Loading provider exams...

AWS DevOps Engineer - Professional Practice Exam — Free Online

A company uses AWS Organizations to manage multiple accounts. Information security policies require that every unencrypted Amazon EBS volume be designated as non-compliant. A DevOps engineer must deploy the solution automatically and ensure that this compliance check is always in place.

Which solution will accomplish this?

A Create an AWS CloudFormation template that defines an AWS Inspector rule to check whether EBS encryption is enabled. Save the template to an Amazon S3 bucket that has been shared with all accounts within the company. Update the account creation script pointing to the CloudFormation template in Amazon S3.
B Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization.
C Create an SCP in Organizations. Set the policy to prevent the launch of Amazon EC2 instances without encryption on the EBS volumes using a conditional expression. Apply the SCP to all AWS accounts. Use Amazon Athena to analyze the AWS CloudTrail output, looking for events that deny an ec2:RunInstances action.
D Deploy an IAM role to all accounts from a single trusted account. Build a pipeline with AWS CodePipeline with a stage in AWS Lambda to assume the IAM role, and list all EBS volumes in the account. Publish a report to Amazon S3.

Explanation

AWS Config’s ENCRYPTED_VOLUMES managed rule reports attached EBS volumes as NON_COMPLIANT when they are unencrypted. An organization AWS Config rule centrally deploys the rule across member accounts, including accounts that subsequently join the organization. An SCP that denies actions to stop or delete AWS Config helps ensure the ongoing compliance evaluation cannot be disabled by member accounts.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

A company hosts a web application in an AWS Region. For disaster recovery, it uses a second Region as a standby. The disaster recovery requirements specify that session data must be replicated between Regions in near real time, and 1% of requests must be routed to the secondary Region to continuously validate system functionality. In addition, if service in the primary Region is disrupted, traffic must automatically route to the secondary Region, which must be able to scale to support all traffic.

How should a DevOps engineer satisfy these requirements?

A In both regions, deploy the application on AWS Elastic Beanstalk and use Amazon DynamoDB global tables for session data. Use an Amazon Route 53 weighted routing policy with health checks to distribute the traffic across the regions.
B In both regions, launch the application in Auto Scaling groups and use DynamoDB for session data. Use a Route 53 failover routing policy with health checks to distribute the traffic across the regions.
C In both regions, deploy the application in AWS Lambda, exposed by Amazon API Gateway, and use Amazon RDS PostgreSQL with cross-region replication for session data. Deploy the web application with client-side logic to call the API Gateway directly.
D In both regions, launch the application in Auto Scaling groups and use DynamoDB global tables for session data. Enable an Amazon CloudFront weighted distribution across regions. Point the Amazon Route 53 DNS record at the CloudFront distribution.

Explanation

Amazon DynamoDB global tables automatically replicate table data across AWS Regions, providing the near-real-time multi-Region session-data replication required. Amazon Route 53 weighted routing sends traffic in specified proportions, so records weighted at 99% and 1% continuously exercise the secondary Region. When health checks mark the primary endpoint unhealthy, Route 53 stops returning that endpoint and routes traffic to the healthy secondary deployment. Elastic Beanstalk can host the application in each Region and scale the secondary environment as needed. DynamoDB global tables and Route 53 weighted routing support these capabilities.

Learn more

A company runs an application that uses a MySQL-compatible Amazon Aurora Multi-AZ DB cluster for its database. A cross-Region read replica was created for disaster-recovery purposes. A DevOps engineer needs to automate promotion of the replica so that it becomes the primary database instance if a failure occurs.

Which solution will achieve this?

A Configure a latency-based Amazon Route 53 CNAME with health checks so it points to both the primary and replica endpoints. Subscribe an Amazon SNS topic to Amazon RDS failure notifications from AWS CloudTrail and use that topic to trigger an AWS Lambda function that will promote the replica instance as the master.
B Create an Aurora custom endpoint to point to the primary database instance. Configure the application to use this endpoint. Configure AWS CloudTrail to run an AWS Lambda function to promote the replica instance and modify the custom endpoint to point to the newly promoted instance.
C Create an AWS Lambda function to modify the application's AWS Cloud Formation template to promote the replica, apply the template to update the stack, and point the application to the newly promoted instance. Create an Amazon CloudWatch alarm to trigger this Lambda function after the failure event occurs.
D Store the Aurora endpoint in AWS Systems Manager Parameter Store. Create an Amazon EventBridge (Amazon CloudWatch Events) event that defects the database failure and runs an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Systems Manager Parameter Store. Code the application to reload the endpoint from Parameter Store if a database connection fails.

