AWS DOP-C02 · Updated 2026
Free AWS DevOps Engineer Professional Practice Exam (DOP-C02)
Full-length DOP-C02 mock exams with the same number of questions and time as the real exam. CI/CD, infrastructure as code, resilience, monitoring, incident response and security scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
75 questions · 3 hours · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 8
🏆
Question 1SDLC Automation
A company runs CodePipeline in us-east-1 and adds a deploy action that creates a CloudFormation stack in ap-southeast-2. The pipeline is defined in CloudFormation. The new action fails during pipeline creation because the artifacts are not available in that Region. Which change BEST fixes the problem?
Correct answer: A. Define an artifact store for each Region in the pipeline and set the Region on the deploy action.
Cross-Region actions need an artifact store in each Region where actions run, defined in the pipeline's artifact stores map. CodePipeline then copies artifacts to that Region automatically. Replicating the bucket yourself is not how CodePipeline locates cross-Region artifacts.
Cross-Region actions need an artifact store in each Region where actions run, defined in the pipeline's artifact stores map. CodePipeline then copies artifacts to that Region automatically. Replicating the bucket yourself is not how CodePipeline locates cross-Region artifacts.
Question 2Incident & Event Response
A photo sharing company stores uploads in an S3 bucket. Three separate teams each need their own Amazon SQS queue to receive every object-created event for the uploads/ prefix. The company wants the bucket's event notification setup to stay simple. Which solution BEST meets these requirements?
Correct answer: C. Send the object-created notification to an SNS topic and subscribe the three SQS queues to that topic.
An SNS topic fans out each S3 event to every subscribed queue, so all three teams get every event from one notification configuration. S3 does not allow overlapping notification configurations with the same prefix and event type, so three separate configurations would be rejected.
An SNS topic fans out each S3 event to every subscribed queue, so all three teams get every event from one notification configuration. S3 does not allow overlapping notification configurations with the same prefix and event type, so three separate configurations would be rejected.
Question 3Resilient Solutions
A SaaS company bakes a new AMI every week and must roll it out to an Auto Scaling group of 60 instances behind an Application Load Balancer. The rollout must keep at least 90 percent of capacity healthy, pause after the first 10 percent for validation, and roll back automatically if CloudWatch alarms fire. The company wants the least custom tooling. Which solution BEST meets these requirements?
Correct answer: D. Run an instance refresh with 90 percent minimum healthy, a 10 percent checkpoint, and alarm rollback.
Instance refresh natively supports a minimum healthy percentage, checkpoints, and automatic rollback when specified alarms go into ALARM. A scripted batch replacement could work but adds the custom tooling the company wants to avoid.
Instance refresh natively supports a minimum healthy percentage, checkpoints, and automatic rollback when specified alarms go into ALARM. A scripted batch replacement could work but adds the custom tooling the company wants to avoid.
Question 4SDLC Automation
A payments company uses a V2 pipeline that deploys database migrations. Developers often push several commits within minutes. Every commit must be deployed in order, and no commit may be skipped by a newer execution. Which configuration BEST meets these requirements?
Correct answer: D. Set the pipeline execution mode to QUEUED.
QUEUED mode processes executions one at a time in the order they arrive, so no commit is skipped. SUPERSEDED mode lets a newer execution replace a waiting one, which skips commits. PARALLEL mode runs executions independently, so order is not guaranteed.
QUEUED mode processes executions one at a time in the order they arrive, so no commit is skipped. SUPERSEDED mode lets a newer execution replace a waiting one, which skips commits. PARALLEL mode runs executions independently, so order is not guaranteed.
Question 5Incident & Event Response
An insurance company invokes a Lambda function asynchronously from an internal application. When an invocation fails after all retries, the support team needs one record that contains the original event, the error message, and the stack trace. The team wants to use a native Lambda feature. Which solution BEST meets these requirements?
Correct answer: B. Configure an on-failure destination that sends invocation records to an SQS queue.
An on-failure destination receives an invocation record with the request payload and the response, which includes the error message and stack trace. A dead-letter queue keeps only the event payload with limited error attributes, so it does not include the full error details.
An on-failure destination receives an invocation record with the request payload and the response, which includes the error message and stack trace. A dead-letter queue keeps only the event payload with limited error attributes, so it does not include the full error details.
Question 6Resilient Solutions
A data processing company runs a stateless worker fleet in an Auto Scaling group that uses only On-Demand c5.2xlarge instances. It wants to cut compute cost with Spot Instances while keeping a baseline of 4 On-Demand instances. It also wants to reduce the chance of Spot interruptions. Which solution BEST meets these requirements?
Correct answer: B. Use a mixed instances policy with diverse instance types, an On-Demand base of 4, and price-capacity-optimized Spot.
Diversifying across several instance types and using the price-capacity-optimized strategy places Spot capacity in the deepest pools, which lowers interruption risk while the On-Demand base keeps the baseline. A single instance type with lowest-price allocation concentrates the fleet in a few pools that are more likely to be interrupted.
Diversifying across several instance types and using the price-capacity-optimized strategy places Spot capacity in the deepest pools, which lowers interruption risk while the On-Demand base keeps the baseline. A single instance type with lowest-price allocation concentrates the fleet in a few pools that are more likely to be interrupted.
Question 7SDLC Automation
A company uses a V2 pipeline with a production deploy stage. When that stage fails, engineers currently find the last good commit and rerun the pipeline by hand, which takes 30 minutes. The company wants the stage to return to the last successful version automatically. Which solution BEST meets this requirement?
Correct answer: D. Configure the production stage with an on-failure result of rollback.
V2 pipelines support automatic stage rollback, which redeploys the source revisions from the last successful execution of that stage. Retrying the failed action reruns the same bad version. Restarting the pipeline uses the latest commit, which is the version that failed.
V2 pipelines support automatic stage rollback, which redeploys the source revisions from the last successful execution of that stage. Retrying the failed action reruns the same bad version. Restarting the pipeline uses the latest commit, which is the version that failed.
Question 8Incident & Event Response
A company uses an Amazon SQS queue as a Lambda event source with a batch size of 10. When one message in a batch fails, the whole batch returns to the queue, and messages that succeeded are processed again. The team wants only the failed messages retried while keeping batching for throughput. Which solution BEST meets these requirements?
Correct answer: C. Enable ReportBatchItemFailures on the event source mapping and return the failed message IDs from the function.
With ReportBatchItemFailures, the function returns the IDs of failed messages, and only those messages become visible again for retry. A batch size of 1 also avoids reprocessing, but it gives up batching and lowers throughput.
With ReportBatchItemFailures, the function returns the IDs of failed messages, and only those messages become visible again for retry. A batch size of 1 also avoids reprocessing, but it gives up batching and lowers throughput.
Question 9Resilient Solutions
A company's Auto Scaling group launches instances that run a configuration script to register with a license server and pull secrets. Health checks sometimes pass before the script finishes, so the load balancer sends traffic to instances that are not ready. The company wants instances to enter service only after the script succeeds and to be terminated if it fails. Which solution BEST meets these requirements?
Correct answer: B. Add a launch lifecycle hook and have the script complete it with CONTINUE on success or ABANDON on failure.
A launch lifecycle hook keeps the instance in Pending:Wait until the script signals CONTINUE, and ABANDON causes the group to terminate it. The health check grace period only delays health check replacement and does not stop traffic or handle a failed script.
