Container images are pushed to Amazon ECR and deployed by a pipeline. The security team requires continuous vulnerability scanning of images, including operating system and programming language packages, and deployments must be blocked when critical vulnerabilities are found. Which two actions meet these requirements?
Enable ECR tag immutability on the repository
Rely on basic scanning on push and review findings weekly
Enable Amazon Inspector enhanced scanning for the ECR repositories
Add a pipeline step that checks the image's findings and fails on any CRITICAL severity
C
Enhanced scanning uses Amazon Inspector to scan continuously for operating system and language package vulnerabilities, and a pipeline check turns critical findings into a failed deployment. Tag immutability and lifecycle policies are good hygiene but do not scan, and weekly reviews do not block anything.
Security and Compliance
25
Select Two
D
GuardDuty must be enabled in every current and future account in AWS Organizations, and the security account must see all findings centrally. Which approach fits with the least operational overhead?
Enable GuardDuty manually in each account and invite each one as a member from the security account
Make the security account the GuardDuty delegated administrator and auto-enable it for all members
A StackSet that enables GuardDuty in each account without configuring a central administrator
An organization trail in CloudTrail that sends all events to the security account for analysis
B
A delegated administrator manages GuardDuty for the organization, auto-enable covers new accounts, and findings are aggregated in the administrator account. This is configured per Region. Manual invitations do not scale, and a StackSet alone does not centralize findings.
Security and Compliance
24
Select One
Audit records written to S3 must not be deletable or overwritable by any user, including the account root user, for seven years. Which configuration meets this requirement?
S3 Versioning with MFA delete enabled on the bucket
Object Lock in governance mode with a seven-year default retention period
A bucket policy that denies s3:DeleteObject to all principals
Object Lock in compliance mode with a seven-year default retention period
D
In compliance mode, no user, including the root user, can delete or overwrite a protected object version until its retention period expires. Governance mode can be bypassed with a special permission, and bucket policies and MFA delete can be changed by the account.
Security and Compliance
23
Select One
Each member account in an AWS Organization has its own account-level CloudTrail trail. The security team must prevent IAM users, IAM roles other than service-linked roles, and root users in member accounts from stopping logging or deleting these trails, even when they have administrator permissions. Which control enforces this preventively?
A permissions boundary attached to every administrator role in each member account of the organization
An AWS Config rule that checks trail status and restarts logging when it stops
An SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail
An IAM policy in each member account that denies CloudTrail actions to all users
C
An SCP's explicit deny applies to IAM users, roles, and the root user in member accounts, whatever their IAM permissions. SCPs do not affect the management account or service-linked roles. Organization trails need no SCP for this, because member accounts cannot modify them. Permissions boundaries and account IAM policies can be changed by account administrators, and a Config rule reacts after the fact.
Security and Compliance
22
Select One
An Auto Scaling group that uses a single instance type in one Availability Zone fails to launch instances during peaks with InsufficientInstanceCapacity errors. What change most improves the group's ability to launch capacity?
Request a service quota increase for the instance type's On-Demand vCPU limit
Use a mixed instances policy with several instance types across multiple AZs
Increase the group's maximum capacity so that more instances can be requested at once
Change the launch template to use dedicated tenancy for every instance in the group
B
InsufficientInstanceCapacity means AWS lacks capacity for that type in that zone, so diversifying types and zones gives the group more capacity pools. Quota increases address limit errors, not capacity, and a higher maximum still requests the same pool.
Incident and Event Response
21
Select One
A CodeDeploy deployment of a new application revision fails, and automatic rollback redeploys the previous revision. The new revision had already applied a database schema migration that removed a column the previous revision reads. What is the correct assessment?
Rollback redeploys the old revision only; schema changes need a compatible design or separate recovery
Rollback restores the database from the automated snapshot taken before the deployment started
Rollback runs the migration tool's down scripts automatically because they are packaged inside the application revision
Rollback succeeds only if the database is managed by the same CloudFormation stack as the application
A
CodeDeploy rollback deploys the last known good revision as a new deployment and does not reverse external side effects. Schema changes should follow an expand-and-contract pattern so both revisions work, or have their own recovery plan.
Incident and Event Response
20
Select One
A deployment introduced a recursive loop in which a Lambda function writes to an S3 bucket that triggers the same function. Costs are rising quickly. The responder must stop all new invocations immediately while the team investigates, without deleting the function or its triggers. What should the responder do?