Explanation

Aurora MySQL cross-Region read replicas can be promoted to standalone DB clusters through the Amazon RDS promotion API. An EventBridge-triggered Lambda function can detect the failure and invoke that promotion, while updating the active endpoint in Systems Manager Parameter Store. Reloading that parameter after a database connection failure directs the application to the newly promoted cluster, satisfying both promotion and traffic redirection requirements. AWS documentation: Promoting a read replica to a DB cluster for Aurora MySQL

Learn more

Promoting a read replica to a DB cluster for Aurora MySQL

A company wants to use AWS development tools to replace its existing bash deployment scripts. It currently deploys a LAMP application to a group of Amazon EC2 instances behind an Application Load Balancer (ALB). During deployments, the company:

Unit tests the committed application
Stops and starts services
Unregisters and re-registers instances with the load balancer
Updates file permissions

The company wants to preserve the same deployment functionality while shifting to AWS services.

Which solution meets these requirements?

A Use AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services, and deregister and register instances with the ALB. Use the appspec.yml file to update file permissions without a custom script.
B Use AWS CodePipeline to move the application from the AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy's deployment group to test the application, unregister and re-register instances with the ALB, and restart services. Use the appspec.yml file to update the permissions without a custom script.
C Use AWS CodePipeline to move the application source code from the AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy to test the application. Use CodeDeploy's appspec.yml file to restart services and update permissions without a custom script. Use AWS CodeBuild to unregister and re- register instances with the ALB.
D Use AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services. Unregister and re-register the instances in the AWS CodeDeploy deployment group with the ALB. Update the appspec.yml file to update file permissions without a custom script.

Explanation

AWS CodePipeline can orchestrate a CodeBuild test stage and a CodeDeploy deployment stage. CodeBuild runs unit tests. For EC2 deployments, CodeDeploy AppSpec lifecycle hooks can invoke bash scripts to restart services, while a deployment group configured with the ALB removes instances from traffic during deployment and restores them afterward. The AppSpec permissions section can set file ownership and modes without a custom script.

Learn more

A company uses AWS Database Migration Service (AWS DMS) to replicate data from a source database in a data center to a target Amazon Aurora PostgreSQL database. The company has created a DMS replication task with change data capture (CDC).

The replication instance is occasionally interrupted, affecting critical functionality. The company must increase the resiliency of the replication instance and receive notifications when interruptions occur.

Which solution meets these requirements with the LEAST operational overhead?

A Copy data from the source database to Amazon S3 by using AWS DataSync. Configure AWS Lambda functions to copy the data to the target database. Configure Amazon CloudWatch alarms to monitor the Lambda functions for errors and throttles. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notification.
B Create Amazon CloudWatch alarms to monitor DMS replication task metrics and host metrics. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notification and to invoke an AWS Lambda function to configure a standby DMS replication instance in a different AWS Region.
C Create Amazon CloudWatch alarms to monitor DMS replication task metrics and host metrics. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notification. After receiving the notification, configure a new DMS replication task in the same AWS Region.
D Modify the DMS replication instance by tuming on Multi-AZ support. Create Amazon CloudWatch alarms to monitor DMS replication task metrics and host metrics. Use an Amazon Simple Notification Service (Amazon SNS) topic for email notification.

Explanation

AWS DMS Multi-AZ automatically maintains a synchronous standby replication instance in a separate Availability Zone. If the primary instance fails or becomes unresponsive, the standby resumes running tasks with minimal interruption. Amazon CloudWatch can monitor DMS replication task and host metrics, and Amazon SNS can deliver email notifications from alarms. This supplies managed failover and alerting without manually creating replacement tasks or operating a cross-Region standby.