A launch lifecycle hook keeps the instance in Pending:Wait until the script signals CONTINUE, and ABANDON causes the group to terminate it. The health check grace period only delays health check replacement and does not stop traffic or handle a failed script.
Question 10SDLC Automation
A company runs integration tests in CodeBuild that create temporary resources in the post_build phase. When a test fails, the build stops and the cleanup commands never run, which leaves resources behind. The cleanup must run whether the tests pass or fail. Which buildspec change BEST meets this requirement?
Correct answer: C. Move the cleanup commands into a finally block in the phase that runs the tests.
Commands in a finally block run after the phase's commands even if those commands fail. That guarantees cleanup in both outcomes. Setting on-failure to ABORT stops the build earlier and does not run cleanup.
Commands in a finally block run after the phase's commands even if those commands fail. That guarantees cleanup in both outcomes. Setting on-failure to ABORT stops the build earlier and does not run cleanup.
Question 11SDLC Automation
A team builds serverless applications with Lambda, API Gateway and DynamoDB and wants a concise template format plus a CLI that packages code, deploys through CloudFormation and can set up gradual Lambda deployments with CodeDeploy using a single property. Which tool should the DevOps engineer standardize on?
Correct answer: A. AWS Serverless Application Model (AWS SAM)
AWS SAM extends CloudFormation with shorthand serverless resources, and its DeploymentPreference property wires up CodeDeploy traffic shifting for Lambda automatically. Hand-written CloudFormation can do the same but needs far more template code for each function.
AWS SAM extends CloudFormation with shorthand serverless resources, and its DeploymentPreference property wires up CodeDeploy traffic shifting for Lambda automatically. Hand-written CloudFormation can do the same but needs far more template code for each function.
Question 12Incident & Event Response
An operations team wants one place to track and resolve operational issues across its AWS accounts. When certain CloudWatch alarms fire, a work item should be created automatically with the related resources and suggested runbooks. Engineers want to investigate and run remediation from the same console. Which solution BEST meets these requirements?
Correct answer: B. Configure the alarms to create Systems Manager OpsCenter OpsItems and associate runbooks with them.
CloudWatch alarms can create OpsItems in OpsCenter, which show related resources and let engineers run Automation runbooks from the same console. An email inbox or a custom dashboard gives no built-in link to resources or runbooks.
CloudWatch alarms can create OpsItems in OpsCenter, which show related resources and let engineers run Automation runbooks from the same console. An email inbox or a custom dashboard gives no built-in link to resources or runbooks.
Question 13Resilient Solutions
A logistics company uses Route 53 failover routing for an internal API. The primary endpoint is the private IP address of an application server in a VPC, and the secondary is a standby server in another Region. The health check for the primary never reports healthy because Route 53 health checkers cannot reach private IP addresses. Which solution BEST provides automatic failover based on the primary's health?
Correct answer: A. Use a Route 53 health check that monitors a CloudWatch alarm on an application health metric.
Route 53 health checks can track the state of a CloudWatch alarm, which works for private resources that health checkers cannot reach over the internet. Opening the security group does not help because the private IP address is not reachable from the public health checkers.
Route 53 health checks can track the state of a CloudWatch alarm, which works for private resources that health checkers cannot reach over the internet. Opening the security group does not help because the private IP address is not reachable from the public health checkers.
Question 14SDLC Automation
A software vendor must test a library against three runtime versions on two operating systems. The team currently maintains six nearly identical CodeBuild projects. The company wants one project that runs all combinations in parallel. Which solution BEST meets this requirement?
Correct answer: C. Use a CodeBuild batch build with a build matrix that defines the runtime and image combinations.
A batch build matrix runs parallel builds for each combination of the listed environment settings from one project. A loop runs the tests serially and on one OS image. Six pipeline actions still require separate configuration to maintain.
A batch build matrix runs parallel builds for each combination of the listed environment settings from one project. A loop runs the tests serially and on one OS image. Six pipeline actions still require separate configuration to maintain.
Question 15Incident & Event Response
A company requires S3 Block Public Access to stay turned on for every bucket in a regulated account. If anyone removes the Block Public Access configuration from a bucket, it must be reapplied automatically within a few minutes. CloudTrail is enabled for management events. Which solution BEST meets these requirements?
Correct answer: D. Create an EventBridge rule that matches the DeletePublicAccessBlock API call and invokes a function that reapplies it.
CloudTrail management events reach EventBridge within minutes, so a rule on DeletePublicAccessBlock can trigger a function that puts the setting back right away. A periodic Config rule only reports the issue once a day and takes no corrective action.
CloudTrail management events reach EventBridge within minutes, so a rule on DeletePublicAccessBlock can trigger a function that puts the setting back right away. A periodic Config rule only reports the issue once a day and takes no corrective action.
Question 16Resilient Solutions
A ride sharing company stores trip data in a DynamoDB table in us-east-1. It is expanding to Europe and needs users in both Regions to read and write locally with single-digit millisecond latency. The application must keep working in one Region if the other Region fails. Which solution BEST meets these requirements?
Correct answer: D. Convert the table to a DynamoDB global table with a replica in an EU Region.
Global tables provide fully managed multi-Region, multi-active replication, so each Region can read and write locally and keep working if the other Region fails. A Streams and Lambda copy is one-way, adds custom code, and does not support local writes in Europe.
Global tables provide fully managed multi-Region, multi-active replication, so each Region can read and write locally and keep working if the other Region fails. A Streams and Lambda copy is one-way, adds custom code, and does not support local writes in Europe.
Question 17SDLC Automation
A company deploys a Lambda function with CodeDeploy linear traffic shifting. The team wants to invoke the new version with synthetic requests and confirm it works before it receives any production traffic. A failed check must stop the deployment. Which solution BEST meets this requirement?
Correct answer: A. Add a Lambda function to the BeforeAllowTraffic hook in the AppSpec file that tests the new version.
The BeforeAllowTraffic hook runs before any traffic shifts to the new version, and a failure status stops and rolls back the deployment. AfterAllowTraffic runs only after all traffic has moved. A canary against the production alias tests traffic that users already see.
The BeforeAllowTraffic hook runs before any traffic shifts to the new version, and a failure status stops and rolls back the deployment. AfterAllowTraffic runs only after all traffic has moved. A canary against the production alias tests traffic that users already see.
Question 18Incident & Event Response
A developer's new CloudFormation stack keeps failing during creation. Each time, the rollback deletes all resources before the developer can inspect them. The developer wants resources that were created successfully to stay in place so the failure can be debugged and the stack operation retried. Which solution BEST meets these requirements?
Correct answer: B. Create the stack with the option to preserve successfully provisioned resources on failure.
Preserving successfully provisioned resources pauses the stack in a failed state instead of rolling back, so the developer can inspect it and retry. Termination protection only prevents stack deletion and does not stop a creation rollback.
Preserving successfully provisioned resources pauses the stack in a failed state instead of rolling back, so the developer can inspect it and retry. Termination protection only prevents stack deletion and does not stop a creation rollback.
Question 19SDLC Automation
A company uses CodeDeploy blue/green deployments for an Amazon ECS service. After traffic shifts, some issues only appear under real load about 30 minutes later. The company wants a fast rollback to the previous task set during the first hour without redeploying. Which solution BEST meets this requirement?
