-east-1 Region. The company must improve website performance for users across different geographical regions and must reduce the load on the origin server. The company must implement a highly available cross-Region solution that uses Amazon CloudFront. Which solution will meet these requirements with the LEAST operational effort?

A. Set up multiple CloudFront distributions. Point each distribution to another S3 bucket in a different Region. Use Amazon Route 53 latency-based routing to direct users to the nearest distribution. Enable S3 replication between the S3 bucket in us-east-1 and the S3 bucket in the different Region.
B. Enable CloudFront with Origin Shield in us-east-1. Configure global edge locations. Set up cache behaviors with optimal TTLs for static content and dynamic content. Configure origin failover to an S3 bucket in a different Region. Enable S3 replication between the S3 bucket in us-east-1 and the S3 bucket in the different Region.
C. Enable CloudFront with Origin Shield in us-east-1. Configure Amazon ElastiCache clusters in multiple Regions to serve as a distributed caching layer between CloudFront and the S3 origin. Set up a replication script to synchronize the S3 bucket in us-east-1 to an S3 bucket in a different Region. Use Amazon EventBridge to schedule the script to run once a day.
D. Enable CloudFront with Origin Shield in the eu-west-1 Region. Configure Regional edge caches. Implement AWS Global Accelerator to route requests to the nearest Regional edge location. Enable S3 replication between the S3 bucket in us-east-1 and an S3 bucket in a different Region.

Correct Answer: B

QUESTION 166
A company requires all its employees to access secrets and parameters through AWS Systems Manager Parameter Store. All secrets must automatically rotate every 60 days. A DevOps engineer must add a new secret to give an application access to an Amazon ElastiCache (Redis OSS) cluster. Which solution will meet these requirements with the LEAST operational overhead?

A. Create the secret in AWS Secrets Manager. Enable managed rotation. Set the rotation frequency to 60 days. Configure the application to reference the secret value by using the fully qualified path in Parameter Store.
B. Create the secret in Parameter Store. Enable automatic rotation. Set the rotation frequency to 60 days. Configure the application to reference the secret value by using the fully qualified path in Parameter Store.
C. Create the secret in Parameter Store. Create an AWS Lambda function to rotate the secret. Configure an Amazon EventBridge event to invoke the Lambda function every 60 days. Configure the application to provide the unique secret name to Parameter Store to retrieve the secret.
D. Create the secret in AWS Secrets Manager. Enable rotation by AWS Lambda function. Use the Secrets Manager provided Lambda template for ElastiCache (Redis OSS) secrets. Set the rotation schedule to 60 days. Set a rotation window duration in Secrets Manager. Configure the application to provide the full reserved path to Parameter Store when the application accesses the secret.

Correct Answer: D

QUESTION 167
A company wants to build a pipeline to update the standard AMI monthly. The AMI must be updated to use the most recent patches to ensure that launched Amazon EC2 instances are up to date. Each new AMI must be available to all AWS accounts in the company’s organization in AWS Organizations. The company needs to configure an automated pipeline to build the AMI. Which solution will meet these requirements with the MOST operational efficiency?

A. Create an AWS CodePipeline pipeline that uses AWS CodeBuild. Create an AWS Lambda function to run the pipeline every month. Create an AWS CloudFormation template. Share the template with all AWS accounts in the organization.
B. Create an AMI pipeline by using EC2 Image Builder. Configure the pipeline to distribute the AMI to the AWS accounts in the organization. Configure the pipeline to run monthly.
C. Create an AWS CodePipeline pipeline that runs an AWS Lambda function to build the AMI. Configure the pipeline to share the AMI with the AWS accounts in the organization. Configure Amazon EventBridge Scheduler to invoke the pipeline every month.
D. Create an AWS Systems Manager Automation runbook. Configure the automation to run in all AWS accounts in the organization. Create an AWS Lambda function to run the automation every month.

Correct Answer: B

QUESTION 168
A company has implemented a new microservices-based application on an Amazon Elastic Container Service (Amazon ECS) cluster. After each deployment, the company wants to validate the critical user journeys and API endpoints before routing traffic to the new application version. The company must implement an automated solution to detect issues in the new deployment and to initiate a rollback if necessary. Which solution will meet these requirements with the LEAST operational overhead?

