A DevOps engineer is planning to deploy a Ruby-based application to production. The
application needs to interact with an Amazon RDS for MySQL database and should have
automatic scaling and high availability. The stored data in the database is critical and
should persist regardless of the state of the application stack.
The DevOps engineer needs to set up an automated deployment strategy for the
application with automatic rollbacks. The solution also must alert the application team when
a deployment fails.
Which combination of steps will meet these requirements? (Select THREE.)
A. Deploy the application on AWS Elastic Beanstalk. Deploy an Amazon RDS for MySQL DB instance as part of the Elastic Beanstalk configuration.
B. Deploy the application on AWS Elastic Beanstalk. Deploy a separate Amazon RDS for MySQL DB instance outside of Elastic Beanstalk.
C. Configure a notification email address that alerts the application team in the AWS Elastic Beanstalk configuration.
D. Configure an Amazon EventBridge rule to monitor AWS Health events. Use an Amazon Simple Notification Service (Amazon SNS) topic as a target to alert the application team.
E. Use the immutable deployment method to deploy new application versions.
F. Use the rolling deployment method to deploy new application versions.
A DevOps engineer has implemented a Cl/CO pipeline to deploy an AWS Cloud Format ion
template that provisions a web application. The web application consists of an Application
Load Balancer (ALB) a target group, a launch template that uses anAmazon Linux 2 AMI an Auto Scaling group of Amazon EC2 instances, a security group and an Amazon RDS for
MySQL database The launch template includes user data that specifies a script to install
and start the application.
The initial deployment of the application was successful. The DevOps engineer made
changes to update the version of the application with the user data. The CI/CD pipeline has
deployed a new version of the template However, the health checks on the ALB are now
failing The health checks have marked all targets as unhealthy.
During investigation the DevOps engineer notices that the Cloud Formation stack has a
status of UPDATE_COMPLETE. However, when the DevOps engineer connects to one of
the EC2 instances and checks /varar/log messages, the DevOps engineer notices that the
Apache web server failed to start successfully because of a configuration error
How can the DevOps engineer ensure that the CloudFormation deployment will fail if the
user data fails to successfully finish running?
A. Use the cfn-signal helper script to signal success or failure to CloudFormation Use the WaitOnResourceSignals update policy within the CloudFormation template Set an appropriate timeout for the update policy.
B. Create an Amazon CloudWatch alarm for the UnhealthyHostCount metric. Include an appropriate alarm threshold for the target group Create an Amazon Simple Notification Service (Amazon SNS) topic as the target to signal success or failure to CloudFormation
C. Create a lifecycle hook on the Auto Scaling group by using the AWS AutoScaling LifecycleHook resource Create an Amazon Simple Notification Service (Amazon SNS) topic as the target to signal success or failure to CloudFormation Set an appropriate timeout on the lifecycle hook.
D. Use the Amazon CloudWatch agent to stream the cloud-init logs Create a subscription filter that includes an AWS Lambda function with an appropriate invocation timeout Configure the Lambda function to use the SignalResource API operation to signal success or failure to CloudFormation.
A company's DevOps team manages a set of AWS accounts that are in an organization in
AWS Organizations
The company needs a solution that ensures that all Amazon EC2 instances use approved
AMIs that the DevOps team manages. The solution also must remediate the usage of AMIs that are not approved The individual account administrators must not be able to remove the
restriction to use approved AMIs.
Which solution will meet these requirements?
A. Use AWS CloudFormation StackSets to deploy an Amazon EventBridge rule to each account. Configure the rule to react to AWS CloudTrail events for Amazon EC2 and to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic
B. Use AWS CloudFormation StackSets to deploy the approved-amis-by-id AWS Config managed rule to each account. Configure the rule with the list of approved AMIs. Configure the rule to run the the AWS-StopEC2lnstance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.
C. Create an AWS Lambda function that processes AWS CloudTrail events for Amazon EC2 Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic. Deploy the Lambda function in each account in the organization Create an Amazon EventBridge rule in each account Configure the EventBridge rules to react to AWS CloudTrail events for Amazon EC2 and to invoke the Lambda function.
D. Enable AWS Config across the organization Create a conformance pack that uses the approved -amis-by-id AWS Config managed rule with the list of approved AMIs. Deploy the conformance pack across the organization. Configure the rule to run the AWSStopEC2lnstance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.