Correct answer: D. Set the original task set termination wait time to 60 minutes in the deployment group.
The termination wait time keeps the original task set running after the traffic shift, so a rollback simply reroutes traffic back to it. Redeploying the old task definition takes longer. A linear shift finishes in about 30 minutes and then removes the old tasks, which does not cover the full hour.
The termination wait time keeps the original task set running after the traffic shift, so a rollback simply reroutes traffic back to it. Redeploying the old task definition takes longer. A linear shift finishes in about 30 minutes and then removes the old tasks, which does not cover the full hour.
Question 20Resilient Solutions
A social media company stores user sessions in a single-node ElastiCache for Redis OSS cluster. When the node failed last month, all users were logged out and recovery took 20 minutes. The company wants sessions to survive a node or Availability Zone failure, with automatic recovery in about a minute. Which solution BEST meets these requirements?
Correct answer: C. Add replicas in other Availability Zones and enable Multi-AZ with automatic failover.
With replicas in other Availability Zones and Multi-AZ enabled, ElastiCache promotes a replica automatically when the primary fails, usually within about a minute. Daily snapshot restores lose up to a day of sessions and take far longer to recover.
With replicas in other Availability Zones and Multi-AZ enabled, ElastiCache promotes a replica automatically when the primary fails, usually within about a minute. Daily snapshot restores lose up to a day of sessions and take far longer to recover.
Question 21Incident & Event Response
An EC2 Auto Scaling group uses a launch template with EBS volumes encrypted by a customer managed KMS key. New instances fail to launch, and the scaling activity history shows a client error about the KMS key used for the volumes. The key is enabled. Which solution BEST meets these requirements?
Correct answer: A. Update the key policy so the Auto Scaling service-linked role can use the key and create grants.
Amazon EC2 Auto Scaling uses its service-linked role to create encrypted volumes, so that role needs permission to use the customer managed key and create grants. The instance profile role is used by software on the instance after launch, not by Auto Scaling when it creates volumes.
Amazon EC2 Auto Scaling uses its service-linked role to create encrypted volumes, so that role needs permission to use the customer managed key and create grants. The instance profile role is used by software on the instance after launch, not by Auto Scaling when it creates volumes.
Question 22SDLC Automation
A company deploys an application with CodeDeploy to EC2 instances in an Auto Scaling group. When the group scales out, new instances start without the application and fail health checks. Instances must receive the latest successful revision automatically. Which solution BEST meets this requirement?
Correct answer: C. Add the Auto Scaling group to the CodeDeploy deployment group.
When an Auto Scaling group is part of a deployment group, CodeDeploy adds a lifecycle hook and deploys the last successful revision to new instances before they go in service. A cron job bypasses CodeDeploy and its hooks. Rerunning the pipeline deploys the newest commit to the whole fleet, which is not intended.
When an Auto Scaling group is part of a deployment group, CodeDeploy adds a lifecycle hook and deploys the last successful revision to new instances before they go in service. A cron job bypasses CodeDeploy and its hooks. Rerunning the pipeline deploys the newest commit to the whole fleet, which is not intended.
Question 23Resilient Solutions
An insurance company's Lambda function processes claim uploads and writes to an RDS for MySQL database. During large batch uploads, the function scales to hundreds of concurrent executions and exhausts database connections, which also affects other applications. The company wants to cap the function at 50 concurrent executions and guarantee it that capacity. Which solution BEST meets these requirements?
Correct answer: A. Set reserved concurrency on the function to 50.
Reserved concurrency both sets aside and caps the concurrency for one function, so it never exceeds 50 executions. Provisioned concurrency pre-initializes environments but does not cap scaling, so extra requests still run as on-demand executions.
Reserved concurrency both sets aside and caps the concurrency for one function, so it never exceeds 50 executions. Provisioned concurrency pre-initializes environments but does not cap scaling, so extra requests still run as on-demand executions.
Question 24SDLC Automation
A company uses CodeDeploy in-place deployments to EC2. A database migration script must run after the new application files are copied to the instance but before the application starts. Which AppSpec lifecycle hook should run the script?
Correct answer: B. AfterInstall
AfterInstall runs after the files are copied and before ApplicationStart, which fits a migration that needs the new files. BeforeInstall runs before the files are copied. ValidateService runs after the application has already started.
AfterInstall runs after the files are copied and before ApplicationStart, which fits a migration that needs the new files. BeforeInstall runs before the files are copied. ValidateService runs after the application has already started.
Question 25Incident & Event Response
A company deploys a web application to EC2 with AWS CodeDeploy using the OneAtATime configuration. A recent release passed every lifecycle hook but caused a spike in HTTP 5xx errors, and the team rolled back manually an hour later. The team wants future deployments to stop and roll back automatically when the error rate rises. Which solution BEST meets these requirements?
Correct answer: A. Add a CloudWatch alarm on the 5xx error rate to the deployment group and enable rollback when the alarm fires.
CodeDeploy can monitor CloudWatch alarms during a deployment, stop it when an alarm goes into ALARM, and roll back to the last good revision. Rollback on deployment failure alone does not help here because every lifecycle hook succeeded.
CodeDeploy can monitor CloudWatch alarms during a deployment, stop it when an alarm goes into ALARM, and roll back to the last good revision. Rollback on deployment failure alone does not help here because every lifecycle hook succeeded.
Question 26Resilient Solutions
A brokerage company needs a DR strategy for its trading portal in a second Region. The business requires an RTO of 15 minutes and an RPO under 1 minute. The full application stack must already run in the DR Region at reduced size so it can take a small share of live traffic for continuous testing, but the company will not pay for full production capacity there. Which DR strategy BEST meets these requirements?
Correct answer: C. Warm standby with a scaled-down but fully working stack that scales out on failover.
Warm standby runs a smaller, fully functional copy of the stack that can serve some traffic and scale out quickly, which fits the RTO, RPO, and cost limits. Pilot light keeps only core data services running, so it cannot serve live test traffic without first launching the application tier.
Warm standby runs a smaller, fully functional copy of the stack that can serve some traffic and scale out quickly, which fits the RTO, RPO, and cost limits. Pilot light keeps only core data services running, so it cannot serve live test traffic without first launching the application tier.
Question 27SDLC Automation
A company has 40 accounts in AWS Organizations. Teams in every account must publish and consume internal Python packages from one place. The company wants to manage packages centrally and avoid storing duplicate copies in each account. Which solution BEST meets these requirements?
Correct answer: B. Create one CodeArtifact domain in a shared account with a domain policy for the organization and repository policies for access.
A single CodeArtifact domain stores each package asset once, and a domain policy can grant access to all accounts in the organization. Repository policies then control read and publish rights. One domain per account duplicates storage and needs custom sync jobs.
A single CodeArtifact domain stores each package asset once, and a domain policy can grant access to all accounts in the organization. Repository policies then control read and publish rights. One domain per account duplicates storage and needs custom sync jobs.
Question 28Incident & Event Response
A company's order service publishes events to a custom Amazon EventBridge event bus. Last month a downstream consumer had a bug for six hours and silently discarded the events it received. The team wants to be able to reprocess events from a specific past time window after future incidents, without asking publishers to resend. Which solution BEST meets these requirements?