Increase provisioned concurrency so that the invocations complete faster
Set the function timeout to 1 second to shorten each invocation
Publish a new version of the function with the loop removed
Set the function's reserved concurrency to 0
D
Reserved concurrency of 0 throttles all new invocations immediately without removing the function or its triggers. Shorter timeouts and more provisioned concurrency keep the loop running, and a new version does not change which version the trigger invokes.
Incident and Event Response
19
Select One
GuardDuty sometimes reports that an EC2 instance is communicating with a known cryptocurrency mining pool. The security team wants new network connections to and from the instance blocked automatically, while keeping it running for forensic analysis. Which solution fits?
An AWS Config rule that terminates any instance with an open GuardDuty finding
A GuardDuty setting that automatically quarantines instances linked to high-severity findings
An EventBridge rule for the finding that runs automation to swap in an isolation security group
A CloudWatch alarm on high CPU utilization that stops the instance and sends an SNS notification to the team
C
GuardDuty publishes findings to EventBridge, and a rule can start automation that swaps in an isolation security group with no rules, blocking new connections while the instance keeps running. Connections that were already tracked can continue, so a network ACL change may be needed to cut them immediately. GuardDuty has no built-in quarantine setting, and stopping or terminating the instance destroys memory evidence.
Incident and Event Response
18
Select One
CloudWatch Logs costs are growing. Application logs must be searchable in CloudWatch for 30 days. For audit purposes, they must also be kept for one year at the lowest cost, and they will rarely be read. Which solution fits?
Set log groups to never expire and move older log streams to a separate log group each month
Set 30-day retention and stream logs through Firehose to S3 with a lifecycle rule to Glacier
Export each log group manually to S3 once a year and then delete the log group
Keep one-year retention in CloudWatch and create metric filters for audit events
B
Retention keeps CloudWatch storage to 30 days, a subscription filter continuously copies logs to S3, and lifecycle rules move them to low-cost archive storage. Keeping a year in CloudWatch costs more, and manual annual exports risk gaps.
Monitoring and Logging
17
Select One
Lambda functions emit JSON logs. The team wants custom CloudWatch metrics, such as orders processed per customer tier, without adding synchronous PutMetricData calls to request handling. Which approach fits?
A metric filter for each customer tier on every function's log group
A scheduled Logs Insights query that writes results to a metric every minute
A PutMetricData call issued asynchronously from a background thread in each function
Embedded Metric Format (EMF) log entries with the tier as a dimension
D
EMF lets functions write structured log entries that CloudWatch extracts into metrics asynchronously. Metric filters per tier do not scale well, and PutMetricData calls, even from a background thread, still add API calls to each invocation.
Monitoring and Logging
16
Select One
A service has separate CloudWatch alarms for p99 latency and for 5xx error rate. On-call engineers should be paged only when both alarms are in ALARM at the same time, but each alarm should still appear on dashboards. What should the engineer create?
A composite alarm with an AND rule over both alarms
An anomaly detection alarm on the latency metric alone
A metric math alarm that adds the latency and error metrics together
Separate SNS topics for each alarm, with an email filter on the pager service
A
A composite alarm evaluates the states of other alarms with Boolean logic and can notify only when both are in ALARM. Metric math combines metric values rather than alarm states, and anomaly detection covers one metric.
Monitoring and Logging
15
Select One
An operations team in a central monitoring account must view metrics, logs, and traces from 30 member accounts in shared dashboards and investigations. The team does not want to copy log data into the monitoring account. Which solution fits?
Subscription filters in every account that stream logs to Firehose and a central S3 bucket
An organization trail in CloudTrail that delivers events to the monitoring account
CloudWatch cross-account observability with the monitoring account linked to source accounts
A Lambda function that copies each account's metrics into the monitoring account every minute
C
Cross-account observability lets a monitoring account view and query metrics, logs, and traces from linked source accounts without copying the data. Streaming logs to S3 copies data, CloudTrail covers API events only, and custom copying is code to maintain.
Monitoring and Logging
14
Select One
During flash sales, an order API writes directly to an Amazon RDS database, and the database is overwhelmed. Orders must never be lost, and customers can receive an order confirmation a few seconds later. Which design change fits best?
Move the database to a larger instance class for the duration of each sale
Put orders in an SQS queue and scale consumers on queue depth
Add an ElastiCache write-through cache in front of the database for all writes
Send orders to a Kinesis data stream with one shard and a single consumer
B
A queue absorbs bursts durably, and consumers write to the database at a rate it can sustain. A larger instance still has a limit, a cache does not make writes durable, and one Kinesis shard with one consumer limits throughput.