A DevOps engineer is building a continuous deployment pipeline for a serverless
application that uses AWS Lambda functions. The company wants to reduce the customer
impact of an unsuccessful deployment. The company also wants to monitor for issues.
Which deploy stage configuration will meet these requirements?
A. Use an AWS Serverless Application Model (AWS SAM) template to define the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the Canary10Percent15Minutes Deployment Preference Type. Use Amazon CloudWatch alarms to monitor the health of the functions.
B. Use AWS CloudFormation to publish a new stack update, and include Amazon CloudWatch alarms on all resources. Set up an AWS CodePipeline approval action for a developer to verify and approve the AWS CloudFormation change set.
C. Use AWS CloudFormation to publish a new version on every stack update, and include Amazon CloudWatch alarms on all resources. Use the RoutingConfig property of the AWS::Lambda::Alias resource to update the traffic routing during the stack update.
D. Use AWS CodeBuild to add sample event payloads for testing to the Lambda functions. Publish a new version of the functions, and include Amazon CloudWatch alarms. Update the production alias to point to the new version. Configure rollbacks to occur when an alarm is in the ALARM state.
A company uses AWS CodeArtifact to centrally store Python packages. The CodeArtifact
repository is configured with the following repository policy.
A development team is building a new project in an account that is in an organization in
AWS Organizations. The development team wants to use a Python library that has already
been stored in the CodeArtifact repository in the organization. The development team uses
AWS CodePipeline and AWS CodeBuild to build the new application. The CodeBuild job
that the development team uses to build the application is configured to run in a VPC
Because of compliance requirements the VPC has no internet connectivity.
The development team creates the VPC endpoints for CodeArtifact and updates the
CodeBuild buildspec yaml file. However, the development team cannot download the
Python library from the repository.
Which combination of steps should a DevOps engineer take so that the development team
can use Code Artifact? (Select TWO.)
A. Create an Amazon S3 gateway endpoint Update the route tables for the subnets that are running the CodeBuild job.
B. Update the repository policy's Principal statement to include the ARN of the role that the CodeBuild project uses.
C. Share the CodeArtifact repository with the organization by using AWS Resource Access Manager (AWS RAM).
D. Update the role that the CodeBuild project uses so that the role has sufficient permissions to use the CodeArtifact repository.
E. Specify the account that hosts the repository as the delegated administrator for CodeArtifact in the organization.
Explanation: "AWS CodeArtifact operates in multiple Availability Zones and stores artifact data and metadata in Amazon S3 and Amazon DynamoDB. Your encrypted data is redundantly stored across multiple facilities and multiple devices in each facility, making it highly available and highly durable.
A company runs an application on one Amazon EC2 instance. Application metadata is
stored in Amazon S3 and must be retrieved if the instance is restarted. The instance must
restart or relaunch automatically if the instance becomes unresponsive.
Which solution will meet these requirements?
A. Create an Amazon CloudWatch alarm for the StatusCheckFailed metric. Use the recover action to stop and start the instance. Use an S3 event notification to push the metadata to the instance when the instance is back up and running.
B. Configure AWS OpsWorks, and use the auto healing feature to stop and start the instance. Use a lifecycle event in OpsWorks to pull the metadata from Amazon S3 and update it on the instance.
C. Use EC2 Auto Recovery to automatically stop and start the instance in case of a failure. Use an S3 event notification to push the metadata to the instance when the instance is back up and running.
D. Use AWS CloudFormation to create an EC2 instance that includes the UserData property for the EC2 resource. Add a command in UserData to retrieve the application metadata from Amazon S3.
A company has deployed an application in a production VPC in a single AWS account. The
application is popular and is experiencing heavy usage. The company’s security team
wants to add additional security, such as AWS WAF, to the application deployment.
However, the application's product manager is concerned about cost and does not want to
approve the change unless the security team can prove that additional security is
necessary.
The security team believes that some of the application's demand might come from users
that have IP addresses that are on a deny list. The security team provides the deny list to a
DevOps engineer. If any of the IP addresses on the deny list access the application, the
security team wants to receive automated notification in near real timeso that the security
team can document that the application needs additional security. The DevOps engineer
creates a VPC flow log for the production VPC.
Which set of additional steps should the DevOps engineer take to meet these requirements
MOST cost-effectively?