Correct answer: D. Create an archive on the event bus and start a replay for the affected time window when needed.
EventBridge archives store events from a bus, and a replay sends events from a chosen time window back to the bus. A dead-letter queue only captures events that EventBridge failed to deliver, and these events were delivered and then discarded by the consumer.
EventBridge archives store events from a bus, and a replay sends events from a chosen time window back to the bus. A dead-letter queue only captures events that EventBridge failed to deliver, and these events were delivered and then discarded by the consumer.
Question 29SDLC Automation
A company builds images on top of public base images from Docker Hub. Builds fail during busy periods because of Docker Hub rate limits. The company wants base images cached in its private Amazon ECR registry and refreshed automatically, with minimal maintenance. Which solution BEST meets this requirement?
Correct answer: A. Create an ECR pull through cache rule for Docker Hub with credentials stored in Secrets Manager.
A pull through cache rule caches upstream images in the private registry on first pull and keeps them in sync. Docker Hub rules need credentials stored in Secrets Manager. ECR replication only copies between ECR registries, not from Docker Hub.
A pull through cache rule caches upstream images in the private registry on first pull and keeps them in sync. Docker Hub rules need credentials stored in Secrets Manager. ECR replication only copies between ECR registries, not from Docker Hub.
Question 30Resilient Solutions
A legal firm stores case documents in an S3 bucket in us-east-1 and replicates them to us-west-2 for disaster recovery. A new contract requires that 99.99 percent of new objects be replicated within 15 minutes. The team must also be alerted when replication falls behind. Which solution BEST meets these requirements?
Correct answer: B. Enable S3 Replication Time Control on the rule and alarm on its replication metrics.
S3 Replication Time Control is designed to replicate 99.99 percent of objects within 15 minutes and publishes replication metrics and events for alerting. Batch Replication is meant for existing objects and on-demand jobs, not for a continuous replication time guarantee.
S3 Replication Time Control is designed to replicate 99.99 percent of objects within 15 minutes and publishes replication metrics and events for alerting. Batch Replication is meant for existing objects and on-demand jobs, not for a continuous replication time guarantee.
Question 31Incident & Event Response
A company's requests flow through Amazon API Gateway, three ECS services, and a Lambda function. Each component writes a shared request ID to its own CloudWatch Logs log group. During an incident, an engineer must quickly find every log line for a set of failing request IDs across all components, without exporting data. Which solution BEST meets these requirements?
Correct answer: A. Run one CloudWatch Logs Insights query across all the log groups that filters on the request IDs.
Logs Insights can query many log groups at once and filter on a field such as the request ID, which returns the matching lines in place. Exporting to S3 for Athena works but is slower and breaks the requirement to avoid exporting data.
Logs Insights can query many log groups at once and filter on a field such as the request ID, which returns the matching lines in place. Exporting to S3 for Athena works but is slower and breaks the requirement to avoid exporting data.
Question 32SDLC Automation
A company stores images in an ECR repository in a shared services account. ECS tasks in a production account fail to start because they cannot pull images from that repository. The production task execution role already has the required ECR permissions in its own policy. What should the DevOps engineer do?
Correct answer: D. Add an ECR repository policy in the shared account that allows the production task execution role to pull images.
Cross-account pulls need permission on both sides, and the repository policy in the shared account must allow the production principal. The role policy alone is not enough. Replication in the reverse direction would not place the images in production.
Cross-account pulls need permission on both sides, and the repository policy in the shared account must allow the production principal. The role policy alone is not enough. Replication in the reverse direction would not place the images in production.
Question 33Resilient Solutions
A company's DR runbook for a Regional outage has six manual steps, including promoting a cross-Region RDS read replica, updating a Route 53 record, and scaling out an Auto Scaling group in the DR Region. Engineers make mistakes under pressure, but leadership requires a human approval before failover starts. The company wants a repeatable and auditable process. Which solution BEST meets these requirements?
Correct answer: A. Build a Systems Manager Automation runbook with an aws:approve step followed by the failover actions.
An Automation runbook codifies the steps, pauses at the aws:approve step for a named approver, and records each execution for audit. An alarm-driven Lambda function automates the failover but skips the human approval that leadership requires.
An Automation runbook codifies the steps, pauses at the aws:approve step for a named approver, and records each execution for audit. An alarm-driven Lambda function automates the failover but skips the human approval that leadership requires.
Question 34SDLC Automation
A company runs integration tests against a shared staging environment. Tests from different pull requests interfere with each other and give false failures. The company wants isolated test environments for each change at the lowest ongoing cost. Which solution BEST meets these requirements?
Correct answer: C. Have the pipeline create an ephemeral stack for each change, run the tests, and then delete the stack.
Ephemeral stacks give each change its own environment and are deleted after tests, so the company pays only while tests run. Permanent accounts per developer cost more. Testing only after merge lets defects into the main branch.
Ephemeral stacks give each change its own environment and are deleted after tests, so the company pays only while tests run. Permanent accounts per developer cost more. Testing only after merge lets defects into the main branch.
Question 35Security & Compliance
A company's pipeline in a tools account assumes a deployment role in each workload account. The deployment role's trust policy trusts the tools account root principal, so any principal in the tools account with sts:AssumeRole permission could use it. Security wants only the pipeline's role to be able to assume it. Which solution BEST meets these requirements?
Correct answer: A. Change the trust policy principal to the ARN of the pipeline's IAM role in the tools account.
Naming the specific pipeline role ARN as the trusted principal means no other principal in the tools account can assume the deployment role. A permissions boundary limits what the role can do after it is assumed, not who can assume it.
Naming the specific pipeline role ARN as the trusted principal means no other principal in the tools account can assume the deployment role. A permissions boundary limits what the role can do after it is assumed, not who can assume it.
Question 36Resilient Solutions
A marketing analytics company runs an Aurora PostgreSQL cluster on a large provisioned writer that is mostly idle but spikes unpredictably for 10 to 30 minutes several times a day. The spikes are mostly write-heavy batch updates. The company wants capacity to scale in small steps within seconds and to stop paying for unused peak capacity, without changing database engines. Which solution BEST meets these requirements?
Correct answer: D. Move the cluster to Aurora Serverless v2 instances with minimum and maximum ACU settings.
Aurora Serverless v2 scales the writer's capacity in fine-grained ACU steps within seconds and bills for the capacity actually used, with no engine change. Replica auto scaling adds readers, which does not help a write-heavy spike on the writer.
Aurora Serverless v2 scales the writer's capacity in fine-grained ACU steps within seconds and bills for the capacity actually used, with no engine change. Replica auto scaling adds readers, which does not help a write-heavy spike on the writer.
Question 37SDLC Automation
A security team requires that container images with critical vulnerabilities never reach Amazon ECR. Images are built in CodeBuild. The team wants to use a managed AWS scanning service rather than maintain its own vulnerability database. Which solution BEST meets these requirements?
Correct answer: B. Scan an SBOM of the image in CodeBuild with the Amazon Inspector scan API and fail the build on critical findings.
Amazon Inspector CI/CD integration scans an SBOM during the build, so the build can fail before the image is pushed. Inspector maintains the vulnerability data. ECR enhanced scanning runs after the push, so vulnerable images briefly exist in the registry.
