A company uses an AWS Organizations organization to manage its 500 AWS accounts. All features are enabled in the organization, and the AWS accounts reside in a single OU. Developers must use the CostCenter tag key for every resource in the organization's member accounts. Some teams do not use the CostCenter tag key when tagging their Amazon EC2 instances.
The cloud team created a script that scans all EC2 instances in the organization's member accounts. When an EC2 instance lacks a CostCenter tag key, the script notifies the AWS account administrators. To prevent receiving this notification, some developers apply the CostCenter tag key with an arbitrary string as its tag value.
The cloud team must ensure that every EC2 instance in the organization uses a CostCenter tag key with the correct cost center value.
Which solution meets these requirements?
ACreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Update the script to scan the tag keys and tag values. Modify the script to update noncompliant resources with a default approved tag value for the CostCenter tag key.
BCreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Update the script to scan the tag keys and tag values and notify the administrators when the tag values are not valid.
CCreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Create an IAM permission boundary in the organization's member accounts that restricts the CostCenter tag values to a list of valid cost centers.
DCreate a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Configure an AWS Lambda function that adds an empty CostCenter tag key to an EC2 instance. Create an Amazon EventBridge rule that matches events to the RunInstances API action with the Lambda function as the target.
0
Community Discussion
No comments yet. Be the first to start the discussion!
A company uses a series of separate Amazon CloudFormation templates to deploy its multi-Region applications. The templates must be deployed in a particular order. The company is making more template changes than it previously anticipated and wants to deploy new templates more efficiently. In addition, the data engineering team must receive notification of every template change.
What should the company do to meet these goals?
ACreate an AWS Lambda function to deploy the CloudFormation templates in the required order. Use stack policies to alert the data engineering team.
BHost the CloudFormation templates in Amazon S3. Use Amazon S3 events to directly trigger CloudFormation updates and Amazon SNS notifications.
CImplement CloudFormation StackSets and use drift detection to trigger update alerts to the data engineering team.
DLeverage CloudFormation nested stacks and stack sets for deployments. Use Amazon SNS to notify the data engineering team.
0
Community Discussion
No comments yet. Be the first to start the discussion!
A company’s security team mandates that every external Application Load Balancer (ALB) and Amazon API Gateway API be associated with an AWS WAF web ACL. The company has hundreds of AWS accounts, all contained in one AWS Organizations organization. The company has enabled AWS Config for the organization. During an audit, the company discovers that some internet-facing ALBs have no associated AWS WAF web ACLs.
Which combination of actions should a DevOps engineer take to prevent future violations?
Choose two
ADelegate AWS Firewall Manager to a security account.
BDelegate Amazon GuardDuty to a security account.
CCreate an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
DCreate an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
EConfigure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
0
Community Discussion
No comments yet. Be the first to start the discussion!
A company uses a continuous integration pipeline in which it builds container images with AWS CodeBuild. The generated images are stored in Amazon Elastic Container Registry (Amazon ECR).
Reviewing and remediating image vulnerabilities is taking the company too long. The company needs to rapidly identify image vulnerabilities and notify the security team about them.
Which combination of steps meets these requirements with the LEAST operational overhead?
Choose two
AActivate Amazon Inspector enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
BCreate an Amazon EventBridge rule for Amazon Inspector findings. Set an Amazon Simple Notification Service (Amazon SNS) topic as the rule target.
CActivate AWS Lambda enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Email Service (Amazon SES).
DCreate a new AWS Lambda function. Invoke the new Lambda function when scan findings are detected.
EActivate default basic scanning for Amazon ECR for all container images. Configure the default basic scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
0
Community Discussion
No comments yet. Be the first to start the discussion!
A DevOps engineer manages a Java-based application running in an Amazon Elastic Container Service (Amazon ECS) cluster on AWS Fargate. Auto scaling is not configured for the application.