A. Create a log group in Amazon CloudWatch Logs. Configure the VPC flow log to capture accepted traffic and to send the data to the log group. Create an Amazon CloudWatch metric filter for IP addresses on the deny list. Create a CloudWatch alarm with the metric filter as input. Set the period to 5 minutes and the datapoints to alarm to 1. Use an Amazon Simple Notification Service (Amazon SNS) topic to send alarm notices to the security team.
B. Create an Amazon S3 bucket for log files. Configure the VPC flow log to capture all traffic and to send the data to the S3 bucket. Configure Amazon Athena to return all log files in the S3 bucket for IP addresses on the deny list. Configure Amazon QuickSight to accept data from Athena and to publish the data as a dashboard that the security team can access. Create a threshold alert of 1 for successful access. Configure the alert to automatically notify the security team as frequently as possible when the alert threshold is met.
C. Create an Amazon S3 bucket for log files. Configure the VPC flow log to capture accepted traffic and to send the data to the S3 bucket. Configure an Amazon OpenSearch Service cluster and domain for the log files. Create an AWS Lambda function to retrieve the logs from the S3 bucket, format the logs, and load the logs into the OpenSearch Service cluster. Schedule the Lambda function to run every 5 minutes. Configure an alert and condition in OpenSearch Service to send alerts to the security team through an Amazon Simple Notification Service (Amazon SNS) topic when access from the IP addresses on the deny list is detected.
D. Create a log group in Amazon CloudWatch Logs. Create an Amazon S3 bucket to hold query results. Configure the VPC flow log to capture all traffic and to send the data to the log group. Deploy an Amazon Athena CloudWatch connector in AWS Lambda. Connect the connector to the log group. Configure Athena to periodically query for all accepted traffic from the IP addresses on the deny list and to store the results in the S3 bucket. Configure an S3 event notification to automatically notify the security team through an Amazon Simple Notification Service (Amazon SNS) topic when new objects are added to the S3 bucket.
A company's DevOps engineer is creating an AWS Lambda function to process
notifications from an Amazon Simple Notification Service (Amazon SNS) topic. The
Lambda function will process the notification messages and will write the contents of the
notification messages to an Amazon RDS Multi-AZ DB instance.
During testing a database administrator accidentally shut down the DB instance. While the
database was down the company lost several of the SNS notification messages that were
delivered during that time.
The DevOps engineer needs to prevent the loss of notification messages in the future
Which solutions will meet this requirement? (Select TWO.)
A. Replace the RDS Multi-AZ DB instance with an Amazon DynamoDB table.
B. Configure an Amazon Simple Queue Service (Amazon SQS) queue as a destination of the Lambda function.
C. Configure an Amazon Simple Queue Service (Amazon SQS> dead-letter queue for the SNS topic.
D. Subscribe an Amazon Simple Queue Service (Amazon SQS) queue to the SNS topic Configure the Lambda function to process messages from the SQS queue.
E. Replace the SNS topic with an Amazon EventBridge event bus Configure an EventBridge rule on the new event bus to invoke the Lambda function for each event.
Explanation: These solutions will meet the requirement because they will prevent the loss
of notification messages in the future. An Amazon SQS queue is a service that provides a
reliable, scalable, and secure message queue for asynchronous communication between
distributed components. You can use an SQS queue to buffer messages from an SNS
topic and ensure that they are delivered and processed by a Lambda function, even if the
function or the database is temporarily unavailable.
Option C will configure an SQS dead-letter queue for the SNS topic. A dead-letter queue is
a queue that receives messages that could not be delivered to any subscriber after a
specified number of retries. You can use a dead-letter queue to store and analyze failed
messages, or to reprocess them later. This way, you can avoid losing messages that could
not be delivered to the Lambda function due to network errors, throttling, or other issues.
Option D will subscribe an SQS queue to the SNS topic and configure the Lambda function
to process messages from the SQS queue. This will decouple the SNS topic from the
Lambda function and provide more flexibility and control over the message delivery and processing. You can use an SQS queue to store messages from the SNS topic until they
are ready to be processed by the Lambda function, and also to retryprocessing in case of
failures. This way, you can avoid losing messages that could not be processed by the
Lambda function due to database errors, timeouts, or other issues.
A company's DevOps engineer uses AWS Systems Manager to perform maintenance
tasks during maintenance windows. The company has a few Amazon EC2 instances that
require a restart after notifications from AWS Health. The DevOps engineer needs to
implement an automated solution to remediate these notifications. The DevOps engineer
creates an Amazon EventBridge rule.
How should the DevOps engineer configure the EventBridge rule to meet these
requirements?