Amazon Inspector CI/CD integration scans an SBOM during the build, so the build can fail before the image is pushed. Inspector maintains the vulnerability data. ECR enhanced scanning runs after the push, so vulnerable images briefly exist in the registry.
Question 38Security & Compliance
A company uses IAM Identity Center connected to its corporate directory. It has 25 project teams, and each engineer should manage only the EC2 instances tagged with their own team name. The company wants to avoid creating and maintaining a separate permission set for every team. Which solution BEST meets these requirements?
Correct answer: C. Enable attributes for access control for the team attribute, and use one permission set that matches it to the instance tag.
Attributes for access control pass the user's team as a session tag, so one permission set can allow actions when ec2:ResourceTag/team matches aws:PrincipalTag/team. Separate permission sets per team would work but create the maintenance the company wants to avoid.
Attributes for access control pass the user's team as a session tag, so one permission set can allow actions when ec2:ResourceTag/team matches aws:PrincipalTag/team. Separate permission sets per team would work but create the maintenance the company wants to avoid.
Question 39SDLC Automation
A company's pipeline uses the GitHub version 1 source action with a personal OAuth token. Security wants to remove personal tokens and use the recommended app-based integration. Which solution BEST meets this requirement?
Correct answer: B. Create a connection with AWS CodeConnections, install the AWS GitHub app, and switch to the connection-based source action.
Connections use the AWS GitHub app instead of personal tokens, and they are the recommended source integration for GitHub. After the connection is created, it must be completed in the console to become available. Storing the token in Secrets Manager still relies on a personal token.
Connections use the AWS GitHub app instead of personal tokens, and they are the recommended source integration for GitHub. After the connection is created, it must be completed in the console to become available. Storing the token in Secrets Manager still relies on a personal token.
Question 40Monitoring & Logging
A legacy Java application on EC2 sends its logs to CloudWatch Logs through the CloudWatch agent. Log lines that contain the text OutOfMemoryError mean the service will soon crash. The team wants an alarm within a few minutes whenever one or more of these lines appear, without changing application code. Which solution BEST meets these requirements?
Correct answer: D. Create a metric filter for OutOfMemoryError and alarm when the metric is 1 or more.
A metric filter turns matching log lines into a CloudWatch metric as they arrive, and an alarm on that metric fires within minutes. An hourly query is too slow and would need extra scheduling code to raise an alert.
A metric filter turns matching log lines into a CloudWatch metric as they arrive, and an alarm on that metric fires within minutes. An hourly query is too slow and would need extra scheduling code to raise an alert.
Question 41Security & Compliance
An application fleet caches database credentials from AWS Secrets Manager for up to one hour. When Secrets Manager rotates the password of the single database user, some instances fail to connect until their cache refreshes. The team needs automatic rotation without these connection failures. Which solution BEST meets these requirements?
Correct answer: B. Switch to the alternating users rotation strategy so the previous credentials stay valid while caches refresh.
The alternating users strategy rotates between two database users, so the credentials from the previous version keep working while application caches refresh. Rotating more often would cause the same failures more often, and manual changes do not meet the automatic rotation requirement.
The alternating users strategy rotates between two database users, so the credentials from the previous version keep working while application caches refresh. Rotating more often would cause the same failures more often, and manual changes do not meet the automatic rotation requirement.
Question 42SDLC Automation
A test stage in CodePipeline runs three independent CodeBuild actions: unit tests, a static analysis scan and a license check. Each takes about 10 minutes, and they currently run one after another. The team wants the stage to finish faster without adding new stages. What should the DevOps engineer change?
Correct answer: C. Give all three actions the same runOrder value so they run in parallel
Actions in a stage that share the same runOrder run in parallel, so the stage takes about as long as the slowest action instead of the sum. A larger compute type can speed each build a little but still runs them one after another.
Actions in a stage that share the same runOrder run in parallel, so the stage takes about as long as the slowest action instead of the sum. A larger compute type can speed each build a little but still runs them one after another.
Question 43Monitoring & Logging
An API team publishes Requests and Errors as two separate custom metrics. Alarms on raw error counts fire at peak hours even when the error rate is low, and they miss problems at night. The team wants to alarm when errors exceed 2 percent of requests over 5 minutes without publishing any new metric. Which solution BEST meets these requirements?
Correct answer: A. Create an alarm on the metric math expression 100 * Errors / Requests with a threshold of 2.
CloudWatch alarms can evaluate a metric math expression, so the error rate is calculated from the existing metrics with no new metric. Publishing an ErrorRate metric works but breaks the requirement to avoid new metrics.
CloudWatch alarms can evaluate a metric math expression, so the error rate is calculated from the existing metrics with no new metric. Publishing an ErrorRate metric works but breaks the requirement to avoid new metrics.
Question 44Config Management & IaC
A networking team owns a CloudFormation stack that creates a shared VPC. Several application teams deploy their own stacks into that VPC on their own schedules. The application stacks need the VPC and subnet IDs, and the network stack must be updatable independently. Which approach BEST meets these requirements?
Correct answer: D. Export the IDs from the network stack outputs and use Fn::ImportValue in the application stacks.
Cross-stack references with exports and Fn::ImportValue share values between stacks that have separate owners and lifecycles. Nested stacks would create a separate VPC inside each application stack. Hardcoded IDs break when resources change.
Cross-stack references with exports and Fn::ImportValue share values between stacks that have separate owners and lifecycles. Nested stacks would create a separate VPC inside each application stack. Hardcoded IDs break when resources change.
Question 45Security & Compliance
A team's ECS task definition injects a database password from a Parameter Store SecureString parameter that is encrypted with a customer managed KMS key. The task definition uses the secrets section with valueFrom. Tasks fail to start with an access denied error when the parameter is retrieved. Which solution BEST meets these requirements?
Correct answer: A. Grant the task execution role ssm:GetParameters on the parameter and kms:Decrypt on the key.
ECS uses the task execution role to retrieve values referenced in the secrets section before the container starts, so that role needs access to the parameter and the key. The task role is used by the application code inside the container, not by ECS when it injects secrets.
ECS uses the task execution role to retrieve values referenced in the secrets section before the container starts, so that role needs access to the parameter and the key. The task role is used by the application code inside the container, not by ECS when it injects secrets.
Question 46Monitoring & Logging
A company's CloudWatch Logs bill keeps growing because every log group is set to Never expire. Engineers only query logs from the last 30 days, but auditors require 7 years of retention at the lowest possible cost. Archiving once a day is acceptable. Which solution BEST meets these requirements?
Correct answer: C. Set 30-day retention and export daily to S3 with a lifecycle rule to S3 Glacier Deep Archive.
A 30-day retention policy limits CloudWatch storage cost, and daily export tasks move the logs to S3, where a lifecycle rule moves them to the lowest-cost archive class. Keeping 7 years of data in CloudWatch Logs costs far more than storing it in S3 Glacier Deep Archive.
A 30-day retention policy limits CloudWatch storage cost, and daily export tasks move the logs to S3, where a lifecycle rule moves them to the lowest-cost archive class. Keeping 7 years of data in CloudWatch Logs costs far more than storing it in S3 Glacier Deep Archive.
Question 47Config Management & IaC
A company's CloudFormation stacks include S3 buckets for build output. Stack deletion fails because the buckets still contain objects. The company wants stacks to delete cleanly without manual steps. Which solution BEST meets this requirement?