The DevOps engineer has identified the Java Virtual Machine (JVM) thread count as a good indicator for when the application should scale. The application serves customer traffic on port 8080 and exposes JVM metrics on port 9404.
Application usage has recently increased. The DevOps engineer must configure auto scaling for the application.
Which solution meets these requirements with the LEAST operational overhead?
Choose two
ADeploy the Amazon CloudWatch agent as a container sidecar. Configure the CloudWatch agent to retrieve JVM metrics from port 9404. Create CloudWatch alarms on the JVM thread count metric to scale the application. Add a step scaling policy in Fargate to scale up and scale down based on the CloudWatch alarms.
BDeploy the Amazon CloudWatch agent as a container sidecar. Configure a metric filter for the JVM thread count metric on the CloudWatch log group for the CloudWatch agent. Add a target tracking policy in Fargate. Select the metric from the metric filter as a scale target.
CCreate an Amazon Managed Service for Prometheus workspace. Deploy AWS Distro for OpenTelemetry as a container sidecar to publish the JVM metrics from port 9404 to the Prometheus workspace. Configure rules for the workspace to use the JVM thread count metric to scale the application. Add a step scaling policy in Fargate. Select the Prometheus rules to scale up and scaling down.
DCreate an Amazon Managed Service for Prometheus workspace. Deploy AWS Distro for OpenTelemetry as a container sidecar to retrieve JVM metrics from port 9404 to publish the JVM metrics from port 9404 to the Prometheus workspace. Add a target tracking policy in Fargate. Select the Prometheus metric as a scale target.
0
Community Discussion
No comments yet. Be the first to start the discussion!
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
A DevOps engineer is building infrastructure for an application. The application must run on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that contains Amazon EC2 instances. The EC2 instances must use an Amazon Elastic File System (Amazon EFS) file system as their storage backend. The Amazon EFS Container Storage Interface (CSI) driver is installed on the EKS cluster.
When the DevOps engineer starts the application, the EC2 instances fail to mount the EFS file system.
Which solutions will resolve the problem?
Choose three
ASwitch the EKS nodes from Amazon EC2 to AWS Fargate.
BAdd an inbound rule to the EFS file system’s security group to allow NFS traffic from the EKS cluster.
CCreate an IAM role that allows the Amazon EFS CSI driver to interact with the file system
DSet up AWS DataSync to configure file transfer between the EFS file system and the EKS nodes.
ECreate a mount target for the EFS file system in the subnet of the EKS nodes.
FDisable encryption or the EFS file system.
A company is building an ecommerce application on AWS and wants to ensure that the application can withstand sudden traffic increases.
The company uses AWS CodePipeline for its CI/CD process. It must implement a solution that integrates automated load testing into the CI/CD pipeline to validate the application's performance. The solution must deploy to production only when performance exceeds a threshold.
Which solution meets these requirements with the LEAST operational overhead?
ADeploy the application by using AWS Elastic Beanstalk. Enable load balancing. Use Elastic Beanstalk to deploy tools for load tests. Run the tests during each deployment, and roll back the deployment if performance thresholds are unmet. Create an AWS Lambda function to monitor test metrics. Set up alarms for performance thresholds. Configure Amazon EventBridge to return an error if a test fails and to proceed with production deployment if a test passes.
BImplement AWS Fargate tasks to run tools for load tests. Use Amazon Elastic container Service (Amazon ECS) to manage the test containers. Create AWS Lambda functions to analyze the test results. Integrate the functions with CodePipeline by using custom actions to initiate and evaluate the tests. Program the functions to return an error if a test fails and to proceed with production deployment if a test passes.
CLaunch Amazon EC2 instances to run tools for load tests. Store test scripts in a GitHub repository. Use AWS Step Functions to orchestrate the tests and result analysis in the CodePipeline workflow. Use Amazon EventBridge to invoke an AWS Lambda function based on the test results. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.