Resilient Cloud Solutions
13
Select One
Instances in an Auto Scaling group behind an Application Load Balancer pass EC2 status checks even when the application process hangs, so the group never replaces them. New instances take about 4 minutes to become ready. Which two changes enable automatic replacement of hung instances without terminating instances that are still starting?
Set the Auto Scaling group's health check type to include Elastic Load Balancing health checks
Increase the scaling cooldown period to 10 minutes for all scaling policies
Set the health check grace period to cover the 4-minute startup time
Keep EC2 status checks as the only health check source for the group
A
ELB health checks detect a hung application that EC2 status checks miss, and the grace period prevents the group from acting on health checks during startup. Cooldowns affect scaling activity, and scale-in protection does not affect health replacement.
Resilient Cloud Solutions
12
Select Two
C
A session-state table in DynamoDB must accept writes in two Regions at the same time, so that users are served by the closest Region and either Region can fail without data loss beyond replication lag. The team wants the least operational overhead. Which solution fits?
DynamoDB global tables with replicas in both Regions
DynamoDB Streams with a Lambda function that copies each change to a table in the other Region
Scheduled on-demand backups copied to the second Region and restored during a failover
DynamoDB Accelerator (DAX) clusters in each Region in front of a single-Region table
A
Global tables provide fully managed multi-Region, multi-active replication. A Streams-based copy works but must handle conflicts and failures in custom code, backups are not active-active, and DAX is a single-Region cache.
Resilient Cloud Solutions
11
Select One
A global application uses Amazon Aurora MySQL in us-east-1. The business requires a recovery point objective (RPO) of seconds and a recovery time objective (RTO) of minutes if the whole Region becomes unavailable, with minimal custom tooling. Which solution fits?
Hourly AWS Backup copies of the cluster to a vault in a second Region
AWS DMS continuous replication into an Aurora cluster in a second Region
A cross-Region read replica of an RDS for MySQL instance, promoted by a script
An Aurora global database with a secondary cluster in a second Region
D
Aurora global databases replicate storage to secondary Regions with typical lag under a second and support managed failover. Hourly backups miss the RPO, and DMS or scripted replica promotion add custom tooling and slower recovery.
Resilient Cloud Solutions
10
Select One
A CloudFormation template creates an RDS DB instance. The master password must not appear in the template, in stack parameters, or in the console's stack details. The password already exists as a secret in AWS Secrets Manager. What should the engineer use for the MasterUserPassword property?
A NoEcho parameter with the password as its default value
A Mappings section entry that stores the password for each environment
A dynamic reference to the Secrets Manager secret
A resolve:ssm reference to a Parameter Store String parameter
C
A {{resolve:secretsmanager:...}} dynamic reference retrieves the value at deployment time and never stores it in the template or stack parameters. A NoEcho default is still in the template, and a String parameter in Parameter Store is plaintext.
Configuration Management and IaC
9
Select One
The CloudWatch agent must be installed and configured on every EC2 instance tagged Env=prod, including instances launched later. The configuration must be reapplied every 30 minutes in case someone changes it by hand. Which Systems Manager capability fits?
A State Manager association targeting the tag on a 30-minute schedule
A one-time Run Command invocation targeting the tag, rerun by operators after each launch
User data in the launch template that installs the agent when each instance first boots
An AWS Config rule that reports instances where the agent is missing or stopped
A
State Manager associations apply a document to tag-targeted instances, include newly launched ones, and reapply on a schedule to correct drift. Run Command is one-time, user data runs only at first boot, and a Config rule only reports.
Configuration Management and IaC
8
Select One
A platform team must deploy a standard set of IAM roles and AWS Config rules to every account in AWS Organizations, including accounts created in the future. The management account should not be used for day-to-day deployments. Which solution fits?
A Lambda function in the management account that runs on account creation events and creates the resources with the SDK
A CloudFormation stack deployed manually by each account's owner from a shared template in S3
AWS Config conformance packs deployed from each account's own Config console after it is created
Service-managed StackSets with automatic deployment, run from a delegated administrator account
D
Service-managed StackSets deploy to OUs and automatically to new accounts, and a delegated administrator keeps routine work out of the management account. A custom Lambda function works but is code to maintain, and the manual options do not scale or guarantee coverage.
Configuration Management and IaC
7
Select One
A CloudFormation stack manages an Amazon RDS DB instance. Some template changes, such as a new DB instance identifier, cause CloudFormation to replace the instance. If a replacement happens, the data in the old instance must be preserved as a snapshot. What should the engineer add to the DB resource?