A. Configure an event source of AWS Health, a service of EC2. and an event type that indicates instance maintenance. Target a Systems Manager document to restart the EC2 instance.
B. Configure an event source of Systems Manager and an event type that indicates a maintenance window. Target a Systems Manager document to restart the EC2 instance.
C. Configure an event source of AWS Health, a service of EC2, and an event type that indicates instance maintenance. Target a newly created AWS Lambda function that registers an automation task to restart the EC2 instance during a maintenance window.
D. Configure an event source of EC2 and an event type that indicates instance maintenance. Target a newly created AWS Lambda function that registers an automation task to restart the EC2 instance during a maintenance window.
Explanation: AWS Health provides real-time events and information related to your AWS
infrastructure. It can be integrated with Amazon EventBridge to act upon the health events
automatically. If the maintenance notification from AWS Health indicates that an EC2
instance requires a restart, you can set up an EventBridge rule to respond to such events.
In this case, the target of this rule would be a Lambda function that would trigger a Systems
Manager automation to restart the EC2 instance during a maintenance window.
Remember, AWS Health is the source of the events (not EC2 or Systems Manager), and
AWS Lambda can be used to execute complex remediation tasks, such as scheduling
maintenance tasks via Systems Manager.
The following are the steps involved in configuring the EventBridge rule to meet these requirements:
Configure an event source of AWS Health, a service of EC2, and an event type
that indicates instance maintenance.
Target a newly created AWS Lambda function that registers an automation task to
restart the EC2 instance during a maintenance window.
The AWS Lambda function will be triggered by the event from AWS Health. The function
will then register an automation task to restart the EC2 instance during the next
maintenance window.
A company is reviewing its 1AM policies. One policy written by the DevOps engineer has
been (lagged as too permissive. The policy is used by an AWS Lambda function that
issues a stop command to Amazon EC2 instances tagged with Environment:
NonProduccion over the weekend. The current policy is:
What changes should the engineer make to achieve a policy ot least permission? (Select
THREE.)
A. Option A
B. Option B
C. Option C
D. Option D
E. Option E
F. Option F
Explanation:
The engineer should make the following changes to achieve a policy of least permission:
A: Add a condition to ensure that the principal making the request is an AWS
Lambda function. This ensures that only Lambda functions can execute this policy.
B: Narrow down the resources by specifying the ARN of EC2 instances instead of
allowing all resources. This ensures that the policy only affects EC2 instances.
D: Add a condition to ensure that this policy only applies to EC2 instances tagged
with “Environment: NonProduction”. This ensures that production environments
are not affected by this policy.
A company is testing a web application that runs on Amazon EC2 instances behind an
Application Load Balancer. The instances run in an Auto Scaling group across multiple
Availability Zones. The company uses a blue green deployment process with immutable
instances when deploying new software.
During testing users are being automatically logged out of the application at random times.
Testers also report that when a new version of the application is deployed all users are
logged out. The development team needs a solution to ensure users remain logged m
across scaling events and application deployments.
What is the MOST operationally efficient way to ensure users remain logged in?
A. Enable smart sessions on the load balancer and modify the application to check tor an existing session.
B. Enable session sharing on the toad balancer and modify the application to read from the session store.
C. Store user session information in an Amazon S3 bucket and modify the application to read session information from the bucket.
D. Modify the application to store user session information in an Amazon ElastiCache cluster.
A company hired a penetration tester to simulate an internal security breach The tester
performed port scans on the company's Amazon EC2 instances. The company's security
measures did not detect the port scans.
The company needs a solution that automatically provides notification when port scans are
performed on EC2 instances. The company creates and subscribes to an Amazon Simple
Notification Service (Amazon SNS) topic.
What should the company do next to meet the requirement?
A. Ensure that Amazon GuardDuty is enabled Create an Amazon CloudWatch alarm for detected EC2 and port scan findings. Connect the alarm to the SNS topic.
B. Ensure that Amazon Inspector is enabled Create an Amazon EventBridge event for detected network reachability findings that indicate port scans Connect the event to the SNS topic.
C. Ensure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected CVEs that cause open port vulnerabilities. Connect the event to the SNS topic
D. Ensure that AWS CloudTrail is enabled Create an AWS Lambda function to analyze the CloudTrail logs for unusual amounts of traffic from an IP address range Connect the Lambda function to the SNS topic.
| Page 8 out of 21 Pages |
| Previous |