Correct answer: D. Add a Lambda-backed custom resource that empties the buckets when it receives a Delete request.
A Lambda-backed custom resource can run code during stack deletion, such as removing all objects, before CloudFormation deletes the bucket. DeletionPolicy Delete is already the default and still fails on non-empty buckets. Stack policies only affect updates.
A Lambda-backed custom resource can run code during stack deletion, such as removing all objects, before CloudFormation deletes the bucket. DeletionPolicy Delete is already the default and still fails on non-empty buckets. Stack policies only affect updates.
Question 48Security & Compliance
A company runs a self-managed Jenkins server on an EC2 instance that deploys resources to AWS. The server uses the long-term access keys of an IAM user, which are stored in a configuration file. An audit flagged the keys as a risk, and the company wants to remove long-term credentials with the least effort. Which solution BEST meets these requirements?
Correct answer: D. Attach an IAM role to the instance through an instance profile and delete the IAM user's access keys.
An instance profile gives the server temporary credentials that rotate automatically, so no long-term keys are needed. Storing the keys in Secrets Manager protects them better, but they are still long-term credentials, which the audit wants removed.
An instance profile gives the server temporary credentials that rotate automatically, so no long-term keys are needed. Storing the keys in Secrets Manager protects them better, but they are still long-term credentials, which the audit wants removed.
Question 49Config Management & IaC
A company updates a production stack that changes its Auto Scaling group and load balancer. The team wants CloudFormation to roll the update back automatically if the application 5XX error alarm fires during the update or in the 15 minutes after it. Which solution BEST meets this requirement?
Correct answer: B. Configure rollback triggers on the stack with the 5XX alarm and a monitoring time of 15 minutes.
Rollback triggers watch specified CloudWatch alarms during an update and for a configured monitoring period afterward. If an alarm fires, CloudFormation rolls back the stack. A change set preview happens before the update, so it cannot react to errors during it.
Rollback triggers watch specified CloudWatch alarms during an update and for a configured monitoring period afterward. If an alarm fires, CloudFormation rolls back the stack. A change set preview happens before the update, so it cannot react to errors during it.
Question 50Monitoring & Logging
A security team wants full-text search across application logs from several CloudWatch Logs log groups and wants to build interactive dashboards in OpenSearch Dashboards. New log events must be searchable within seconds of being written. Which solution BEST meets these requirements?
Correct answer: C. Create subscription filters on the log groups that stream events to an OpenSearch Service domain.
A subscription filter streams log events as they arrive to an Amazon OpenSearch Service domain, which provides full-text search and dashboards within seconds. Hourly exports add up to an hour of delay, which misses the requirement.
A subscription filter streams log events as they arrive to an Amazon OpenSearch Service domain, which provides full-text search and dashboards within seconds. Hourly exports add up to an hour of delay, which misses the requirement.
Question 51Security & Compliance
A healthcare company uses Amazon Macie to scan S3 buckets for sensitive data. When Macie finds personal health information in a bucket that is not approved to store it, the security team wants the object tagged and a ticket opened automatically within minutes. Which solution BEST meets these requirements?
Correct answer: D. Create an EventBridge rule for Macie findings that invokes a Lambda function to tag the object and open the ticket.
Macie publishes findings to EventBridge, so a rule can invoke a Lambda function that tags the object and calls the ticketing system within minutes. Macie only reports findings and has no option to delete objects, and weekly exports are far too slow.
Macie publishes findings to EventBridge, so a rule can invoke a Lambda function that tags the object and calls the ticketing system within minutes. Macie only reports findings and has no option to delete objects, and weekly exports are far too slow.
Question 52Config Management & IaC
A platform team wants all application teams using the AWS CDK to create S3 buckets and ECS services with encryption, logging and standard tags already applied. Teams should reuse these patterns with little code. Which approach BEST meets this requirement?
Correct answer: C. Build a library of higher-level constructs with secure defaults and publish it as a package in CodeArtifact.
Custom higher-level constructs wrap resources with built-in defaults, and teams reuse them as normal code dependencies. Publishing the library in CodeArtifact makes versioned distribution easy. A wiki depends on each team following it correctly.
Custom higher-level constructs wrap resources with built-in defaults, and teams reuse them as normal code dependencies. Publishing the library in CodeArtifact makes versioned distribution easy. A wiki depends on each team following it correctly.
Question 53Monitoring & Logging
A payment service writes a log line with the order ID and the reason whenever a fraud check blocks a transaction. The fraud team wants a message in its chat tool within seconds for each blocked event, and each message must include the order ID and reason. Which solution BEST meets these requirements?
Correct answer: B. Add a subscription filter for the blocked pattern that invokes a Lambda function to post each event.
A subscription filter sends each matching event to Lambda within seconds, so the function can parse the order ID and reason and post them to chat. An alarm on a metric filter only reports a count and cannot include details from individual log events.
A subscription filter sends each matching event to Lambda within seconds, so the function can parse the order ID and reason and post them to chat. An alarm on a metric filter only reports a count and cannot include details from individual log events.
Question 54Config Management & IaC
A company must run a log collection script on 2,000 instances tagged Env=prod. The script must run on no more than 10 percent of instances at a time, and it must stop if more than 5 percent of the invocations fail. Which solution BEST meets these requirements?
Correct answer: C. Use Run Command targeting the tag with a concurrency of 10 percent and an error threshold of 5 percent.
Run Command supports rate control with maximum concurrency and an error threshold, and it can target instances by tag. A State Manager schedule does not limit how many instances run at once in the way required. A per-instance sleep is slow and adds complexity.
Run Command supports rate control with maximum concurrency and an error threshold, and it can target instances by tag. A State Manager schedule does not limit how many instances run at once in the way required. A per-instance sleep is slow and adds complexity.
Question 55Security & Compliance
A company must apply the same set of 40 AWS Config rules, with remediation actions, to every account in its organization, including accounts added later. It wants to deploy and manage the rules as one unit from a central account. Which solution BEST meets these requirements?
Correct answer: A. Deploy an organization conformance pack from the AWS Config delegated administrator account.
An organization conformance pack packages Config rules and remediation actions and deploys them as one unit to all accounts, including new ones. An aggregator only collects compliance data for viewing and does not deploy rules to source accounts.
An organization conformance pack packages Config rules and remediation actions and deploys them as one unit to all accounts, including new ones. An aggregator only collects compliance data for viewing and does not deploy rules to source accounts.
Question 56Monitoring & Logging
A team runs 25 Lambda functions and suspects some are over-provisioned on memory while others reach their memory limits. The standard Lambda metrics do not show memory usage, CPU time, or network usage for each invocation. The team wants these system-level metrics with minimal code changes. Which solution BEST meets these requirements?
Correct answer: B. Enable CloudWatch Lambda Insights by adding its extension layer to the functions.
Lambda Insights uses a Lambda extension layer to collect system-level metrics such as memory, CPU time, and network usage with no code changes. X-Ray shows where time is spent in a request but does not report memory or CPU usage.
Lambda Insights uses a Lambda extension layer to collect system-level metrics such as memory, CPU time, and network usage with no code changes. X-Ray shows where time is spent in a request but does not report memory or CPU usage.
Question 57Config Management & IaC
A company uses AWS Config to detect S3 buckets that allow public read access. The security team wants noncompliant buckets fixed automatically within minutes, without writing custom code. Which solution BEST meets this requirement?