A. Set up Amazon CloudWatch Application Insights for the ECS cluster. Create an Amazon EventBridge rule to invoke an AWS Lambda function to analyze the task states. Program the Lambda function to use the ECS UpdateService API call to initiate a rollback if a specific percentage of tasks fail.
B. Set up Amazon CloudWatch Application Insights for the ECS cluster. Configure Application Insights to monitor key performance indicators of the microservices in the critical user journeys and API calls. Create CloudWatch alarms based on the insights. Use Amazon EventBridge to invoke an AWS Step Functions workflow to evaluate the alarms. Configure the workflow to initiate a rollback if necessary by using the alarms’ built-in integration with Amazon ECS.
C. Create CloudWatch Synthetics canaries that simulate critical user journeys and API calls. Implement AWS X-Ray tracing for all the microservices. Configure X-Ray to send traces to CloudWatch. Create CloudWatch alarms based on error rates and latency metrics. Create an AWS Lambda function to analyze the traces and to initiate a rollback if necessary by using the alarms’ built-in integration with Amazon ECS.
D. Create CloudWatch Synthetics canaries that simulate critical user journeys and AP| calls. Configure the canaries to run against the new deployment. Create CloudWatch alarms that are invoked when canaries fail. Use the alarms’ built-in integration with Amazon ECS to initiate a rollback if the alarms are invoked before traffic is routed to the new deployment.

Correct Answer: D

QUESTION 169
A company has a stateless web application that is deployed on Amazon EC2 instances. The EC2 instances are in a target group behind an Application Load Balancer (ALB). Amazon Route 53 manages the application domain. The company updates the application Ul and develops a beta version of the application. The company wants to test the beta version on 10% of its traffic. Which solution will meet these requirements with the LEAST number of configuration changes?

A. Deploy the beta version to new EC2 instances in a new target group. Associate the new target group with a new ALB. Update the existing Route 53 record to use a weighted routing policy. Add a new Route 53 record that points to the new ALB with the same routing policy. Assign a weight of 90 to the existing record. Assign a weight of 10 to the new record.
B. Deploy the beta version to new EC2 instances in a new target group. Associate the new target group with the same ALB listener rule. Assign a weight of 90 to the existing target group. Assign eight of 10 to the new target group.
C. Refactor the application to implement a feature flag for the beta version by using AWS AppConfig. Use the feature flag to enable the beta version for 10% of the EC2 instances.
D. Containerize and deploy the application on Amazon Elastic Container Service (Amazon ECS). Use AWS CodeDeploy to deploy the beta version by using the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.

Correct Answer: B

QUESTION 170
A company runs an application as an Amazon Elastic Container Service (Amazon ECS) task to process messages from an Amazon Simple Queue Service (Amazon SQS) queue. The ECS task runs on a schedule to process the SQS queue every 10 minutes. A high volume of messages was delivered to the SQS queue. The application took several hours to process all the messages. The company’s new service level objective (SLO) requires that the application must process messages within 10 minutes of delivery. A DevOps engineer needs to configure the application to meet the SLO while minimizing idle running resources. Which solution meets these requirements with the MOST operational efficiency?

A. Configure a step scaling policy for the ECS task. Configure the step scaling policy to use the ECSServiceAverageMemoryUtilization metric. Set the maximum number of tasks to equal the number of messages the application receives at peak hours.
B. Configure a target tracking scaling policy for the ECS task. Calculate the number of messages for each task by using the SQS ApproximateNumberOfMessagesVisible metric and the ECS RunningTaskCount metric. Scale the number of tasks based on the calculated attribute.
C. Create a scheduled scaling policy to increase the number of ECS tasks available during peak volume periods. Set the schedule as a cron for the application’s peak hours. Set the maximum number of tasks to equal the number of messages the application receives at peak hours.
D. Create a predictive scaling policy to increase the number of available ECS tasks during peak volume periods. Configure the predictive scaling policy to use the ECSServiceAverageCPUUtilization metric. Set the maximum number of tasks to equal the number of messages the application receives at peak hours.