Learn more

A DevOps engineer must apply a core set of security controls to an existing collection of AWS accounts. The accounts belong to an organization in AWS Organizations. Individual teams will manage individual accounts by using the AdministratorAccess AWS managed policy. AWS CloudTrail and AWS Config must be enabled in every available AWS Region for all accounts. Individual account administrators must not be able to modify or delete any baseline resources. However, those administrators must be able to modify or delete their own CloudTrail trails and AWS Config rules.

Which solution meets these requirements in the MOST operationally efficient manner?

A Create an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization's management account by using CloudFormation StackSets. Set the stack policy to deny Update Delete actions.
B Enable AWS Control Tower. Enroll the existing accounts in AWS Control Tower. Grant the individual account administrators access to CloudTrail and AWS Config.
C Designate an AWS Config management account. Create AWS Config recorders in all accounts by using AWS CloudFormation StackSets. Deploy AWS Config rules to the organization by using the AWS Config management account. Create a CloudTrail organization trail in the organization's management account. Deny modification or deletion of the AWS Config recorders by using an SCP.
D Create an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization's management account by using CloudFormation StackSets. Create an SCP that prevents updates or deletions to CloudTrail resources or AWS Config resources unless the principal is an administrator of the organization's management account.

Explanation

AWS Control Tower can enroll existing accounts and centrally apply a governed landing-zone baseline. Its preventive controls protect AWS Control Tower-managed AWS Config resources and AWS Config rules, while the protections are scoped to the Control Tower-managed baseline so account administrators can still manage their own CloudTrail trails and AWS Config rules. This avoids maintaining custom StackSets and SCP exception logic across all accounts.

Learn more

A company uses AWS CodeCommit for source-code control. Developers make changes in various feature branches and create pull requests to move those changes to the main branch when the changes are ready for production.

Developers must not be able to push changes directly to the main branch. The company applied the AWSCodeCommitPowerUser managed policy to the developers’ IAM role, and the developers can now push changes directly to the main branch in every repository in the AWS account.

What should the company do to restrict the developers’ ability to push changes directly to the main branch?

A Create an additional policy to include a Deny rule for the GitPush and PutFile actions. Include a restriction for the specific repositories in the policy statement with a condition that references the main branch.
B Remove the IAM policy, and add an AWSCodeCommitReadOnly managed policy. Add an Allow rule for the GitPush and PutFile actions for the specific repositories in the policy statement with a condition that references the main branch.
C Modify the IAM policy. Include a Deny rule for the GitPush and PutFile actions for the specific repositories in the policy statement with a condition that references the main branch.
D Create an additional policy to include an Allow rule for the GitPush and PutFile actions. Include a restriction for the specific repositories in the policy statement with a condition that references the feature branches.

Explanation

An IAM explicit Deny overrides the Allows granted by AWSCodeCommitPowerUser. A separate customer-managed policy can deny codecommit:GitPush and codecommit:PutFile for the specified repositories when the reference is the main branch, while leaving feature-branch work permitted. AWS-managed policies cannot be edited. AWS CodeCommit’s branch-restriction guidance uses a conditional Deny to prevent updates to a branch, including pushes and pull-request merges.

Learn more

A company has 20 service teams. Each team owns its own microservice. Each service team uses a separate AWS account for its microservice and a VPC with the 192.168.0.0/22 CIDR block. The company administers the AWS accounts by using AWS Organizations.

Each service team runs its microservice on multiple Amazon EC2 instances behind an Application Load Balancer. The microservices communicate with one another over the public Internet. The company's security team has issued a new guideline requiring all communication between microservices to use HTTPS over private network connections and prohibiting traversal of the public Internet.

A DevOps engineer must implement a solution that meets these requirements while minimizing the number of changes required for each service team.

Which solution meets these requirements?