DUse AWS CodeBuild to run tools for load tests, store the test artifacts in Amazon S3, and configure a CodePipeline stage to invoke the CodeBuild project. Use Amazon CloudWatch to monitor the test metrics and to set up alarms for performance thresholds. Integrate an AWS Lambda function into the pipeline by using a custom action. Program the function to return an error if a test fails and to proceed with production deployment if a test passes.
A company uses AWS Key Management Service (AWS KMS) keys with manual key rotation to satisfy regulatory compliance requirements. The security team needs notification whenever any keys have gone more than 90 days without rotation.
Which solution will achieve this?
AConfigure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
BConfigure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic.
CDevelop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
DConfigure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
A company has an AWS Organizations organization. A DevOps engineer must manage multiple AWS accounts that are in different OUs in the organization. All resources within an account, including IAM policies and Amazon S3 policies, are deployed by using AWS CloudFormation. All templates and code are maintained in an AWS CodeCommit repository. Recently, some developers have been unable to access an S3 bucket from certain accounts in the organization.
The following policy is attached to the S3 bucket:
What should the DevOps engineer do to fix this access issue?
AModify the S3 bucket policy. Turn off the S3 Block Public Access setting on the S3 bucket. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue.
BVerify that no IAM permissions boundaries are denying developers access to the S3 bucket. Make the necessary changes to IAM permissions boundaries. Use an AWS Config recorder in the individual developer accounts that are experiencing the issue to revert any changes that are blocking access. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
CConfigure an SCP that stops anyone from modifying IAM resources in developer OUs. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
DEnsure that no SCP is blocking access for developers to the S3 bucket. Ensure that no IAM policy permissions boundaries are denying access to developer IAM users. Make the necessary changes to the SCP and IAM policy permissions boundaries in the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
A company operates an application in an Amazon Elastic Container Service (Amazon ECS) service using the AWS Fargate launch type. The application consumes messages from an Amazon Simple Queue Service (Amazon SQS) queue. It can take several minutes for the application to process each queue message. While processing a message, the application reads a file from an Amazon S3 bucket and processes the file’s data. The application writes the processed output to a second S3 bucket. The company uses Amazon CloudWatch Logs to monitor processing errors and confirm that the application processes messages successfully.
The SQS queue generally receives a low message volume. Occasionally, however, the queue receives larger message volumes. A DevOps engineer must implement a solution that reduces the processing time for message bursts.
Which solution meets this requirement in the MOST cost-effective manner?
ARegister the ECS service as a scalable target in AWS Application Auto Scaling. Configure a target tracking scaling policy to scale the service in response to the queue size.
BIncrease the maximum number of messages that Amazon SQS requests to batch messages together. Use long polling to minimize the number of API calls to Amazon SQS during periods of low traffic.
CSend messages to an Amazon EventBridge event bus instead of the SQS queue. Replace the ECS service with an EventBridge rule that launches ECS tasks in response to matching events.
DCreate an Auto Scaling group of EC2 instances. Create a capacity provider in the ECS cluster by using the Auto Scaling group. Change the ECS service to use the EC2 launch type.
A company runs an application on on-premises devices in the company’s on-premises data center. The company uses an AWS Direct Connect connection between that data center and the company’s AWS account. During the initial setup of the on-premises devices and during application updates, the application must retrieve configuration files from an Amazon Elastic File System (Amazon EFS) file system.
All traffic from the on-premises devices to Amazon EFS must stay private and encrypted. The on-premises devices must adhere to the principle of least privilege for AWS access. The company’s DevOps team must be able to revoke access for one device without affecting the other devices.
Which combination of steps meets these requirements?
Choose two
ACreate an IAM user that has an access key and a secret key for each device. Attach the AmazonElasticFileSystemFullAccess policy to all IAM users. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
BGenerate certificates for each on-premises device in AWS Private Certificate Authority. Create a trust anchor in IAM Roles Anywhere that references an AWS Private CA. Create an IAM role that trust IAM Roles Anywhere. Attach the AmazonElasticFileSystemClientReadWriteAccess to the role. Create an IAM Roles Anywhere profile for the IAM role. Configure the AWS CLI on the on-premises devices to use the aws_signing_helper command to obtain credentials.