Correct answer: A. Configure AWS Config automatic remediation with an AWS-managed Automation runbook that removes public access.
AWS Config remediation can run a Systems Manager Automation runbook automatically when a resource becomes noncompliant. AWS provides managed runbooks for blocking public S3 access, so no custom code is needed. An SNS email only notifies and relies on a person.
AWS Config remediation can run a Systems Manager Automation runbook automatically when a resource becomes noncompliant. AWS provides managed runbooks for blocking public S3 access, so no custom code is needed. An SNS email only notifies and relies on a person.
Question 58Security & Compliance
A company's security baseline depends on AWS Config recording in every member account. Nobody in a member account, including account administrators, may stop or delete the configuration recorder or delivery channel. A dedicated security role in each account must still be able to make these changes. Which solution BEST meets these requirements?
Correct answer: C. Attach an SCP that denies the Config stop and delete actions unless aws:PrincipalArn matches the security role.
An SCP limits all principals in member accounts, including administrators, and the aws:PrincipalArn condition exempts only the security role. Administrators could simply remove an IAM policy attached to their own roles, so it does not enforce the control.
An SCP limits all principals in member accounts, including administrators, and the aws:PrincipalArn condition exempts only the security role. Administrators could simply remove an IAM policy attached to their own roles, so it does not enforce the control.
Question 59Config Management & IaC
A company must install a third-party monitoring agent on all Windows and Linux instances. The vendor supplies installers for each platform, and versions change monthly. New instances must get the agent automatically. Which solution BEST meets these requirements?
Correct answer: D. Create a Systems Manager Distributor package with the installers and deploy it with a State Manager association.
Distributor packages software for multiple platforms and versions, and a State Manager association installs it on matching instances, including new ones. Monthly AMI rebuilds and instance replacement take far more effort. A monthly Run Command misses instances launched between runs.
Distributor packages software for multiple platforms and versions, and a State Manager association installs it on matching instances, including new ones. Monthly AMI rebuilds and instance replacement take far more effort. A monthly Run Command misses instances launched between runs.
Question 60Monitoring & Logging
A company runs Java microservices on Amazon EKS. Leadership wants service level objectives, such as 99.9 percent of requests under 300 ms, tracked for each service. The team also needs automatically collected latency, error, and request metrics and a service map, without manually instrumenting code. Which solution BEST meets these requirements?
Correct answer: D. Enable CloudWatch Application Signals with auto-instrumentation and define SLOs per service.
Application Signals auto-instruments supported applications, collects request, latency, and error metrics with a service map, and lets you create SLOs. Synthetics canaries measure synthetic test traffic, not the real requests that the SLOs must track.
Application Signals auto-instruments supported applications, collects request, latency, and error metrics with a service map, and lets you create SLOs. Synthetics canaries measure synthetic test traffic, not the real requests that the SLOs must track.
Question 61Security & Compliance
A fintech company prepares for a PCI DSS audit every year. Engineers spend weeks collecting screenshots and configuration exports from dozens of accounts as evidence. The company wants evidence collected continuously and organized by control, with the least manual work. Which solution BEST meets these requirements?
Correct answer: A. Use AWS Audit Manager with the PCI DSS framework to create an assessment that gathers evidence automatically.
Audit Manager uses prebuilt frameworks to collect evidence continuously from AWS sources and maps it to each control in an assessment. AWS Artifact provides AWS's own compliance reports, which describe AWS controls, not evidence about the company's workloads.
Audit Manager uses prebuilt frameworks to collect evidence continuously from AWS sources and maps it to each control in an assessment. AWS Artifact provides AWS's own compliance reports, which describe AWS controls, not evidence about the company's workloads.
Question 62Config Management & IaC
A company must patch and harden its base AMI every month, run tests on it, and share the approved AMI with 30 accounts and two Regions, with as little custom scripting as possible. What should the DevOps engineer use?
Correct answer: B. EC2 Image Builder pipelines with distribution settings for accounts and Regions
EC2 Image Builder automates building, hardening, testing and distributing AMIs on a schedule, including cross-account and cross-Region sharing. A self-managed Packer cron job works but requires custom scripting and its own maintenance.
EC2 Image Builder automates building, hardening, testing and distributing AMIs on a schedule, including cross-account and cross-Region sharing. A self-managed Packer cron job works but requires custom scripting and its own maintenance.
Question 63Monitoring & Logging
A managed services provider must give three executives at a client company read-only access to one CloudWatch dashboard. The executives do not have AWS accounts. The provider does not want to create IAM users for them or make the dashboard public. Which solution BEST meets these requirements?
Correct answer: D. Share the dashboard with the executives' email addresses using CloudWatch dashboard sharing.
CloudWatch dashboard sharing can grant access to specific email addresses, and those users sign in with a username and password to view the dashboard without an AWS account. Public sharing lets anyone with the link see the dashboard, which the provider wants to avoid.
CloudWatch dashboard sharing can grant access to specific email addresses, and those users sign in with a username and password to view the dashboard without an AWS account. Public sharing lets anyone with the link see the dashboard, which the provider wants to avoid.
Question 64Security & Compliance
A company already runs policy-as-code checks in its CodePipeline pipelines. However, some teams deploy CloudFormation stacks directly from the console, which skips those checks. The company wants the same rules enforced on every CloudFormation stack operation in its accounts before resources are provisioned. Which solution BEST meets these requirements?
Correct answer: C. Activate a CloudFormation Hook in each account that evaluates resources against the rules before provisioning.
CloudFormation Hooks run inside the CloudFormation service for every stack operation, so they apply to console deployments as well as pipelines and can block noncompliant resources before creation. Adding pipeline rules does nothing for stacks deployed outside the pipeline.
CloudFormation Hooks run inside the CloudFormation service for every stack operation, so they apply to console deployments as well as pipelines and can block noncompliant resources before creation. Adding pipeline rules does nothing for stacks deployed outside the pipeline.
Question 65Config Management & IaC
A company stores an API key for a partner integration in Systems Manager Parameter Store. The key must be rotated every 90 days. The team wants an event 14 days before the key reaches 90 days old, and the parameter should expire if it is not rotated. Which solution BEST meets these requirements?
Correct answer: B. Store the key as an advanced parameter with Expiration and ExpirationNotification parameter policies.
Parameter policies such as Expiration and ExpirationNotification are available only for advanced parameters. They delete the parameter at expiry and send EventBridge events ahead of time. Standard parameters do not support policies, and a tag does nothing on its own.
Parameter policies such as Expiration and ExpirationNotification are available only for advanced parameters. They delete the parameter at expiry and send EventBridge events ahead of time. Standard parameters do not support policies, and a tag does nothing on its own.
Question 66Config Management & IaC
A company offers an EC2-based product through AWS Service Catalog. Users can currently choose any instance type, which has caused high costs. The company wants users to choose only from t3.medium and t3.large without editing the product template. Which solution BEST meets this requirement?
Correct answer: C. Add a template constraint to the product in the portfolio that limits the instance type parameter.
Template constraints apply rules to product parameters at launch time without changing the template. They can limit allowed values for the instance type. A launch constraint sets the role used for provisioning, not which parameter values users may choose.