A Create a new AWS account in AWS Organizations. Create a VPC in this account and use AWS Resource Access Manager to share the private subnets of this VPC with the organization. Instruct the service teams to launch a new Network Load Balancer (NLB) and EC2 instances that use the shared private subnets. Use the NLB DNS names for communication between microservices.
B Create a Network Load Balancer (NLB) in each of the microservice VPCs. Use AWS PrivateLink to create VPC endpoints in each AWS account for the NLBs. Create subscriptions to each VPC endpoint in each of the other AWS accounts. Use the VPC endpoint DNS names for communication between microservices.
C Create a Network Load Balancer (NLB) in each of the microservice VPCs. Create VPC peering connections between each of the microservice VPCs. Update the route tables for each VPC to use the peering links. Use the NLB DNS names for communication between microservices.
D Create a new AWS account in AWS Organizations. Create a transit gateway in this account. and use AWS Resource Access Manager to share the transit gateway with the organization. In each of the microservice VPCs, create a transit gateway attachment to the shared transit gateway. Update the route tables of each VPC to use the transit gateway. Create a Network Load Balancer (NLB) in each of the microservice VPCs. Use the NLB DNS names for communication between microservices.

Explanation

AWS PrivateLink provides private, service-specific connectivity through interface endpoints and is suitable when consumer and provider VPCs have overlapping CIDR ranges, because the endpoint uses network interfaces in the consumer VPC without creating IP-address conflicts. Exposing each service through an NLB and consuming it through PrivateLink endpoint DNS names keeps microservice traffic private; HTTPS can be used for the service requests. VPC peering and Transit Gateway do not solve connectivity among VPCs with the same CIDR block.

Learn more

A company uses AWS CodeDeploy to automate software deployments. The deployment must satisfy these requirements:

Several instances must remain available to serve traffic throughout the deployment. Traffic must be balanced among those instances, and the instances must heal automatically if a failure occurs.
A new fleet of instances must be automatically launched to deploy a new revision, without manual provisioning.
Traffic must be rerouted to the new environment to half of the new instances at a time. The deployment must succeed when traffic is rerouted to at least half of the instances; otherwise, it must fail.
Before traffic is routed to the new fleet of instances, temporary files created during the deployment process must be deleted.
At the conclusion of a successful deployment, the original instances in the deployment group must be deleted immediately to lower costs.

How can a DevOps engineer satisfy these requirements?

A Use an Application Load Balancer and an in-place deployment. Associate the Auto Scaling group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.OneAtAtime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the AllowTraffic hook within appspec.yml to delete the temporary files.
B Use an Application Load Balancer and a blue/green deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the Automatically copy Auto scaling group option, create a custom deployment configuration with minimum healthy hosts defined as 50%, and assign the configuration to the deployment group. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BeforeBlockTraffic hook within appspec.yml to delete the temporary files.
C Use an Application Load Balancer and a blue/green deployment. Associate the Auto Scaling group and the Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.HalfAtAtime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BeforeAllowTraffic hook within appspec.yml to delete the temporary files.
D Use an Application Load Balancer and an in-place deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault AllatOnce as a deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BlockTraffic hook within appspec.yml to delete the temporary files.

Explanation

An EC2/On-Premises blue/green deployment replaces the original environment with a separately provisioned replacement environment, and copying an existing Auto Scaling group creates the replacement fleet automatically. CodeDeployDefault.HalfAtATime has a 50% minimum healthy-host setting and processes the replacement instances in halves. BeforeAllowTraffic runs on replacement instances before they are registered with the load balancer, allowing temporary files to be removed before they receive traffic. After successful rerouting, CodeDeploy can terminate the original environment immediately.

Learn more

A company uses AWS Control Tower to manage its multi-account AWS environment. Historically, the company has created AWS accounts through AWS Control Tower in the AWS Management Console. The company wants to implement an automated solution to create new AWS accounts by using AWS Control Tower Account Factory.

A DevOps engineer is testing a new approach in which employees upload a CSV file to an Amazon S3 bucket. The .csv file will contain the information necessary to create a new AWS account. An AWS Lambda function will process Amazon S3 event notifications when new files are created in the S3 bucket. The Lambda function will create the AWS account by using the AWS Service Catalog APIs.

The DevOps engineer must implement a solution that publishes a notification to an Amazon Simple Notification Service (Amazon SNS) topic when the account-creation process completes successfully.

What should the DevOps engineer do to automate the SNS notification?