CCreate an IAM user that has an access key and a secret key for all devices. Attach the AmazonElasticFileSystemClientReadWriteAccess policy to the IAM user. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
DUse the amazon-efs-utils package to mount the EFS file system.
EUse the native Linux NFS client to mount the EFS file system.
A company operates an application on AWS Lambda that sends logs to Amazon CloudWatch Logs. An Amazon Kinesis data stream subscribes to the CloudWatch Logs log groups. One consumer Lambda function processes logs from the data stream and writes them to an Amazon S3 bucket.
The company’s DevOps team has identified high latency while some logs are being processed and ingested.
Which combination of steps will reduce the latency?
Choose three
ACreate a data stream consumer with enhanced fan-out. Set the Lambda function that processes the logs as the consumer.
BIncrease the ParallelizationFactor setting in the Lambda event source mapping.
CConfigure reserved concurrency for the Lambda function that processes the logs.
DIncrease the batch size in the Kinesis data stream.
ETurn off the ReportBatchItemFailures setting in the Lambda event source mapping.
FIncrease the number of shards in the Kinesis data stream.
A company uses AWS Organizations to centrally administer its AWS accounts. It enabled AWS Config in every member account by using AWS CloudFormation StackSets. The company configured trusted access in Organizations for AWS Config and designated a member account as the delegated administrator account for AWS Config.
A DevOps engineer must implement a new security policy. The policy must require all existing and future AWS member accounts to use a shared baseline of AWS Config rules, including remediation actions, that is managed from a central account. Non-administrator users with access to member accounts must be unable to modify this shared baseline of AWS Config rules deployed in each member account.
Which solution meets these requirements?
ACreate a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the Organizations management account by using CloudFormation StackSets.
BCreate an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the Organizations management account by using CloudFormation StackSets.
CCreate a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the delegated administrator account by using AWS Config.
DCreate an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the delegated administrator account by using AWS Config.
A security team is worried that a developer could inadvertently associate an Elastic IP address with an Amazon EC2 instance in production. Developers must not be permitted to associate an Elastic IP address with an instance. The security team must be alerted whenever any production server has an Elastic IP address.
How can this task be automated?
AUse Amazon Athena to query AWS CloudTrail logs to check for any associate-address attempts. Create an AWS Lambda function to disassociate the Elastic IP address from the instance, and alert the security team.
BAttach an IAM policy to the developers' IAM group to deny associate-address permissions. Create a custom AWS Config rule to check whether an Elastic IP address is associated with any instance tagged as production, and alert the security team.
CEnsure that all IAM groups associated with developers do not have associate-address permissions. Create a scheduled AWS Lambda function to check whether an Elastic IP address is associated with any instance tagged as production, and alert the security team if an instance has an Elastic IP address associated with it.
DCreate an AWS Config rule to check that all production instances have EC2 IAM roles that include deny associate-address permissions. Verify whether there is an Elastic IP address associated with any instance, and alert the security team if an instance has an Elastic IP address associated with it.
A company uses an AWS CodePipeline pipeline to upload AWS CloudFormation templates to an Amazon S3 bucket. The pipeline uses those templates to deploy CloudFormation stacks whose names match the template names.
The company has encountered problems when attempting to revert templates to an earlier version. To avoid these problems, the company must be able to review template changes before the changes are deployed to production.
Which solution meets these requirements with the LEAST operational overhead?
AConfigure a connection in AWS CodeConnections to a Git repository. Store the templates in the Git repository. Configure a pull request workflow to review template modifications. Configure AWS CloudFormation Git sync for the stacks.
BAdd a manual review action in the pipeline to review modifications to the template code before the stack deployments.
CUpdate the pipeline to invoke an AWS Lambda function to check the template modifications before the stack deployments.