Correct Answer: B

QUESTION 171
A development team manually builds a local artifact. The development team moves the artifact to an Amazon S3 bucket to support an application. The application has a local cache that must be cleared when the development team deploys the application to Amazon EC2 instances. For each deployment, the development team runs a command to clear the cache, download the artifact from the S3 bucket, and unzip the artifact to complete the deployment. The development team wants to migrate the deployment process to a CI/CD process and to track the progress of each deployment. Which combination of actions will meet these requirements with the MOST operational efficiency? (Select THREE.)

A. Set up an AWS CodeConnections compatible Git repository. Allow developers to merge code into the repository. Use AWS CodeBuild to build an artifact and copy the object into the S3 bucket. Configure CodeBuild to run for every merge into the main branch.
B. Create a custom script to clear the cache. Specify the script in the BeforeInstall lifecycle hook in the AppSpec file.
C. Create user data for each EC2 instance that contains the cache clearing script. Test the application after deployment. If the deployment is not successful, then redeploy.
D. Use AWS CodePipeline to deploy the application. Set up an AWS CodeConnections compatible Git repository. Allow developers to merge code into the repository as a source for the pipeline.
E. Use AWS CodeBuild to build the artifact and place the artifact in the S3 bucket. Use AWS CodeDeploy to deploy the artifact to EC2 instances.
F. Use AWS Systems Manager to fetch the artifact from the S3 bucket and to deploy the artifact to all the EC2 instances.

Correct Answer: BDE

QUESTION 172
A DevOps engineer is designing a solution to centrally ingest and process a large amount of Amazon CloudWatch logs that multiple applications produce. The solution must collect all the CloudWatch logs from multiple AWS accounts, process the logs in real time, and store the processed logs in an Amazon S3 bucket. Which solution will meet these requirements with the LEAST implementation effort?

A. Create an S3 bucket in a single AWS account. Create an export task for each CloudWatch Logs log group and set the S3 bucket as the destination. Create an Amazon EventBridge rule that invokes the export task every hour.
B. Create an S3 bucket, an Amazon Kinesis data stream, and an Amazon Data Firehose delivery stream in a single AWS account. Create a CloudWatch Logs subscription filter for each CloudWatch Logs log group. Set the Kinesis data stream as the destination of the subscription filter. Set the Kinesis data stream as the source for the S3 bucket and as the destination for the Firehose delivery stream.
C. Create an S3 bucket and an Amazon Data Firehose delivery stream in a single AWS account. Create a CloudWatch Logs subscription filter for each CloudWatch Logs log group and set the Firehose delivery stream as the destination. Set the S3 bucket as the destination for the Firehose delivery stream.
D. Create an S3 bucket and an Amazon Data Firehose delivery stream in a single AWS account. Create an account-level CloudWatch Logs subscription filter and set the Firehose delivery stream as the destination. Set the S3 bucket as the destination for the Firehose delivery stream.

Correct Answer: D

QUESTION 173
A company has a public application that uses an Amazon API Gateway REST API, an AWS Lambda function, and an Amazon RDS for PostgreSQL DB cluster. Users have recently received error messages as application demand increased. The company’s DevOps engineer discovered that the errors were caused by RDS connection limits being reached. The DevOps engineer also discovered that more than 90% of the API requests are GET requests that read from the DB cluster. How should the DevOps engineer solve this problem with the LEAST development effort?

A. Migrate from Amazon RDS to Amazon DynamoDB. Add an Amazon CloudFront distribution in front of the API Gateway REST API.
B. Add a proxy from Amazon RDS Proxy in front of the RDS DB cluster. Enable API caching in API Gateway.
C. Add an Amazon RDS Proxy in front of the RDS database cluster. Provision an Amazon ElastiCache (Redis OSS) cluster.
D. Migrate from Amazon RDS to Amazon DynamoDB. Enable API caching in API Gateway.

Correct Answer: B

QUESTION 174
A DevOps team is deploying microservices for an application on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The cluster uses managed node groups. The DevOps team wants to enable auto scaling for the microservice Pods based on a specific CPU utilization percentage. The DevOps team has already installed the Kubernetes Metrics Server on the cluster. Which solution will meet these requirements in the MOST operationally efficient way?