A Configure AWS Control Tower to publish to the SNS topic when the automatic drift detection feature identifies that a new account has been added to the service.
B Configure the AWS Control Tower Account Factory product in AWS Service Catalog to publish to the SNS topic when a new account product is launched with the service.
C Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that reacts to the AWS Service Catalog ProvisionProduct event and publishes to the SNS topic.
D Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that reacts to the AWS Control Tower CreateManagedAccount event and publishes to the SNS topic.

Explanation

AWS Control Tower records the successful creation and provisioning of an Account Factory account as a CreateManagedAccount lifecycle event. An Amazon EventBridge rule can react to that event, filter for successful completion, and use the Amazon SNS topic as its target. The Service Catalog ProvisionProduct API event occurs when the provisioning request is submitted, so it does not by itself establish that account creation completed successfully.

Learn more

A space-exploration company receives telemetry data from multiple satellites. Small data packets arrive through Amazon API Gateway and are placed directly into an Amazon Simple Queue Service (Amazon SOS) standard queue. A custom application subscribes to the queue and transforms the data into a standard format.

Because of inconsistencies in the data produced by the satellites, the application occasionally cannot transform the data. In these situations, the messages stay in the SQS queue. A DevOps engineer must create a solution that retains the failed messages and makes them available to scientists for review and later processing.

Which solution meets these requirements?

A Configure AWS Lambda to poll the SOS queue and invoke a Lambda function to check whether the queue messages are valid. If validation fails, send a copy of the data that is not valid to an Amazon S3 bucket so that the scientists can review and correct the data. When the data is corrected, amend the message in the SOS queue by using a replay Lambda function with the corrected data
B Convert the SQS standard queue to an SQS FIFO queue. Configure AWS Lambda to poll the SQS queue every 10 minutes by using an Amazon EventBridge schedule. Invoke the Lambda function to identify any messages with a SentTimestamp value that is older than 5 minutes, push the data to the same location as the application's output location, and remove the messages from the queue.
C Create an SOS dead-letter queue. Modify the existing queue by including a redrive policy that sets the Maximum Receives setting to 1 and sets the dead-letter queue ARN to the ARN of the newly created queue. Instruct the scientists to use the dead-letter queue to review the data that is not valid. Reprocess this data at a later time.
D Configure API Gateway to send messages to different SOS virtual queues that are named for each of the satellites. Update the application to use a new virtual queue for any data that it cannot transform, and send the message to the new virtual queue. Instruct the scientists to use the virtual queue to review the data that is not valid. Reprocess this data at a later time.

Explanation

An Amazon SQS dead-letter queue retains messages that the consumer cannot successfully process after the configured receive threshold. A redrive policy on the source queue specifies the dead-letter queue ARN and maxReceiveCount; setting the threshold to 1 moves failed messages to the dead-letter queue for scientists to review and reprocess later.

Learn more

Using dead-letter queues in Amazon SQS

A company uses one AWS account to test applications on Amazon EC2 instances. AWS Config is enabled in the account, and the restricted-ssh AWS Config managed rule is active.

The company requires an automated monitoring solution that provides a customized, real-time notification whenever any security group in the account is noncompliant with the restricted-ssh rule. The customized notification must include the name and ID of the noncompliant security group.

A DevOps engineer creates an Amazon Simple Notification Service (Amazon SNS) topic in the account and subscribes the appropriate personnel to that topic.

What should the DevOps engineer do next to satisfy these requirements?

A Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Configure an input transformer for the EventBridge (CloudWatch Events) rule. Configure the EventBridge (CloudWatch Events) rule to publish a notification to the SNS topic.
B Configure AWS Config to send all evaluation results for the restricted-ssh rule to the SNS topic. Configure a filter policy on the SNS topic to send only notifications that contain the text of NON_COMPLIANT in the notification to subscribers.
C Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Configure the EventBridge (CloudWatch Events) rule to invoke AWS Systems Manager Run Command on the SNS topic to customize a notification and to publish the notification to the SNS topic.
D Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches all AWS Config evaluation results of NON_COMPLIANT. Configure an input transformer for the restricted-ssh rule. Configure the EventBridge (CloudWatch Events) rule to publish a notification to the SNS topic.