DConfigure a connection in AWS CodeConnections to a Git repository. Store the templates in the Git repository. Configure the pipeline to include a source action that uses the connection. Add a manual review action to the pipeline to review template modifications before the stack deployments.
A company is implementing a CI/CD pipeline for an application using AWS CodePipeline and AWS CodeBuild. The company requires a solution to run unit tests and automatically create code coverage reports before any code is deployed to production. The CI/CD pipeline execution must fail when code coverage is below 80%.
Which solution meets these requirements?
ACreate an AWS Lambda function to run unit tests and generate code coverage reports. Add a Lambda invoke action to a stage in the CodePipeline pipeline. Create an Amazon EventBridge scheduled rule to run hourly to monitor the Lambda function's output. Configure the rule to fail the pipeline if coverage is less than 80%.
BCreate an AWS Step Functions workflow to run unit tests and generate code coverage reports. Add a Step Functions test action to a stage in the CodePipeline pipeline to invoke the workflow. Configure the workflow to fail if the code coverage is less than 80%.
CCreate a CodeBuild project with a buildspec.yml file that includes commands to run unit tests and generate code coverage reports. Add a CodeBuild test action to a stage in the CodePipeline pipeline. Configure the CodeBuild test action to use the source artifacts from the source action as input. Modify the buildspec.yml file to fail the build if coverage is less than 80%.
DCreate a CodeBuild project with Jenkins installed. Configure Jenkins to run unit tests and generate code coverage reports. Add a Jenkins test action to a stage in the CodePipeline pipeline. Configure the Jenkins test action to output the coverage report as an output artifact. Configure an approval action to fail the pipeline if code coverage is less than 80%.
A company uses Amazon RDS for Microsoft SQL Server as the primary database for its applications. The company must provide high availability both within AWS Regions and across AWS Regions.
An Amazon Route 53 CNAME record is configured for the database endpoint, and the applications connect through that endpoint. During a failover event, the company must redirect application traffic to a standby database. The company must maintain an RPO of less than 1 minute and an RTO of less than 10 minutes.
Which solution meets these requirements?
ADeploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment that uses cross-Region read replicas. Use automation to promote the read replica to a standalone instance and to update the Route 53 record.
BDeploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment. Set up automated snapshots to be copied to another Region every 5 minutes. Use AWS Lambda to restore the latest snapshot in the secondary Region during failover.
CDeploy an Amazon RDS for SQL Server Single-AZ DB instance. Use AWS Database Migration Service (AWS DMS) to replicate data continuously to an RDS DB instance in another Region. Use Amazon CloudWatch alarms to notify the company about failover events.
DDeploy an Amazon RDS for SQL Server Single-AZ DB instance. Configure AWS Backup to create cross-Region backups every 30 seconds. Use automation to restore the latest backup and to update the Route 53 record during failover.
A company used a lift-and-shift approach to migrate a workload to AWS. The company has an Auto Scaling group of Amazon EC2 instances. Each EC2 instance hosts a web application, a database, and a Redis cache.
Users are seeing substantial variation in the web application's response times. Requests to the web application are routed to one EC2 instance that is experiencing significant load. The company wants to separate the application components to improve availability and performance.
Which solution will satisfy these requirements?
ACreate a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Application Load Balancer and an Auto Scaling group for the Redis cache.
BCreate an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create a Network Load Balancer and an Auto Scaling group in a single Availability Zone for the Redis cache.
CCreate a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Amazon ElastiCache (Redis OSS) cluster for the cache. Create a target group that has a DNS target type that contains the ElastiCache (Redis OSS) cluster hostname.
DCreate an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create an Amazon ElastiCache (Redis OSS) cluster for the cache.
A company uses Amazon RDS for every database in its AWS accounts. The company uses AWS Control Tower to create a landing zone with an audit and logging account. For compliance, all databases must be encrypted at rest. The company's security engineer needs to be notified of any noncompliant databases in the company’s accounts.