A. Edit the Auto Scaling group that is associated with the worker nodes of the EKS cluster. Configure the Auto Scaling group to use a target tracking scaling policy to scale when the average CPU utilization of the Auto Scaling group reaches a specific percentage.
B. Deploy the Kuberetes Horizontal Pod Autoscaler (HPA) and the Kubernetes Vertical Pod Autoscaler (VPA) in the cluster. Configure the HPA to scale based on the target CPU utilization percentage. Configure the VPA to use the recommender mode setting.
C. Run the AWS Systems Manager AWS-UpdateEKSManagedNodeGroup Automation document. Modify the values for NodeGroupDesiredSize, NodeGroupMaSize, and NodeGroupMinSize to be based on an estimate for the required node size.
D. Deploy the Kuberetes Horizontal Pod Autoscaler (HPA) and the Kubernetes Cluster Autoscaler in the cluster. Configure the HPA to scale based on the target CPU utilization percentage. Configure the Cluster Autoscaler to use the auto-discovery setting.

Correct Answer: D

QUESTION 175
A DevOps engineer uses AWS Control Tower to deploy multiple AWS accounts to support business, technical, and administrative units in a company. A security team needs the DevOps engineer to automate AWS Control Tower guardrails for the company. The guardrails must be applied to all accounts in an OU of the company’s organization in AWS Organizations. The security team needs a solution that has version control features. The security team must be able to review and roll back versions when necessary. The security team will manage the solution in the security team’s OU. The security team wants to specify the types of guardrails that are allowed. The security team wants to allow only new guardrails that the security team approves. Which solution will meet these requirements with the MOST operational efficiency?

A. Create an AWS CloudFormation template for each required guardrail. Store the templates in an AWS CodeConnections compatible Git repository. Create an AWS::ControlTower::EnableControl logical resource in the template for each OU in the organization. Configure an AWS CodeBuild project that clones the Git repository and applies the template.
B. Create an individual AWS CloudFormation template for each required guardrail. Store the templates in an AWS CodeConnections compatible Git repository. Create an AWS::Control Tower::EnableControl logical resource in the template for each account in the organization. Configure a pipeline in AWS CodePipeline in the security team’s account. Ensure that the security team manually invokes the pipeline and specifies the guardrail parameters when the security team starts each deployment.
C. Create an individual AWS CloudFormation template for required guardrail. Store the templates in an AWS CodeConnections compatible Git repository. Create an AWS::Control Tower::EnableControl logical resource in the template for each OU in the organization. Configure a pipeline in AWS CodePipeline in the security team’s account. Configure an Amazon EventBridge rule to initiate the pipeline in response to merges to the security team’s Git repository.
D. Create a pipeline in AWS CodePipeline in the security team’s account. Add an Amazon EventBridge rule to the pipeline that matches on PutObject events to an Amazon S3 bucket. Create an individual AWS CloudFormation template for each required guardrail. Store the templates in the S3 bucket. Create an AWS::Control Tower::EnableControl logical resource in the template for each OU in the organization.

Correct Answer: C

QUESTION 176
A software engineering team is using AWS CodeDeploy to deploy a new version of an application. The team wants to ensure that if any issues arise during the deployment, the process can automatically roll back to the previous version. During the deployment process, a health check confirms the application’s stability. If the health check fails, the deployment must revert automatically. Which solution will meet these requirements?

A. Implement lifecycle event hooks in the deployment configuration.
B. Use AWS CloudFormation to monitor the health of the deployment.
C. Set up alarms in Amazon CloudWatch to start a rollback.
D. Configure automatic rollback settings in AWS CodeDeploy.

Correct Answer: D

QUESTION 177
A company built its serverless infrastructure on AWS. The infrastructure consists of an Amazon API Gateway REST API, multiple AWS Lambda functions, and Amazon EventBridge. The company wants to be aware of any new supply chain attacks that the company’s CI/CD pipelines do not catch. The company needs a solution to detect malicious activity in the deployed application. Which solution meets these requirements?