Explanation

An Amazon EventBridge rule can match AWS Config rule-compliance-change events specifically for the restricted-ssh rule with a NON_COMPLIANT result. An EventBridge input transformer can extract values from the matching event, including the affected security group’s name and ID, and format them as a custom message sent to the Amazon SNS topic. AWS Config documents EventBridge support for notifications on Config Rules Compliance Change events, and EventBridge input transformers customize event data before it is delivered to an SNS target.

Learn more

A retail company plans to use AWS Elastic Beanstalk to host its Java-based online sales website. Because this will be the production website, the CTO has these deployment-strategy requirements:

Zero downtime. During the deployment, the Amazon EC2 instances currently in service must stay in service. No deployment or other action may be performed on those EC2 instances because they handle production traffic.
A new fleet of instances must be provisioned to deploy the new application version.
After the new application version is successfully deployed to the new fleet, the new instances must be put into service and the old instances removed.
Rollback must be as simple as possible. If deployment of the new application version to the new fleet fails, those instances must be terminated and the current instances must continue serving traffic normally.
Resources in the environment (the EC2 Auto Scaling group, Elastic Load Balancing, and Elastic Beanstalk DNS CNAME) must remain unchanged, and no DNS change can be made.

Which deployment strategy meets these requirements?

A Use rolling deployments with a fixed amount of one instance at a time and set the healthy threshold to OK.
B Use rolling deployments with additional batch with a fixed amount of one instance at a time and set the healthy threshold to OK.
C Launch a new environment and deploy the new application version there, then perform a CNAME swap between environments.
D Use immutable environment updates to meet all the necessary requirements.

Explanation

An immutable deployment launches a fresh instance fleet in a temporary Auto Scaling group behind the existing environment load balancer while the original fleet continues serving traffic. After the new instances pass health checks, Elastic Beanstalk replaces the old instances; if deployment fails, it terminates the new Auto Scaling group and leaves the original instances untouched. The environment’s existing load balancer and CNAME remain in use, so no DNS swap is required.

Learn more

A company is developing a software solution that runs a particular parallel-processing mechanism. In certain specialized scenarios, the software can scale to tens of servers. The solution uses a proprietary, license-based library that requires one dedicated license to be installed on each server. The company owns 200 licenses and plans to run no more than 200 server nodes concurrently.

The company requests these features:

A way to automate license usage at scale.
Creation of a dashboard for future use to check which licenses are available at any time.

What is the MOST effective way to meet these requirements?

A Upload the licenses to a private Amazon S3 bucket. Create an AWS CloudFormation template with a Mappings section for the licenses. In the template, create an Auto Scaling group to launch the servers. In the user data script, acquire an available license from the Mappings section. Create an Auto Scaling lifecycle hook, then use it to update the mapping after the instance is terminated.
B Upload the licenses to an Amazon DynamoDB table. Create an AWS CloudFormation template that uses an Auto Scaling group to launch the servers. In the user data script, acquire an available license from the DynamoDB table. Create an Auto Scaling lifecycle hook, then use it to update the mapping after the instance is terminated.
C Upload the licenses to a private Amazon S3 bucket. Populate an Amazon SQS queue with the list of licenses stored in S3. Create an AWS CloudFormation template that uses an Auto Scaling group to launch the servers. In the user data script acquire an available license from SQS. Create an Auto Scaling lifecycle hook, then use it to put the license back in SQS after the instance is terminated.
D Upload the licenses to an Amazon DynamoDB table. Create an AWS CLI script to launch the servers by using the parameter --count, with min:max instances to launch. In the user data script, acquire an available license from the DynamoDB table. Monitor each instance and, in case of failure, replace the instance, then manually update the DynamoDB table.

Explanation

Amazon SQS can act as a pool of license tokens: each available license is represented by a queue message, and a launching instance receives one token exclusively while the message is invisible to other consumers. A termination lifecycle hook provides time to return that token to the queue before the instance terminates. The number of available queue messages can be monitored in CloudWatch for an availability dashboard. CloudFormation mappings are static template mappings and are not a runtime license-allocation store.