Which solution meets these requirements with the MOST operational efficiency?
AUse AWS Control Tower to activate the optional detective control (guardrail) to determine whether the RDS storage is encrypted. Create an Amazon Simple Notification Service (Amazon SNS) topic in the company's audit account. Create an Amazon EventBridge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer's email address to the SNS topic.
BUse AWS CloudFormation StackSets to deploy AWS Lambda functions to every account. Write the Lambda function code to determine whether the RDS storage is encrypted in the account the function is deployed to. Send the findings as an Amazon CloudWatch metric to the management account. Create an Amazon Simple Notification Service (Amazon SNS) topic. Create a CloudWatch alarm that notifies the SNS topic when metric thresholds are met. Subscribe the security engineer's email address to the SNS topic.
CCreate a custom AWS Config rule in every account to determine whether the RDS storage is encrypted. Create an Amazon Simple Notification Service (Amazon SNS) topic in the audit account. Create an Amazon EventBidge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer's email address to the SNS topic.
DLaunch an Amazon C2 instance. Run an hourly cron job by using the AWS CLI to determine whether the RDS storage is encrypted in each AWS account. Store the results in an RDS database. Notify the security engineer by sending email messages from the EC2 instance when noncompliance is detected
A DevOps engineer has created an AWS Lambda function. The Lambda function initiates an AWS CloudFormation drift-detection operation on all supported resources for a particular CloudFormation stack, and then exits the invocation.
The DevOps engineer has set up an Amazon EventBridge scheduled rule that invokes the Lambda function every hour. An Amazon Simple Notification Service (Amazon SNS) topic already exists in the AWS account, and the DevOps engineer has subscribed to that SNS topic to receive notifications.
The DevOps engineer needs to receive a notification as soon as possible when drift is detected in this particular stack configuration.
Which solution meets these requirements?
AConfigure the existing EventBridge rule to also target the SNS topic. Configure an SNS subscription filter policy to match the CloudFormation stack. Attach the subscription filter policy to the SNS topic.
BCreate a second Lambda function to query the CloudFormation API for the drift detection results for the stack. Configure the second Lambda function to publish a message to the SNS topic if drift is detected. Adjust the existing EventBridge rule to also target the second Lambda function.
CConfigure Amazon GuardDuty in the account with drift detection for all CloudFormation stacks. Create a second EventBridge rule that reacts to the GuardDuty drift detection event finding for the specific CloudFormation stack. Configure the SNS topic as a target of the second EventBridge rule.
DConfigure AWS Config in the account. Use the cloudformation-stack-drift-detection-check managed rule. Create a second EventBridge rule that reacts to a compliance change event for the CloudFormation stack. Configure the SNS topic as a target of the second EventBridge rule.
A DevOps engineer is creating a multistage AWS CodePipeline pipeline to build, verify, stage, test, and deploy an application. A manual approval stage is needed between the test and deploy stages. The development team uses a custom chat tool that supports webhooks and needs near-real-time notifications.
How should the DevOps engineer set up status updates for pipeline activity and approval requests to be posted to the chat tool?
ACreate an Amazon CloudWatch Logs subscription that filters on CodePipeline Pipeline Execution State Change. Publish subscription events to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the chat webhook URL to the SNS topic, and complete the subscription validation.
BCreate an AWS Lambda function that is invoked by AWS CloudTrail events. When a CodePipeline Pipeline Execution State Change event is detected, send the event details to the chat webhook URL.
CCreate an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Change. Publish the events to an Amazon Simple Notification Service (Amazon SNS) topic. Create an AWS Lambda function that sends event details to the chat webhook URL. Subscribe the function to the SNS topic.
DModify the pipeline code to send the event details to the chat webhook URL at the end of each stage. Parameterize the URL so that each pipeline can send to a different URL based on the pipeline environment.