DeletionPolicy: Snapshot, which also applies when an update replaces the resource
UpdateReplacePolicy: Snapshot
A stack policy that allows Update:Replace actions only for the database resource
Termination protection on the stack so that CloudFormation cannot remove resources
B
UpdateReplacePolicy controls what happens to the old physical resource when an update replaces it. DeletionPolicy applies only when the resource is removed from the template or the stack is deleted, and termination protection only guards against stack deletion.
Configuration Management and IaC
6
Select One
A monorepo in a connected Git provider contains several services. The pipeline for the API service must start only for pushes to the main branch that change files under services/api/. The team wants the least custom code. What should the DevOps engineer configure?
An EventBridge rule for all repository pushes that invokes a Lambda function to inspect changed files and start the pipeline
A V1 pipeline with periodic polling of the repository, with the build stage exiting early when no API files changed
A CodePipeline V2 trigger with a branch filter for main and a file path filter for services/api/
A separate repository for each service, each with its own pipeline triggered on every push to any branch
C
V2 pipelines support trigger filters on branches and file paths, so no custom code is needed. The EventBridge and Lambda approach works but adds code to maintain, and polling starts runs the pipeline does not need.
SDLC Automation
5
Select One
Builds in CodeBuild download npm packages from the public registry. Builds fail whenever the public registry is slow or unavailable, and the security team wants a controlled place to govern which package versions are consumed. Which solution meets both requirements with the least operational overhead?
A CodeArtifact repository with an npmjs external connection, used by builds
CodeBuild local caching of the node_modules directory, with the cache refreshed at the start of every build
Committing the node_modules directory to the source repository after security review
A self-managed npm mirror on EC2 instances in an Auto Scaling group behind a load balancer
A
CodeArtifact caches packages fetched through the external connection, so builds keep working when the public registry is unavailable, and package origin controls govern what is consumed. Build caches are best-effort, and a self-managed mirror adds operational work.
SDLC Automation
4
Select One
An Amazon ECS service on Fargate sits behind an Application Load Balancer. The team must validate each new release on a separate test listener before production traffic moves, and it must be able to return all traffic to the previous release within seconds if problems appear. Which deployment approach fits?
A rolling update with minimumHealthyPercent set to 100 and maximumPercent set to 200
Deleting and recreating the service with the new task definition during a maintenance window
Two separate ECS services behind Route 53 weighted records, with weights adjusted during the release
A blue/green deployment across two target groups, with a test listener on the ALB
D
Blue/green deployments for ECS run the new tasks in a second target group, expose them on a test listener, and switch the production listener quickly in either direction. A rolling update replaces tasks gradually with no test listener, and DNS weights are subject to caching.
SDLC Automation
3
Select One
A team deploys a Lambda-based API with CodeDeploy. Before any production traffic reaches a new version, automated smoke tests must run against that version. If the error-rate alarm fires while traffic is shifting, the deployment must roll back automatically. Which two configurations meet these requirements?
An AfterAllowTraffic hook that runs the smoke tests after the traffic shift completes
A BeforeAllowTraffic hook function that runs the smoke tests against the new version
A CodePipeline manual approval action placed after the CodeDeploy deploy action
CloudWatch alarms in the deployment group with automatic rollback enabled for alarm events
B
The BeforeAllowTraffic hook runs before any traffic reaches the new version, and alarm-based rollback reverses the shift when the alarm fires. AfterAllowTraffic runs too late, a later approval does not roll back, and $LATEST is not the version being deployed.
SDLC Automation
2
Select Two
D
A company runs CodePipeline in a central tooling account. The pipeline must deploy CloudFormation stacks into a separate production account. Pipeline artifacts are stored in an S3 bucket in the tooling account, encrypted with the default AWS managed key (aws/s3). The first cross-account deployment fails with access denied errors when the production account reads the artifacts. Which solution fixes the problem while following AWS best practices?
Create an IAM user in the production account and store its access keys as pipeline variables so the deploy action can read the bucket
Encrypt artifacts with a customer managed KMS key shared with production, and have the pipeline assume a cross-account role there
Replicate the artifact bucket to the production account with S3 Replication and point the deploy action at the replica bucket
Make the artifact bucket readable by the production account's root principal and keep the aws/s3 key for encryption
B
AWS managed keys cannot be used by other accounts, so cross-account pipelines need a customer managed key whose key policy grants the target role access. The pipeline then assumes a role in the production account for the deploy action. Replication and IAM users add copies or long-term credentials without fixing key access.
SDLC Automation
1
Select One
.png)
.svg)