Template constraints apply rules to product parameters at launch time without changing the template. They can limit allowed values for the instance type. A launch constraint sets the role used for provisioning, not which parameter values users may choose.
Question 67Monitoring & Logging
A company with 120 accounts in AWS Organizations wants its central operations team to see AWS Health events, such as scheduled maintenance and service issues, for all accounts from one account. The team also wants to query these events through the AWS Health API without signing in to each account. Which solution BEST meets these requirements?
Correct answer: A. Enable AWS Health organizational view and register the operations account as delegated administrator.
Organizational view aggregates AWS Health events for all member accounts, and a delegated administrator account can view and query them through the console and the organization Health API. Scripting calls into each account works but adds the per-account overhead the team wants to avoid.
Organizational view aggregates AWS Health events for all member accounts, and a delegated administrator account can view and query them through the console and the organization Health API. Scripting calls into each account works but adds the per-account overhead the team wants to avoid.
Question 68Security & Compliance
A company stores customer reports in an S3 bucket. A compliance review requires that all requests to the bucket use encrypted connections. Any request sent over plain HTTP must be rejected. Which solution BEST meets these requirements?
Correct answer: B. Add a bucket policy statement that denies all S3 actions when aws:SecureTransport is false.
A Deny statement with the aws:SecureTransport condition set to false rejects any request that does not use TLS. Default encryption protects data at rest only and has no effect on how requests travel over the network.
A Deny statement with the aws:SecureTransport condition set to false rejects any request that does not use TLS. Default encryption protects data at rest only and has no effect on how requests travel over the network.
Question 69Config Management & IaC
A company uses CloudFormation StackSets with service-managed permissions across its organization. Today only the management account can create stack sets. The security team wants a dedicated tooling account to manage stack sets so that daily work does not happen in the management account. Which solution BEST meets this requirement?
Correct answer: A. Register the tooling account as a StackSets delegated administrator and create stack sets there as DELEGATED_ADMIN.
A delegated administrator account can create and manage service-managed stack sets for the organization by calling as DELEGATED_ADMIN. This keeps daily work out of the management account. IAM users in the management account still put the work in that account.
A delegated administrator account can create and manage service-managed stack sets for the organization by calling as DELEGATED_ADMIN. This keeps daily work out of the management account. IAM users in the management account still put the work in that account.
Question 70Monitoring & Logging
A company's Auto Scaling groups sometimes fail to launch instances because of insufficient capacity or invalid launch template settings. The team notices only later, when capacity is already low. The team wants an immediate notification that includes the failure details whenever a launch fails, with the least effort. Which solution BEST meets these requirements?
Correct answer: C. Create an EventBridge rule for the EC2 Instance Launch Unsuccessful event that targets SNS.
Amazon EC2 Auto Scaling emits an EC2 Instance Launch Unsuccessful event to EventBridge with the failure cause, and a rule can forward it to SNS right away. An alarm on group metrics shows that capacity is low but gives no details about why the launch failed.
Amazon EC2 Auto Scaling emits an EC2 Instance Launch Unsuccessful event to EventBridge with the failure cause, and a rule can forward it to SNS right away. An alarm on group metrics shows that capacity is low but gives no details about why the launch failed.
Question 71Security & Compliance
A company wants every new Amazon EBS volume in its accounts to be encrypted, including volumes created by teams that forget to request encryption in their templates. Those volumes should still be created, but encrypted. The company wants a preventive setting with the least effort. Which solution BEST meets these requirements?
Correct answer: B. Turn on EBS encryption by default in each Region of each account, with a chosen KMS key.
EBS encryption by default makes every new volume in that Region encrypted, even when the request does not ask for encryption. An SCP on ec2:Encrypted would block those requests instead of creating encrypted volumes, which breaks the requirement that the volumes still be created.
EBS encryption by default makes every new volume in that Region encrypted, even when the request does not ask for encryption. An SCP on ec2:Encrypted would block those requests instead of creating encrypted volumes, which breaks the requirement that the volumes still be created.
Question 72Config Management & IaC
A company uses AWS Control Tower and wants to deploy CloudFormation templates and SCPs to accounts automatically whenever Account Factory creates a new account. The platform team wants to define the customizations in a manifest file stored in source control. Which solution BEST meets these requirements?
Correct answer: D. Deploy the Customizations for AWS Control Tower solution and define the resources in its manifest file.
Customizations for AWS Control Tower uses a manifest in source control and runs its pipeline on Control Tower lifecycle events, such as account creation. It can deploy both CloudFormation templates and SCPs. Detective controls only report compliance and do not deploy resources.
Customizations for AWS Control Tower uses a manifest in source control and runs its pipeline on Control Tower lifecycle events, such as account creation. It can deploy both CloudFormation templates and SCPs. Detective controls only report compliance and do not deploy resources.
Question 73Monitoring & Logging
A DevOps team uses AWS X-Ray to trace a multi-tenant API. Support engineers need to find all traces for a specific tenant ID by using filter expressions in the X-Ray console. The developers currently add the tenant ID to each segment as metadata, but filtering on it returns no results. Which change BEST meets this requirement?
Correct answer: A. Record the tenant ID as a segment annotation instead of as metadata.
X-Ray indexes annotations for use in filter expressions, while metadata is stored with the trace but cannot be searched. Raising the sampling rate records more traces but still leaves the tenant ID unsearchable.
X-Ray indexes annotations for use in filter expressions, while metadata is stored with the trace but cannot be searched. Raising the sampling rate records more traces but still leaves the tenant ID unsearchable.
Question 74Security & Compliance
A company uses a customer managed KMS key to encrypt objects in one S3 bucket in us-east-1. Security wants the application role to use the key only through Amazon S3 in that Region. The role must not be able to call KMS directly to decrypt arbitrary data. Which solution BEST meets these requirements?
Correct answer: B. Add a kms:ViaService condition for s3.us-east-1.amazonaws.com to the key policy statement for the role.
The kms:ViaService condition allows the key to be used only when the request comes through the named service in that Region, so direct KMS calls by the role are denied. A source IP condition restricts where requests come from but still allows direct KMS calls from that range.
The kms:ViaService condition allows the key to be used only when the request comes through the named service in that Region, so direct KMS calls by the role are denied. A source IP condition restricts where requests come from but still allows direct KMS calls from that range.
Question 75Config Management & IaC
A company stores operational settings, such as timeouts and retry limits, in AWS AppConfig as freeform JSON. Last month a typo in one value took down production. The company wants AppConfig to reject invalid configuration before it is deployed. Which solution BEST meets this requirement?
Correct answer: D. Attach a JSON Schema validator or Lambda validator to the configuration profile.
AppConfig validators check configuration data against a JSON Schema or a Lambda function before deployment. Invalid data is rejected and never reaches the application. Bake time only watches alarms after the configuration is already deployed.
AppConfig validators check configuration data against a JSON Schema or a Lambda function before deployment. Invalid data is rejected and never reaches the application. Bake time only watches alarms after the configuration is already deployed.
The real AWS DevOps Engineer Professional exam at a glance
75questions
3htime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS DevOps Engineer Professional exam. They are not real exam questions. AWS DevOps Engineer Professional and Amazon Web Services are trademarks of their owners. Real exam format: 75 questions (65 scored, 10 unscored) · 180 minutes · passing score 750 on a 100-1000 scale.