A company organizes its AWS accounts into OUs within an AWS Organizations organization. It has deployed a collection of Amazon API Gateway APIs in one Organizations account. The APIs are associated with that account’s VPC and currently have no authentication mechanism. Only principals in one specific OU must be permitted to invoke the APIs.
The company applies the following policy to the API Gateway interface VPC endpoint:
The company also modifies the API Gateway resource policies to deny invocations that do not pass through the interface VPC endpoint. After these updates, attempts to invoke an API by using the interface VPC endpoint URL produce this error: "User: anonymous is not authorized."
Which combination of steps will resolve this issue?
Choose two
AEnable IAM authentication on all API methods by setting AWS JAM as the authorization method.
BCreate a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token.
CCreate a request parameter-based AWS Lambda authorizer that passes the caller's identity in a combination of headers, query string parameters, stage variables, and $cortext variables.
DUse Amazon Cognito user pools as the authorizer to control access to the API.
EVerify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials.
A DevOps engineer uses an AWS CodePipeline pipeline. The pipeline contains a build action and a deploy action for a single-page web application delivered to an Amazon S3 bucket. Amazon CloudFront serves the web application. The build action produces an artifact for the web application.
The DevOps engineer created an AWS CloudFormation template that defines the S3 bucket and configures the bucket to host the application. The DevOps engineer configured a CloudFormation deploy action before the S3 action. The CloudFormation deploy action creates the S3 bucket. The DevOps engineer must configure the S3 deploy action to use the S3 bucket from the CloudFormation template.
Which combination of steps meets these requirements?
Choose two
AAdd an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Configure the output value to export to an AWS::SSM::Parameter resource named Stackvariables.
BAdd an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Set the CloudFormation action's namespace to StackVariables in the pipeline.
CConfigure the output artifacts of the CloudFormation action in the pipeline to be an AWS Systems Manager Parameter Store parameter named StackVariables. Name the artifact BucketName.
DConfigure the build artifact from the build action as the input to the CodePipeline S3 deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.
EConfigure the build artifact from the build action and the AWS Systems Manager parameter as the inputs to the deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.
A company uses an AWS Cloud Development Kit (AWS CDK) application for its infrastructure. The AWS CDK application creates AWS Lambda functions and the IAM roles attached to those functions. The company also uses AWS Organizations. The company’s developers can assume the AWS CDK application deployment role.
The company’s security team discovered that the developers and the role used to deploy the AWS CDK application have more permissions than required. The security team also found that the roles attached to the Lambda functions created by the CDK application have more permissions than necessary. The developers must not be able to grant additional permissions.
Which solution meets these requirements with the LEAST operational overhead?
ACreate an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role and the AWS CDK application deployment role. Centrally create new IAM roles to attach to the Lambda functions for the developers to use to provision Lambda functions.
BCreate an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Update the account's AWS CDK bootstrapping to use the permission boundary. Update the configuration in the AWS CDK application for the default permissions boundary to use the policy.
CCreate an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Instruct the developers to use the permission boundary policy name when they create a role in the AWS CDK application code.
DCreate an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role. Give the AWS CDK deployment role access to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to verify that the Lambda functions role does not have permissions.
A company operates applications on Windows and Linux Amazon EC2 instances. The instances run in multiple Availability Zones within an AWS Region. The company uses Auto Scaling groups for each application.
The company requires a durable storage solution for the instances. The solution must use SMB for Windows and NFS for Linux. It must also provide sub-millisecond latencies. All instances will read from and write to the data.
Which combination of steps meets these requirements?
Choose three
ACreate an Amazon Elastic File System (Amazon EFS) file system that has targets in multiple Availability Zones.
BCreate an Amazon FSx for NetApp ONTAP Multi-AZ file system.
CCreate a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume to use for shared storage.
DUpdate the user data for each application’s launch template to mount the file system.
EPerform an instance refresh on each Auto Scaling group.
FUpdate the EC2 instances for each application to mount the file system when new instances are launched.
Community Discussion