Learn more

A company operates a data-ingestion application across multiple AWS accounts. The accounts belong to an organization in AWS Organizations. The company needs to monitor the application and centralize access to it. Currently, the application runs on Amazon EC2 instances in several Auto Scaling groups. The EC2 instances do not have internet access because the data is sensitive. Engineers have deployed the required VPC endpoints. The EC2 instances use a custom AMI built specifically for the application.

To maintain and troubleshoot the application, system administrators need to be able to log in to the EC2 instances. This access must be automated and centrally controlled. The company’s security team must be notified whenever the instances are accessed.

Which solution meets these requirements?

A Create an Amazon EventBridge (Amazon CloudWatch Events) rule to send notifications to the security team whenever a user logs in to an EC2 instance. Use EC2 Instance Connect to log in to the instances. Deploy Auto Scaling groups by using AWS CloudFormation. Use the cfn-init helper script to deploy appropriate VPC routes for external access. Rebuild the custom AMI so that the custom AMI includes AWS Systems Manager Agent.
B Deploy a NAT gateway and a bastion host that has internet access. Create a security group that allows incoming traffic on all the EC2 instances from the bastion host. Install AWS Systems Manager Agent on all the EC2 instances. Use Auto Scaling group lifecycle hooks for monitoring and auditing access. Use Systems Manager Session Manager to log in to the instances. Send logs to a log group in Amazon CloudWatch Logs. Export data to Amazon 83 for auditing. Send notifications to the security team by using S3 event notifications.
C Use EC2 Image Builder to rebuild the custom AMI. Include the most recent version of AWS Systems Manager Agent in the image. Configure the Auto Scaling group to attach the AmazonSSMManagedlnstanceCore role to all the EC2 instances. Use Systems Manager Session Manager to log in to the instances. Enable logging of session details to Amazon S3. Create an S3 notification for new file uploads to send a message to the security team through an Amazon Simple Notification Service (Amazon SNS) topic.
D Use AWS Systems Manager Automation to build Systems Manager Agent into the custom AMI. Configure AWS Config to attach an SCP to the root organization account to allow the EC2 instances to connect to Systems Manager. Use Systems Manager Session Manager to log in to the instances. Enable logging of session details to Amazon S3. Create an S3 notification for new file uploads to send a message to the security team through an Amazon Simple Notification Service (Amazon SNS) topic.

Explanation

AWS Systems Manager Session Manager provides centrally controlled access to private EC2 instances through Systems Manager endpoints, without requiring inbound SSH access or internet connectivity. Managed instances need SSM Agent and an IAM instance profile with the required Systems Manager permissions; the AmazonSSMManagedInstanceCore managed policy provides those permissions. Session Manager can store session data in Amazon S3, and S3 object-upload notifications can invoke an Amazon SNS topic for security-team notifications.

Learn more

AWS DevOps Engineer - ProfessionalDemo

AWS DevOps Engineer - ProfessionalDemo

Exam Topics

How to Use This Practice Exam

Download the Full Exam PDF

QuestionQ1

Community Discussion

QuestionQ2

Community Discussion

QuestionQ3

Community Discussion

QuestionQ4

Community Discussion

QuestionQ5

Community Discussion

QuestionQ6

Community Discussion

QuestionQ7

QuestionQ8

QuestionQ9

QuestionQ10

QuestionQ11

QuestionQ12

QuestionQ13

QuestionQ14

QuestionQ15

QuestionQ16

QuestionQ17

QuestionQ18

QuestionQ19

QuestionQ20

QuestionQ21

QuestionQ22

QuestionQ23

QuestionQ24

QuestionQ25

It's free

QuestionQ6

Community Discussion

QuestionQ7

QuestionQ8

QuestionQ9

QuestionQ10

QuestionQ11

QuestionQ12

QuestionQ13

QuestionQ14

QuestionQ15

QuestionQ16

QuestionQ17

QuestionQ18

QuestionQ19

QuestionQ20

QuestionQ21

QuestionQ22

QuestionQ23

QuestionQ24

QuestionQ25

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Want a break from the ads?

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion

Community Discussion