A. Enable AWS WAF for the API Gateway REST API. Configure an AWS WAF ACL. Add the known bad inputs managed rule group.
B. Enable Amazon GuardDuty. Enable Lambda Protection. Use EventBridge for event notifications.
C. Deploy AWS CloudFormation Guard in the CI/CD pipelines. Write rules to catch the supply chain attacks.
D. Create a firewall in AWS Network Firewall. Configure a policy. Add the managed rule for the Emerging Threats rule group.

Correct Answer: B

QUESTION 178
A company deploys its application by using AWS CodePipeline. The pipeline deploys to a staging environment and then to a production environment if the staging deployment succeeds. A recent production deployment was manually rolled back because a large amount of customer traffic caused unexpected system behavior. The company needs to configure the pipeline to prevent this issue in future deployments. Which solution will meet these requirements with the LEAST operational overhead?

A. Create a new step in the pipeline after the deployment to the staging environment. Configure an AWS CodeBuild action to run a load test against the application in the staging environment. Create another step after the testing step to invoke an AWS Lambda function that evaluates whether the pipeline should proceed.
B. Create a new step in the pipeline after the deployment to the staging environment. Configure an AWS CodeBuild action to run a load test against the application in the staging environment. Create another step after the load testing step for manual approval.
C. Create a new step in the pipeline after the deployment to the staging environment. Configure an AWS CodeBuild action to run unit tests against the code base and performance tests. Create another step after the testing step to invoke an AWS Lambda function that evaluates the results to determine success or failure. If the evaluation fails, roll back the staging deployment.
D. Create a new step in the pipeline after the deployment to the staging environment. Configure an AWS CodeBuild action to run unit tests against the code base and performance tests. Create another step after the testing step for manual approval.

Correct Answer: B

QUESTION 179
A company uses AWS CodePipeline and AWS CodeDeploy to deploy application code to Amazon EC2 instances. The EC2 instances send application logs and CodeDeploy logs to Amazon CloudWatch. Recently, the company manually rolled back a deployment because of application errors. The company wants to automate the rollback process when application errors occur. Which solution will meet these requirements?

A. Create a CloudWatch metric based on the application logs. Create a CloudWatch alarm based on the metric that will activate when application errors occur. Change the deployment group settings to use the CloudWatch alarm configuration. Configure the deployment group to use an auto rollback configuration.
B. Configure a CloudWatch alarm that uses a custom metric for application errors that are recorded in the CodeDeploy agent logs. Configure the current deployment to use the CloudWatch alarm for its alarm configuration. Configure the deployment to use an auto rollback configuration.
C. Create an AWS Lambda function that will create a new deployment by using the last successful application deployment. Create an Amazon EventBridge rule that matches events from CodeDeploy that have a deployment status of FAILURE. Configure the EventBridge rule to target the Lambda function.
D. Create an AWS Lambda function that will create a new deployment group for the application deployment. Create a CloudWatch alarm based on metrics from the application logs. Configure the alarm to activate when an application error occurs on an EC2 instance. Configure the CloudWatch alarm to invoke the Lambda function.

Correct Answer: A

QUESTION 180
A video-sharing company stores its videos in an Amazon S3 bucket. The company needs to analyze user access patterns such as the number of users who access a specific video each month. Which solution will meet these requirements with the LEAST development effort?

A. Enable Amazon S3 server access logging. Load the access logs into an Amazon Aurora database. Run SQL queries on the Aurora database to analyze the user access patterns.
B. Enable Amazon S3 server access logging. Use Amazon Athena to create an external table that contains the access logs. Run SQL queries on the Athena table to analyze the user access patterns.
C. Invoke an AWS Lambda function for every S3 object access event. Configure the Lambda function to write the file access information, including user ID, S3 bucket ID, and file key, to an Amazon Aurora database. Run SQL queries on the Aurora database to analyze the user access patterns.
D. Record a log message in Amazon CloudWatch Logs for every S3 object access event. Configure a log stream in CloudWatch Logs to write the file access information, including user ID, S3 bucket ID, and file key, to an Amazon Managed Service for Apache Flink application. Perform a sliding window analysis on the user access patterns.

Correct Answer: B